Think about the message your bank sends when it spots a purchase that doesn’t fit your usual habits. It shows the amount, the merchant and a question, do you recognise this purchase?, with two possible answers. It doesn’t explain how card fraud works or ask you to go to any site to verify your details, so we read the whole thing on the lock screen, answer with one tap and carry on with whatever we were doing. What is so special about it? Not much, really. It works because it does one thing and does it in the moment, and that is the same thing we ask of a nudge.
We have already written about when a nudge should arrive, and timing is still a central part of the work. Here we will deal with the other part, which is how to write a security nudge so that it gets read. A nudge that arrives on time but is written like a memo gets read like a memo, and ends up filed away all the same.
What does the text of a nudge have to do?
A nudge is a short message that tries to tilt a security decision towards the side that protects the person, without forcing them into anything and while that decision is still open. The definition already says a lot about how it has to be written. Since it doesn’t compel anything, it only works if the person understands it straight away, in the few seconds they give a notification.
That is why the text of a nudge has one main task, which is to raise a question tied to the event that triggered the message, one the person can answer in the moment. If we compare “please remember to review your transactions regularly” with “do you recognise this purchase?”, we can see that the first sentence describes a good habit while the second raises something that can be answered right now. The same happens in security, and when a nudge opens with “remember that it is important to check senders”, the person receiving it recognises the tone of the policy straight away and treats it as one more notice.
The temptation to say everything in a single message is strong, because the space seems small and the subject has plenty to say. That said, what doesn’t fit in the nudge has its place elsewhere in the programme, since the background explanation lives in the content and the correction after a mistake lives in the Teachable Moments. The nudge can be incomplete because it doesn’t work alone.
An example of how to write a security nudge
Say we create a phishing simulation campaign with an email that imitates an unpaid invoice, and we set up a nudge to arrive at the moment the campaign is sent. The first version that usually comes out looks something like this:
“Security reminder: in accordance with the current policy, before opening any attachment it is important to verify that the sender is trustworthy and that the email is legitimate.”
Where does it fall short? What it says is correct, but it makes the reader get through a long sentence to reach a generic instruction. It also cites the policy instead of speaking to the person, and it has no connection to anything in their inbox at that moment. If we rewrite it with a single question tied to the event, it comes closer to this:
“Did you get an invoice you weren’t expecting? Do you recognise who sent it?”
The second version makes complete sense in the preview, names something the person can recognise in their inbox and raises a doubt that can be settled in a second. It doesn’t mention the simulation or the policy, because its job is to get the person to pause before the click, and for that it is enough for them to ask themselves a question at the right moment. If they click anyway, that is where the Teachable Moment comes in, which is the place where it makes sense to explain what happened and how to recognise the trick next time.
What types of nudges are there, depending on the mechanism they use?
Two nudges triggered by the same event can push in very different ways, and choosing the mechanism before writing is what puts everything else in order. Three mechanisms are enough to see the difference:
| Mechanism | What it does | When it works | An example | Where it crosses the line |
|---|---|---|---|---|
| Emotional | Appeals to what the person wants to protect | When the action protects something close: their data, their team, their work | “Your team’s work is behind your password too.” | When protecting turns into frightening |
| Social | Draws on what the people around them do | When the behaviour is already common and it makes sense to make it visible | “When someone on your team reports a suspicious email, the rest of the team gains time.” | When the claim isn’t true or sounds like surveillance |
| Visual | Shows the gesture instead of describing it | When the action depends on finding a button or a signal | A screenshot of the report button with the line “Here it is, in case you need it” | When the image doesn’t display in the chosen channel |
Choosing a single mechanism per nudge puts the rest of the text in order. When a message tries to move the reader, show what the rest of the team does and explain where the button is all at once, it ends up long and directionless, and the person doesn’t know which of the three things to hold on to. If the trigger lends itself to more than one mechanism, it is better to write two different nudges and alternate them than to combine them in one.
The social mechanism has a condition the others don’t, which is that it only works if what it claims is true in that organisation. Saying that “most people already report” when that isn’t the case is something the person can check against what they see around them. And when the claim doesn’t match, they stop believing the rest of the messages too. If there is no number to back the sentence up, the alternative is to talk about what is expected of the team, which is something the programme can say.
When the nudge congratulates instead of correcting
We tend to think of the nudge as something that stops a mistake, but some of the triggers are behaviours that went well, such as reporting a phishing simulation, completing a piece of content or passing an exam. In those cases the message has nothing to correct, and it still serves an important purpose, which is to let the person know that the gesture was noticed and that it was the right one.
The risk here is the generic thank-you. “Thanks for taking part!” reads as an automated text, the same for any person who receives it, and it reinforces nothing because it names nothing specific. The recognition that works says what the person did and why it helps, for example: “You reported today’s simulation with the button. That is what to do with an email that asks for something unexpected, and it is what lets us react in time when the email is real.”
This kind of nudge sustains something that is easily lost, which is the sense that reporting makes a difference. When someone reports and gets no response, the habit fades away without any decision being made, and a short message in the moment is the simplest way to prevent that. It also rests on an idea that runs through the whole programme, because awareness that protects is built more on what the person does well than on the list of what they did wrong.
How does the text of a nudge change depending on the channel?
The same nudge doesn’t read the same way in an inbox as in a work chat, which is why each channel needs its own title and its own text. In email, the subject line is the part of the nudge most people will read, and often the only part, so it has to work on its own. “Security notice” is a subject line that says nothing, whereas “Did you get an invoice you weren’t expecting?” already raises the important question before the person opens the message.
In Slack or Microsoft Teams the message appears in the same space where people talk to their team, and that changes the register. A text with the tone of an official announcement feels out of place between two work messages, while a shorter, more direct one reads as what it should be, someone on the team letting you know something useful. These channels also accept an image, which is where the visual mechanism finds its best place.
One practice that helps is to write the shortest version first, the title or the subject line, and the body afterwards. If the short version doesn’t make sense on its own, adding text underneath won’t fix it, because the person who decided from the preview is not going to read it.
What should a nudge never say?
Some messages are written with the best of intentions and end up working against the goal. Most of them fall into one of these families:
- The one that frightens. “Your account may have been compromised” grabs attention for an instant and leaves behind a sense of threat that the person associates with the programme. The aim is for the person to learn to recognise the trap, and fear tends to teach them to avoid the messages that remind them of it.
- The one that reproaches. “You clicked on a phishing link again” speaks to the person as if the mistake were a trait of theirs. The mistake is a one-off event and the message has to treat it that way, explaining what happened and what to do next time.
- The one that quotes the policy. “In accordance with the current security policy” moves the conversation from care to rules, and the reader hears a formal warning where they were expecting advice.
- The one that speaks in jargon. Terms like “spoofed domain” or “attack vector” are precise for people who work in security and opaque for a large part of the organisation, and a nudge that needs decoding loses the little attention time it had.
- The one that looks like phishing. This is the most delicate family, because an email nudge with urgency, a logo and a “verify now” button teaches the opposite of what the programme is after. The bank’s message also works because of what it doesn’t do, which is ask for your PIN or send you to a link, and a security nudge has to be equally recognisable for what it doesn’t ask for.
How do you review a nudge before switching it on?
Before switching a nudge on, it helps to read it the way the person will, in the real channel and with the little time they will give it. These questions help catch most problems:
- Does it make sense from what shows in the preview, whether that is the email subject line or the chat title?
- Does it raise a single thing, and can it be resolved right there?
- Does it name the specific event that triggered it, or could it have reached any person at any moment?
- Could someone mistake it for an attack?
- Would a person send it like this to someone on their team?
In SMARTFENSE, Nudges include a gallery of predefined messages with several options for each trigger, and each option uses a different mechanism to influence behaviour, such as emotional, social or visual, among others. That makes it possible to choose the mechanism without writing from scratch.
When the text needs adjusting to the way the organisation talks, every nudge can be fully customised, with its own title and message for email, Slack and Microsoft Teams, and in each language. Before switching it on, you can send a test to your own inbox to see it as the person will receive it, which is the most direct way to review it.
If we later want to know whether a nudge is changing anything, measurement has its own methods. A good idea is to use them to compare mechanisms, because the text that sounds best in a meeting may not be the one most people read.
One question and two answers
In the end, the bank’s message works because it respects the little time we give it, asks for something we can do with one tap and never asks for what someone trying to defraud us would. A well-written security nudge has more in common with that message than with any formal announcement. The next time we have to write one, before polishing the sentence, let’s ask ourselves whether someone could answer it from the lock screen. If the answer is yes, the nudge is already doing its job.
Leave a Reply