Why a security habit collapses when the context changes

A field study published in 2011 set out to answer a simple question about habits. When someone buys popcorn at the cinema, do they eat it because they like it or because they are used to eating it there?

To find out, boxes of popcorn were handed to cinema-goers, some freshly made and some seven days old, and how much each person ate was measured. The people who arrived with a strong habit of eating popcorn at the cinema rated the stale batch as unpleasant, and ate roughly 63% of the box anyway, almost as much as the people who had been given fresh popcorn.

The handout was then repeated with a different group of people, this time in a meeting room where films were shown on video. There, taste took over again, and those who got the stale popcorn ate about half as much as those who got the fresh.

The habit was stuck to the cinema. Inside that context the behaviour kept coming out even when the food was unpleasant. Outside it, the behaviour went back to depending on how much the food was liked.

The finding is uncomfortable because it casts doubt on a fairly widespread assumption, that people act mainly on what they know or what they decide. In why phishing is not a knowledge problem I set out why knowing the right answer is not enough for that answer to govern behaviour. What interests me here is the question that follows. If neither knowledge nor the intention of the day governs it, then what does.

Why isn’t wanting to change a security habit enough?

A habit is a learned link between a context and a response. That is why, when the cue from that context reappears, the behaviour can run even if preferences or intentions have already changed. Motivation moves the intention. The cue moves the habit.

In another study, Wood, Tam and Guerrero Witt followed 115 students transferring to a new university and watched what happened to three everyday habits, exercising, reading the newspaper and watching television. Where the new setting kept the same cues and situations associated with those behaviours, the habits tended to hold. Someone who read the paper in company, and still had company, kept reading it. Where the context changed a great deal, the habits weakened and intention regained weight, so the person did what they actually wanted to do.

Changes in circumstances also shifted intentions, but that on its own was not enough to account for the lapses. Intention tells us what we want to do. Context tends to determine what we end up doing.

Which security behaviours can become habits?

The ones repeated in stable contexts that end up associated with the cues of those contexts. That is where the quiet problem of many programmes sits, in the years they spend trying to automate a judgement.

Phishing detection is not a good candidate for full automation. Every email carries different information, the response depends on the case, and often several signals have to be weighed before deciding. Repeating the training improves that judgement, and even so it does not turn good judgement into an automatic response.

What can be designed are habits built around that judgement.

1. If an email asks for credentials, do not use the link in the message and go in through the bookmark.
2. If a payment request arrives outside the usual circuit, verify it through the known channel.
3. If something looks suspicious, report it through the established tool.

The distinction matters. What gets automated is the action in response to a given cue, and the decision remains a judgement.

Benjamin Gardner, Amanda Rebar and Phillippa Lally reviewed in 2022 how habit formation is studied outside the laboratory, and wrote down two conditions. A habit develops when the behaviour is repeated in a consistent context. And it does not form unless something first changes in the motivation, the capability or the opportunity to act. That second condition is the one that usually goes missing. A programme does not install a habit by repeating a message for months, it has to create the conditions for a concrete behaviour to exist.

Does asking someone to commit to being more careful work?

Plans that name a trigger work better than plans that name a date. The evidence on implementation intentions, plans with the format “if X arises, then I will do Y”, gathers 642 independent tests. The overall effect is small and the review itself reports substantial publication bias, so the point rests on the internal comparison rather than on the size. Plans with a contingent format returned d = 0.43 against 0.29 for those with a schedule format, which say when and where without tying the action to a condition.

Translated into a programme, the difference is plain to see. “This quarter we are going to pay more attention to payment requests” states an intention and specifies neither what should trigger the behaviour nor what to do at that moment. “If a payment request arrives outside the usual tool, then I call the person on the number I already have saved” turns a concrete situation into a concrete instruction.

That still does not make the behaviour a habit. What the plan does is prepare the response to a given cue in advance, and if that pairing is then repeated in a stable context, it can become part of a habitual behaviour.

A nudge uses a similar logic from the outside, because it introduces the cue at the moment the behaviour has to happen. The implementation intention does something different, in that the person decides in advance which cue they will recognise and what they will do when it appears. The difference lies in who supplies the cue, the environment in one case and the plan itself in the other.

When is the right moment to intervene to build a habit?

When the context that held the old habit up has just broken. It is the moment when the cue stops firing on its own and the behaviour comes back under the control of intention, which is exactly the condition a programme needs and almost never picks.

That turns a list of operational events into the best intervention calendar available. The moments are a new hire, the mail client migration, a team reorganisation, a change of office or working pattern, and the handover of a new laptop. In all of them the environmental cues change at once, and the routines the person brought with them stop being propped up by anything.

The same 2022 review makes the point for major life events, such as moving home or a workplace relocation, which open up the possibility of building new links between cue and behaviour. Part of those cues, moreover, is what the team around the person does, a layer I worked through separately in the shortcut that becomes the norm.

The flip side of that same moment is that it puts the good habits that already existed at risk. Someone who reported suspicious emails with a button that was always in the same place on the bar no longer has that button where it was. The intention to report is still there, and the link that executed it without thinking is not. It is worth adding the layer of training expiry and new hires here, because these are the same events read from the operational side of the programme.

That window has a limit worth keeping in mind. It is narrow and it closes on its own, because the new context starts producing routines of its own as soon as it settles. Arriving early there matters more than arriving complete.

Where this leaves the programme’s work

Little changes in the content and a good deal changes in the unit and the timing. The behaviour is chosen by its shape rather than by its importance, and the intervention is placed where the context breaks.

Two pieces of the SMARTFENSE programme work on that plane. The phishing report button is the behaviour that lends itself best to becoming a habit, because the cue always looks much the same and the response is a single one, available without leaving the inbox. And the campaign calendar makes it possible to fire the intervention against the event instead of against the date, which is the difference that counts in a new hire or a migration.

The platform also keeps the record of what each person received and when, which is what later shows whether the intervention landed inside the window or after it.

A programme that aims at willpower has to win every day. One that aims at the cue wins once, and after that the context holds it up on its own.