Risk Communication in Security Using Mental Models

In computer security, risk communication refers to a mechanism used to inform computer users against a given threat. Efficacy of risk communication depends not only on the nature of the risk, but also alignment between the conceptual model of the risk communicator and the user’s perception or mental model of the risk. The gap between the mental model of the security experts and non-experts could lead to ineffective and poor risk communication. Our research shows that for a variety of the security risks self-identified security experts and non-experts have different mental models. We propose that the risk communication methods should be designed based on the non-expert’s mental models with regard to each security risk.