Sociocultural Orientation and Perceived Utility of Base Rates in Self and Social Judgments of Cyber Risk

Abstract

Despite ground-breaking technological advances, scientists still have difficulty patching one of the most threatening bugs in the cyber world: human error. Individuals constitute a unique vulnerability in cybersecurity because they systematically make errors when perceiving their own risk. Specifically, individuals underestimate their own susceptibility to cyber-attacks. Among the most common ways companies seek to improve security is presenting clients and employees with base rate information on the prevalence of cyber threats and the likelihood of the general population to succumb to them. This strategy is intended to increase the accuracy with which clients and employees assess their threat levels. However, outcomes typically fall short of this goal. We review the differential use of base rate information as a cognitive and motivational bias that contributes to forecasting errors and accuracy in self and social risk assessment. We also examine two dimensions of sociocultural orientation: individualism-collectivism and tightness-looseness-and their potential influence on the use of base rate information. We discuss implications for interventions that could mitigate the threat of cyber-attacks