Security Nudge

A security nudge is a lightweight intervention that makes the secure behavior the easier or more obvious choice at the moment a decision is made, without removing the person's freedom to choose. The term comes from behavioral economics, where a "nudge" is any change to the way options are presented that predictably shifts behavior. In security, common nudges include an "external sender" banner on email, a warning when a reply is about to go to a look-alike domain, a prompt asking "did you verify this by phone?" before a payment above a threshold is approved, a reminder in the expense tool that gift cards are never a valid purchase, or a friendly message the first time a new employee receives an attachment from outside the organization.

How it works

Nudges work because most social-engineering failures are not knowledge failures. Employees who know perfectly well that they should verify a bank-change request still skip the step when they are busy, when the request comes from a senior person, or when nothing in the interface suggests anything is unusual. A nudge injects a cue exactly at that point. It does not need the person to remember a course from eight months ago — which the decay research suggests they will not — because it carries the reminder into the moment. Nudges are also cheap in attention: a two-line banner costs seconds, whereas a training module costs minutes the organization does not have. The SANS 2025 Security Awareness Report found that lack of time and staffing is the primary obstacle awareness programs face; nudges scale without staff.

How to use them well

Be selective. A nudge that appears on every email becomes wallpaper within a week; the "external sender" banner is often ignored for precisely this reason. The most effective nudges are conditional — they fire on the combination of signals that actually predicts risk, such as an external sender plus a payment keyword plus a first-time correspondent. Write them as questions or actions ("Call the vendor on the number in your records before approving?") rather than warnings, and give a one-click route to the safe action, such as reporting the message. Nudges complement rather than replace just-in-time training and security awareness training, and they are especially valuable in the first 90 days of employment, when — as our new hire security onboarding guide explains — a new starter has no baseline of what normal looks like. Track how often each nudge fires and how often the person then takes the safe action; that ratio is a behavior signal worth feeding into a human risk score, and it is one of the practical levers for building a durable security culture.