Position Statement: Risk Perception and the Acceptance of New Security Technology

Risk perception and communication research in IT security has largely relied on studies addressing specific risks or threats and investigating how users assess or react to these. This approach offered valuable insights for the design of countermeasures against specific threats, such as phishing warnings or anti-virus protection. However, for the deployment of new and better IT security technology, the role of risk perception has not been properly analyzed yet. In previous studies, we found that users are interested in additional security measures, such as alternative authentication mechanisms or message encryption, but do not adopt them in everyday life. They showed little awareness of different sources of risks and therefore treated the Internet as a generally unsafe environment where nothing can be done to improve one’s situation. In this position paper, we discuss why it is important to study and understand which and how risks are actually perceived by users during everyday Internet use without being asked about specific threats. We postulate that an understanding for the development of everyday risk perception will help to promote IT security technology.