The visibility trap

Many organisations feel that their awareness is in order. There are posters by the coffee machine, a mailing goes out every month, and the intranet carries a campaign with practical advice. The reasoning behind this is obvious. After all, a great deal is communicated about safe behaviour, and from there it is a short step to the thought that an awareness programme is in place. Equating visibility with a programme is understandable, but it is not correct.

This report examines two questions that lie beneath it. The first is whether a communication campaign is something fundamentally different from a behaviour programme. The second is when communicating loses its effect, that is, at what point more messages no longer help and even start to backfire. It sets out what the scientific research shows about this, and which approach follows from it.

For both questions it is important first to be clear about what we mean by a programme in this report. A programme is not a series of separate messages, but a continuous and managed whole that is aimed at behaviour. It establishes in advance which behaviour it wants to achieve, chooses suitable means to match, including training, exercises and communication, then measures whether that behaviour actually changes, and adjusts on the basis of that measurement. In other words, it is a cycle that sustains itself and is aimed at a goal. A campaign, by contrast, stands as a single or recurring message in its own right, and it can be a valuable part of a programme without ever coinciding with it.

01 · FindingVisibility is a layer, not a programme

The difference between communicating and a programme is not a play on words, but is set out in the guideline that the field uses for this. In its revised guideline, the US standards organisation NIST distinguishes three levels of learning: awareness, training and education (NIST SP 800-50r1, 2024). Awareness focuses people's attention on a topic, training teaches them a skill with which they can perform a task, and education is the in-depth, often career-oriented form. Posters, mailings and intranet campaigns almost all fall under the first level. They ask for attention, but they do not teach a skill and they do not on their own steer behaviour.

More important still is what the guideline understands by a programme. The 2024 revision describes a learning programme not as a series of messages, but as a managed cycle with a life cycle: you set goals, you align the content with roles and target groups, you measure the effect, and you adjust. Awareness campaigns are one of the building blocks within that cycle, alongside role-based training, exercises and targeted interventions. Equating a campaign with a programme is therefore a category mistake, because you confuse one layer with the whole.

Behavioural science makes the same distinction along a different route. The widely used Behaviour Change Wheel, which we also apply in The participation paradox, distinguishes nine types of intervention with which you can influence behaviour, and education is only one of them (Michie, van Stralen and West, 2011). Communicating mainly affects people's knowledge. It largely leaves untouched the other levers that behaviour hangs on, such as motivation and the practical opportunity. Whoever only communicates therefore operates one lever and leaves the other eight unused.

02 · FindingCommunicating often does not change behaviour

That campaigns do not always change behaviour is not a new insight. In a much-cited study, Bada, Sasse and Nurse analysed why awareness campaigns so often fail to change behaviour (Bada, Sasse and Nurse, 2015). Their conclusion was clear. Knowledge and awareness are a necessary condition, but on their own not enough. To change behaviour, people must be able to understand and apply the advice, and they must in addition be willing to do so. That willingness calls for a change in attitude and intention, and that does not arise automatically by spreading more information.

This is the well-known gap between knowing and doing. People know that they should use a strong password, that they should not just click on a link, and that they should store data properly, but behaviour does not automatically follow knowing. The Behaviour Change Wheel explains why this is so. Safe behaviour only arises when the knowledge and skill, the motivation and the opportunity to do the right thing come together (Michie, van Stralen and West, 2011). A campaign that only gives information fills, at most, the first box. Motivation and opportunity then remain untouched, and it is precisely there that behaviour often goes wrong.

03 · ExplanationWhen communicating starts to backfire

The second question is when communicating not only yields little, but starts to backfire outright. The research points to two mechanisms that together explain why more of the same undermines attention: habituation and message fatigue.

The first mechanism is habituation, and that runs deeper than a question of motivation. In a series of brain studies, Anderson and colleagues used functional MRI to map how the brain responds to repeated security warnings (Anderson et al., 2015). Activity in the visual processing areas dropped sharply as early as the second exposure, and fell further with each subsequent repetition. A follow-up study in practice confirmed that picture. In a three-week field experiment, the degree to which people heeded warnings clearly declined the more often they came by (Vance et al., 2018). The message that always has the same form is registered less and less, even in the brain. What stands out is that warnings that kept changing form resisted this effect far better. Variation holds attention, whereas repeating exactly the same thing makes attention slacken.

The second mechanism is message fatigue, a concept from communication science. So, Kim and Cohen mapped how people respond when they are exposed for a long time to messages about the same topic (So, Kim and Cohen, 2017). What is involved is a state of exhaustion that arises from excess, repetition and monotony, and that leads people to start ignoring the message. Follow-up research showed that message fatigue undermines persuasiveness along two routes: through active resistance, where people start to resist the message, and through passive disengagement, where they simply no longer pay attention (Kim and So, 2018). What is worrying is that excess not only removes the effect, but can even make the desired action less likely than if nothing had been communicated. Comparable effects have been described in communication about climate and health, where too much of the same message actually lowered the willingness to take part.

In the security context this has acquired a name of its own. Researchers at NIST came across what they call security fatigue in interviews, a tiredness and unwillingness to engage with security any further (Stanton et al., 2016). People felt bombarded with warnings along the lines of watch out for this and watch out for that, and responded with resignation, a sense of loss of control, the trivialising of risks and the avoidance of decisions. The researchers therefore recommend keeping the number of security decisions you ask of people as small as possible.

These mechanisms come together in a sober economic idea, the compliance budget. Beautement, Sasse and Wonham showed that people follow security rules only up to a point, after which their willingness declines (Beautement, Sasse and Wonham, 2008). There is, in other words, a finite amount of attention and cooperation available, and above that limit every extra demand becomes harmful rather than useful. Every poster and every mailing costs something of that budget. Whoever keeps sending without counting those costs runs out of supply and has nothing left for the moment when it really matters.

04 · ApproachFrom campaign to programme

If communicating is one lever and not a programme, and if more of the same starts to backfire at some point, then a different way of working follows from that. The core is to treat communication as a part of a programme that steers behaviour, and not as the programme itself.

1. Treat communication as one lever within a managed cycle.Give the programme a life cycle instead of an agenda of separate messages: set goals, align the content with roles and target groups, measure the effect and adjust (NIST SP 800-50r1, 2024). A campaign is then an instrument within that cycle, and not its conclusion.
2. Design for behaviour instead of for visibility.For every intervention, ask which part of behaviour you are influencing. A single message affects knowledge at most, whereas behaviour also requires motivation and opportunity (Michie, van Stralen and West, 2011). So make sure that the safe behaviour is not only known, but also attractive and easy to do.
3. Vary the form to counter habituation.Do not repeat the same poster or mailing endlessly, because that is exactly what makes attention slacken. Vary form, channel and angle, so that the message is noticed afresh each time (Anderson et al., 2015; Vance et al., 2018).
4. Respect the attention and compliance budget.Opt for fewer but more targeted and well-timed messages, and limit the number of decisions you ask of people (Stanton et al., 2016; Beautement, Sasse and Wonham, 2008). Every unnecessary message costs part of a supply that you do better to save for the moment that it matters.
5. Measure behaviour and effect instead of the number of messages.Do not count how many posters were up or how many mailings went out, but look at what people actually do, such as reporting suspicious messages. That such a skill, recognising phishing, does not improve by itself from exposure alone, we set out in The Attention Problem. Under the NIS2 directive, the duty of care for resilient behaviour is moreover a responsibility of the management body, and getting that leadership on board is a task in its own right, as we showed in The Buy-in Problem. That responsibility is easier to substantiate with behavioural figures than with a tally of outputs.

05 · ConclusionVisibility is a start, not a programme

A communication campaign is something fundamentally different from a behaviour programme. Visibility focuses attention, but it does not teach a skill and it does not on its own steer behaviour. A programme combines that visibility with training, with attention to motivation and opportunity, with measurement and with adjustment, and it does so as a managed cycle instead of as a series of separate messages. Whoever equates the two confuses a layer with the whole.

And communicating loses its effect as soon as repetition makes attention slacken and fatigue takes over. Through habituation the response drops as early as the second exposure, through message fatigue repetition can even backfire, and the attention and compliance budget is simply finite. The right question is therefore not whether a great deal has been communicated, but whether behaviour and culture have been durably changed. Visibility is a start in this, and not a programme.