Using Positive Emotions Like Fun and Appreciation to Improve Security Behavior in the Workplace
Andrew R. Tbh, I'd go with this kind of approach. Using emotions is in my opinion the most effective way to change or push certain behaviours.
I try to trigger "fun" by adding some gamification to our security campaigns like team rankings and challenges, for example on our Display in our bistro.
I also try to trigger "curiosity" by having 1on1 dialogues with colleagues and showing them what is actually going on behind the scenes of our security measures like "how we secure our organization".
And I trigger "appreciation/trust" by handing out mini lego fishermen with a handwritten card to colleagues who report really dangerous phishing emails or do really good in our e-learnings.
I'd always try to avoid negative emotions more than necessary and focus on positive ones instead. But I think it heavily depends on the company culture. Highly regulated organisations might see things a bit differently. 😅