Hacking the Human: The Prevalence Paradox in Cybersecurity.
OBJECTIVE
This work assesses the efficacy of the "prevalence effect" as a form of cyberattack in human-automation teaming, using an email task.


BACKGROUND
Under the prevalence effect, rare signals are more difficult to detect, even when taking into account their proportionally low occurrence. This decline represents diminished human capability to both detect and respond. As signal probability (SP) approaches zero, accuracy exhibits logarithmic decay. Cybersecurity, a context in which the environment is entirely artificial, provides an opportunity to manufacture conditions enhancing or degrading human performance, such as prevalence effects. Email cybersecurity prevalence effects have not previously been demonstrated, nor intentionally manipulated.


METHOD
The Email Testbed (ET) provides a simulation of a clerical email work involving messages containing sensitive personal information. Using the ET, participants were presented with 300 email interactions and received cyberattacks at rates of either 1%, 5%, or 20%.


RESULTS
Results demonstrated the existence and power of prevalence effects in email cybersecurity. Attacks delivered at a rate of 1% were significantly more likely to succeed, and the overall pattern of accuracy across declining SP exhibited logarithmic decay.


APPLICATION
These findings suggest a "prevalence paradox" within human-machine teams. As automation reduces attack SP, the human operator becomes increasingly likely to fail in detecting and reporting attacks that remain. In the cyber realm, the potential to artificially inflict this state on adversaries, hacking the human operator rather than algorithmic defense, is considered. Specific and general information security design countermeasures are offered.
['Sawyer|Ben D|BD|', 'Hancock|Peter A|PA|']
D000328:Adult D016494:Computer Security D034742:Electronic Mail D006801:Humans D008328:Man-Machine Systems D011336:Probability D014584:User-Computer Interface D055815:Young Adult
messages information security design antimalware antivirus human-computer interaction internet malware risk signal detection vigilance virus