How Can Design Improve Cybersecurity Communication?

Can better design improve cybersecurity awareness without relying on more policies, warnings or training sessions?

Effective cybersecurity communication goes beyond explaining risks. It involves understanding how people behave, how they interact with technology and how design itself can help them make safer decisions.

In this latest Digital4Security Microcredential Insights feature, Prof. Dr. Julia von Thienen from the German University of Digital Science introduces the concept of Implication Design and explores how it can transform cybersecurity communication.

How to Explain Cybersecurity Risks to Employees – Without a Single Word?

Imagine climbing an old wooden ladder. As you place your foot on the first rung, you feel it wobble. Instinctively, you become more cautious, perhaps deciding to reposition the ladder before climbing further. No warning sign is needed: the ladder itself communicates something important about the risks of using it.

Digital technologies can convey their potential risks in similar ways, without requiring words. Depending on how they are designed, they can make possible consequences intuitively recognisable, helping users act appropriately and preventing incidents.

There is enormous untapped potential here. When technology itself fails to make its intended uses and risks clear at first glance, lengthy explanations, training sessions, rules and prohibitions may become necessary. Yet some of these efforts could be spared through better design from the outset.

This is where Implication Design comes in. Let’s explore what it means in practice.

Eyecam: What If Your Webcam Looked Back?

A compelling example comes from research by Marc Teyssier and colleagues. Their project, Eyecam, transforms an ordinary webcam into an artefact resembling a human eye, complete with a moving eyeball, eyelids and eyebrows. Its movements make the act of observation strikingly evident.

Conventional webcams can easily fade into the background of our awareness. We may forget that a camera is open, that images might be recorded or accessed without authorisation, and that others may be watching. As a result, we might reveal things that were never intended for sharing.

With a webcam designed like a human eye, observation becomes much more noticeable. The design invites immediate questions: Is the camera on now? Am I comfortable with this?

The Eyecam project illustrates the power of design: technology can communicate important implications through its very form and behaviour, without requiring lengthy explanations. In this case, the implications concern the possibility of being observed and of others seeing things the user may not have intended to share.

Try Implication Design Yourself

Implication Design explores how the consequences of technology can become apparent through its form, materials and behaviour, helping users intuitively understand what they can do, what might be risky, and why.

Consider a cybersecurity challenge in your own organisation. Then experiment with five steps:

Implication Design respects the users’ autonomy while helping them understand what is at stake and make appropriate decisions based on an accurate understanding of the situation.

A Question Worth Asking

Next time you encounter a cybersecurity challenge, consider whether another warning, instruction or policy is really the best solution. What if the technology itself could communicate its risks?

Explore alternatives. Make ideas tangible. Invite others to experience them, and improve your designs.

After all, if even an old wooden ladder can communicate its risks through the way it feels to the user, why shouldn’t our digital technologies become better at communicating their consequences just as intuitively?

This article is part of the Digital4Security Microcredential Insights series, exploring specialist cybersecurity knowledge, practical approaches and professional development opportunities.