Nudging

The term comes from Richard Thaler and Cass Sunstein's Nudge (2008), which defines a nudge as any aspect of the choice architecture that alters behaviour in a predictable way without forbidding options or significantly changing economic incentives. The philosophical label is libertarian paternalism: the designer steers, but the chooser keeps the freedom to opt out cheaply. The psychological basis is dual-process theory - most security decisions (clicking, approving, sharing) are made by fast, automatic System 1 processing, so interventions that act at the moment of choice outperform knowledge delivered weeks earlier. Practitioner frameworks such as the UK Behavioural Insights Team's EAST (make it Easy, Attractive, Social, Timely) and the earlier MINDSPACE checklist translate this into design rules.

In security the strongest nudge is the default. Pre-enabled MFA registration campaigns, secure-by-default configurations, auto-lock timeouts, sharing links that default to "people in your organisation" rather than "anyone with the link", and password managers that autofill only on the correct origin all rely on inertia working for security instead of against it. Salience nudges include external-sender banners, first-contact safety tips and lookalike-domain warnings; feedback nudges include password-strength meters, which Ur et al. (USENIX Security 2012) showed can push users toward stronger passwords when scoring is stringent. Social-norm nudges ("87 percent of your colleagues have enabled MFA") use descriptive norms, and commitment nudges ask people to confirm intent before a risky action.

The main failure mode is habituation. Repeated identical warnings are processed less and less; Akhawe and Felt's large field study of browser warnings (USENIX Security 2013) showed click-through rates differing sharply between browsers with different warning designs, and a banner on every external mail soon becomes invisible. Countermeasures are rarity (warn only on genuinely unusual events), polymorphic or context-specific wording and placing the warning where the decision happens. Nudges also have ceilings: they shift probabilities, they do not stop a determined or deceived user, so they complement rather than replace hard controls.

Ethically, nudges must be transparent and aligned with the user's own interest. The inverse - designs that exploit the same biases against the user - are dark patterns, and the EU Digital Services Act Art. 25 prohibits online platforms from using interface designs that deceive or manipulate users. "Sludge" describes friction that makes the good choice harder. Unlike a security policy, a nudge carries no sanction and needs no enforcement, which makes it cheap but also means compliance cannot be demanded or audited in the same way.