{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,13]],"date-time":"2026-03-13T10:52:38Z","timestamp":1773399158770,"version":"3.50.1"},"reference-count":56,"publisher":"MIS Quarterly","issue":"4","license":[{"start":{"date-parts":[[2025,9,18]],"date-time":"2025-09-18T00:00:00Z","timestamp":1758153600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,12,1]]},"abstract":"<jats:p>Users\u2019 disregard of security warnings is a critical problem in cybersecurity. This problem worsens when people confuse security warnings with common, non-security-related notifications, which they learn to routinely disregard. We investigate this problem through the neurobiological phenomenon of generalization of habituation, where habituation to one stimulus transfers to another stimulus that shares similar characteristics. Generalization of habituation suggests that because of habituation to frequent notifications, people may also be deeply habituated to security warnings they have never seen before, leading to warning disregard. Furthermore, because generalization of habituation occurs unconsciously at the neurobiological level, this may occur even though a person can consciously distinguish security warnings from notifications. We address this problem through three experiments\u2014two in the field and one using functional magnetic resonance imaging. These experiments demonstrate how generalization of habituation occurs and can be mitigated by differentiating warnings from notifications in terms of their visual appearance or mode of interaction. These findings provide guidance to software developers for designing warnings that resist generalization of habituation and promote greater warning adherence.<\/jats:p>","DOI":"10.25300\/misq\/2025\/18531","type":"journal-article","created":{"date-parts":[[2025,9,18]],"date-time":"2025-09-18T16:28:20Z","timestamp":1758212900000},"page":"1357-1384","source":"Crossref","is-referenced-by-count":1,"title":["The Fog of Warnings: How Non-Security-Related Notifications Diminish the Efficacy of Security Warnings"],"prefix":"10.25300","volume":"49","author":[{"given":"Anthony","family":"Vance","sequence":"first","affiliation":[{"name":"Department of Business Information Technology, Pamplin College of Business Virginia Tech Blacksburg, VA, U.S.A."}]},{"given":"Dave","family":"Eargle","sequence":"additional","affiliation":[{"name":"Independent Scholar, Denver CO, U.S.A."}]},{"given":"C. Brock","family":"Kirwan","sequence":"additional","affiliation":[{"name":"MindCORE Neuroimaging Facility University of Pennsylvania, Philadelphia, PA, U.S.A."}]},{"given":"Bonnie Brinton","family":"Anderson","sequence":"additional","affiliation":[{"name":"Information Systems Department, Marriott School of Business, Brigham Young University, Provo, UT, U.S.A."}]},{"given":"Jeffrey L.","family":"Jenkins","sequence":"additional","affiliation":[{"name":"Information Systems Department, Marriott School of Business, Brigham Young University, Provo, UT, U.S.A."}]}],"member":"10933","published-online":{"date-parts":[[2025,12,1]]},"reference":[{"key":"2025120114415814800_b1-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134007","article-title":"Where the wild warnings are: Root causes of Chrome HTTPS certificate errors","author":"Acer","year":"2017"},{"issue":"6","key":"2025120114415814800_b2-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"1776","DOI":"10.1152\/japplphysiol.00515.2006","article-title":"Motor training induces experience specific patterns of plasticity across motor cortex and spinal cord","volume":"101","author":"Adkins","year":"2006","journal-title":"Journal of Applied Physiology"},{"key":"2025120114415814800_b3-05_ra_10_25300_misq_2025_18531","article-title":"Alice in Warningland: A large-scale field study of browser security warning effectiveness","author":"Akhawe","year":"2013"},{"issue":"4","key":"2025120114415814800_b4-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"192","DOI":"10.1080\/19393555.2018.1505008","article-title":"Habituation effects in computer security warning","volume":"27","author":"Amran","year":"2018","journal-title":"Information Security Journal: A Global Perspective"},{"key":"2025120114415814800_b5-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1016\/j.dss.2016.09.010","article-title":"Your memory is working against you: How eye tracking and memory explain susceptibility to phishing","volume":"92","author":"Anderson","year":"2016","journal-title":"Decision Support Systems"},{"issue":"3","key":"2025120114415814800_b6-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"713","DOI":"10.1080\/07421222.2016.1243947","article-title":"From warnings to wallpaper: Why the brain habituates to security warnings and what can be done about it","volume":"33","author":"Anderson","year":"2016","journal-title":"Journal of Management Information Systems"},{"key":"2025120114415814800_b7-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.1016\/j.infbeh.2021.101666","article-title":"No evidence for language benefits in infant relational learning","volume":"66","author":"Anderson","year":"2022","journal-title":"Infant Behavior and Development"},{"key":"2025120114415814800_b8-05_ra_10_25300_misq_2025_18531","unstructured":"Apple\n          . (2025). Human interface guidelines, Retrieved on January 25, 2025, from https:\/\/developer.apple.com\/design"},{"issue":"7","key":"2025120114415814800_b9-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.1162\/jocn_a_01112","article-title":"Distinct frontoparietal networks underlying attentional effort and cognitive control","volume":"29","author":"Berry","year":"2017","journal-title":"Journal of Cognitive Neuroscience"},{"key":"2025120114415814800_b10-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"2403","DOI":"10.1145\/1753326.1753689","article-title":"Trained to accept? A field experiment on consent dialogs","author":"B\u00f6hme","year":"2010"},{"key":"2025120114415814800_b11-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.1145\/2501604.2501610","article-title":"Your attention please: Designing security-decision uis to make genuine risks harder to ignore","author":"Bravo-Lillo","year":"2013"},{"key":"2025120114415814800_b12-05_ra_10_25300_misq_2025_18531","volume-title":"About face 3: The essentials of interaction design","author":"Cooper","year":"2007"},{"key":"2025120114415814800_b13-05_ra_10_25300_misq_2025_18531","unstructured":"Crowdstrike\n          . (2024). 2024 global threat report, https:\/\/www.Crowdstrike.Com\/global-threat-report."},{"issue":"1","key":"2025120114415814800_b14-05_ra_10_25300_misq_2025_18531","first-page":"51","article-title":"Engineering computer \u201clook and feel\u201d: User interface technology and human factors engineering","volume":"30","author":"Curtis","year":"1989","journal-title":"Jurimetrics"},{"issue":"2-3","key":"2025120114415814800_b15-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"109","DOI":"10.1002\/(SICI)1097-0193(1999)8:2\/3&lt;109::AID-HBM7&gt;3.0.CO;2-W","article-title":"Optimal experimental design for event-related fMRI","volume":"8","author":"Dale","year":"1999","journal-title":"Human Brain Mapping"},{"issue":"3","key":"2025120114415814800_b16-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"811","DOI":"10.2307\/41703482","article-title":"How to conduct a functional magnetic resonance (fMRI) study in social science research","volume":"36","author":"Dimoka","year":"2012","journal-title":"MIS Quarterly"},{"key":"2025120114415814800_b17-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"331","DOI":"10.1007\/978-3-642-21602-2_36","article-title":"Visual hierarchy and viewing behavior: An eye tracking study","author":"Djamasbi","year":"2011"},{"key":"2025120114415814800_b18-05_ra_10_25300_misq_2025_18531","unstructured":"Eargle, D., Gureckis, T., Rich, A. S., McDonnell, J., & Martin, J. B. (2021). PsiTurk: An open platform for science on Amazon Mechanical Turk (v3.2.1). https:\/\/zenodo.org\/record\/7269012"},{"key":"2025120114415814800_b19-05_ra_10_25300_misq_2025_18531","unstructured":"Eargle, D. W.\n           (2017). Security messages or: How I learned to stop disregarding and heed the warning [Unpublished Ph.D. dissertation]. University of Pittsburgh."},{"key":"2025120114415814800_b20-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.1016\/j.physbeh.2021.113512","article-title":"Food reinforcement and habituation to food are processes related to initiation and cessation of eating","volume":"239","author":"Epstein","year":"2021","journal-title":"Physiology & Behavior"},{"issue":"1","key":"2025120114415814800_b21-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"20","DOI":"10.1016\/0166-2236(92)90344-8","article-title":"Separate visual pathways for perception and action","volume":"15","author":"Goodale","year":"1992","journal-title":"Trends in Neurosciences"},{"key":"2025120114415814800_b22-05_ra_10_25300_misq_2025_18531","unstructured":"Google\n          . (2025). Material design for Android. Retrieved on January 25, 2025, from https:\/\/developer.android.com\/design."},{"issue":"5","key":"2025120114415814800_b23-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"crossref","first-page":"419","DOI":"10.1037\/h0029810","article-title":"Habituation: A dual-process theory","volume":"77","author":"Groves","year":"1970","journal-title":"Psychological Review"},{"issue":"18","key":"2025120114415814800_b24-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.3390\/app10186247","article-title":"Handling skewed data: A comparison of two popular methods","volume":"10","author":"Hammouri","year":"2020","journal-title":"Applied Sciences"},{"key":"2025120114415814800_b25-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"133","DOI":"10.1145\/1719030.1719050","article-title":"So long, and no thanks for the externalities: The rational rejection of security advice by users","author":"Herley","year":"2009"},{"issue":"14","key":"2025120114415814800_b26-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.1017\/S1754470X13000196","article-title":"What clinicians can learn from schema change in sport","volume":"6","author":"James","year":"2013","journal-title":"The Cognitive Behaviour Therapist"},{"issue":"4","key":"2025120114415814800_b27-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"880","DOI":"10.1287\/isre.2016.0644","article-title":"More harm than good? How security messages that interrupt make us vulnerable","volume":"27","author":"Jenkins","year":"2016","journal-title":"Information Systems Research"},{"key":"2025120114415814800_b28-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.3389\/fpsyg.2020.528079","article-title":"Repetition of computer security warnings results in differential repetition suppression effects as revealed with functional MRI","volume":"11","author":"Kirwan","year":"2020","journal-title":"Frontiers in Psychology"},{"issue":"3","key":"2025120114415814800_b29-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"324","DOI":"10.1111\/isj.12402","article-title":"Embracing brain and behaviour: Designing programs of complementary neurophysiological and behavioural studies","volume":"33","author":"Kirwan","year":"2023","journal-title":"Information Systems Journal"},{"issue":"1","key":"2025120114415814800_b30-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1016\/j.tins.2005.10.003","article-title":"Consolidation of motor memory","volume":"29","author":"Krakauer","year":"2006","journal-title":"Trends in Neurosciences"},{"key":"2025120114415814800_b31-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.1109\/CRISIS.2012.6378951","article-title":"Don\u2019t work. Can\u2019t work? Why it\u2019s time to rethink security warnings","author":"Krol","year":"2012"},{"key":"2025120114415814800_b32-05_ra_10_25300_misq_2025_18531","volume-title":"Don\u2019t make me think, revisited: A common sense approach to web and mobile usability","author":"Krug","year":"2014"},{"issue":"4","key":"2025120114415814800_b33-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"587","DOI":"10.1007\/s11292-016-9263-1","article-title":"Missing person alerts: Does repeated exposure decrease their effectiveness?","volume":"12","author":"Lampinen","year":"2016","journal-title":"Journal of Experimental Criminology"},{"issue":"6843","key":"2025120114415814800_b34-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"150","DOI":"10.1038\/35084005","article-title":"Neurophysiological investigation of the basis of the fMRI signal","volume":"412","author":"Logothetis","year":"2001","journal-title":"Nature"},{"issue":"1574","key":"2025120114415814800_b35-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"2076","DOI":"10.1098\/rstb.2010.0363","article-title":"The levels of analysis revisited","volume":"366","author":"MacDougall-Shackleton","year":"2011","journal-title":"Philosophical Transactions of the Royal Society B"},{"issue":"4","key":"2025120114415814800_b36-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"308","DOI":"10.1037\/h0025896","article-title":"Vigilance, arousal, and habituation","volume":"75","author":"Mackworth","year":"1968","journal-title":"Psychological Review"},{"key":"2025120114415814800_b37-05_ra_10_25300_misq_2025_18531","unstructured":"Mandiant\n          . (2024). M-trends 2024 special report. Retrieved on August 16, 2024, from https:\/\/cloud.google.com\/security\/resources\/m-trends."},{"key":"2025120114415814800_b38-05_ra_10_25300_misq_2025_18531","volume-title":"Vision: A computational approach","author":"Marr","year":"1982"},{"key":"2025120114415814800_b39-05_ra_10_25300_misq_2025_18531","unstructured":"Microsoft\n          . (2025). Microsoft design. Retrieved on January 25, 2025, from https:\/\/www.microsoft.com\/Design"},{"key":"2025120114415814800_b40-05_ra_10_25300_misq_2025_18531","unstructured":"MITRE\n          . (2024). \u201cUser execution: Malicious file,\u201d mitre att&ck. Retrieved on August 16, 2025, from https:\/\/attack.mitre.org\/techniques\/t1204\/002."},{"key":"2025120114415814800_b41-05_ra_10_25300_misq_2025_18531","unstructured":"MTurk\n          . (2017). Tutorial: How to label thousands of images using the crowd. https:\/\/blog.nturk.com\/tutorial-how-to-label-thousands-of-images-using-the-crowd-bea164ccbefc"},{"key":"2025120114415814800_b42-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","DOI":"10.1145\/3229434.3229445","article-title":"Dismissed! A detailed exploration of how mobile phone users handle push notifications","author":"Pielot","year":"2018"},{"issue":"2","key":"2025120114415814800_b43-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"135","DOI":"10.1016\/j.nlm.2008.09.012","article-title":"Habituation revisited: An updated and revised description of the behavioral characteristics of habituation","volume":"92","author":"Rankin","year":"2009","journal-title":"Neurobiology of Learning and Memory"},{"key":"2025120114415814800_b44-05_ra_10_25300_misq_2025_18531","article-title":"Schemata: The building blocks of cognition","volume-title":"Theoretical issues in reading comprehension","author":"Rumelhart","year":"1980"},{"issue":"4820","key":"2025120114415814800_b45-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"1317","DOI":"10.1126\/science.3629243","article-title":"Toward a universal law of generalization for psychological science","volume":"237","author":"Shepard","year":"1987","journal-title":"Science"},{"key":"2025120114415814800_b46-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"3055","DOI":"10.1145\/2556288.2557189","article-title":"Large-scale assessment of mobile notifications","author":"Shirazi","year":"2014"},{"issue":"2","key":"2025120114415814800_b47-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"crossref","first-page":"355","DOI":"10.25300\/MISQ\/2014\/38.2.02","article-title":"Data collection in the digital age: Innovative alternatives to student samples","volume":"38","author":"Steelman","year":"2014","journal-title":"MIS Quarterly"},{"issue":"2","key":"2025120114415814800_b48-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"127","DOI":"10.1016\/j.nlm.2008.07.011","article-title":"Habituation: A history","volume":"92","author":"Thompson","year":"2009","journal-title":"Neurobiology of Learning and Memory"},{"issue":"1","key":"2025120114415814800_b49-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"16","DOI":"10.1037\/h0022681","article-title":"Habituation: A model phenomenon for the study of neuronal substrates of behavior","volume":"73","author":"Thompson","year":"1966","journal-title":"Psychological Review"},{"key":"2025120114415814800_b50-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"70","DOI":"10.1016\/j.ijhcs.2019.07.011","article-title":"The influence of concurrent mobile notifications on individual responses","volume":"132","author":"Turner","year":"2019","journal-title":"International Journal of Human-Computer Studies"},{"key":"2025120114415814800_b51-05_ra_10_25300_misq_2025_18531","article-title":"What does the brain tell us about usable security?","author":"Vance","year":"2017"},{"issue":"10","key":"2025120114415814800_b52-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"679","DOI":"10.17705\/1jais.00375","article-title":"Using measures of risk perception to predict information security behavior: Insights from electroencephalography (EEG)","volume":"15","author":"Vance","year":"2014","journal-title":"Journal of the Association for Information Systems"},{"issue":"2","key":"2025120114415814800_b53-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"publisher","first-page":"355","DOI":"10.25300\/MISQ\/2018\/14124","article-title":"Tuning out security warnings: A longitudinal examination of habituation through fMRI, eye tracking, and field experiments","volume":"42","author":"Vance","year":"2018","journal-title":"MIS Quarterly"},{"key":"2025120114415814800_b54-05_ra_10_25300_misq_2025_18531","article-title":"A week to remember: The impact of browser warning storage policies","author":"Weinberger","year":"2016"},{"issue":"4","key":"2025120114415814800_b55-05_ra_10_25300_misq_2025_18531","doi-asserted-by":"crossref","first-page":"34","DOI":"10.1145\/1330311.1330320","article-title":"The psychology of security","volume":"51","author":"West","year":"2008","journal-title":"Communications of the ACM"},{"key":"2025120114415814800_b56-05_ra_10_25300_misq_2025_18531","article-title":"Fixing HTTPS misconfigurations at scale: An experiment with security notifications","author":"Zeng","year":"2019"}],"container-title":["MIS Quarterly"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/misq.umn.edu\/misq\/article-pdf\/49\/4\/1357\/19249\/05_ra_10.25300_misq_2025_18531.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/misq.umn.edu\/misq\/article-pdf\/49\/4\/1357\/19249\/05_ra_10.25300_misq_2025_18531.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T19:42:09Z","timestamp":1764618129000},"score":1,"resource":{"primary":{"URL":"https:\/\/misq.umn.edu\/misq\/article\/49\/4\/1357\/3281\/The-Fog-of-Warnings-How-Non-Security-Related"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,1]]},"references-count":56,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2025,12,1]]},"published-print":{"date-parts":[[2025,12,1]]}},"URL":"https:\/\/doi.org\/10.25300\/misq\/2025\/18531","relation":{},"ISSN":["0276-7783","2162-9730"],"issn-type":[{"value":"0276-7783","type":"print"},{"value":"2162-9730","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,12,1]]}}}