--- title: MRIs Prove Security Warnings Push Our Brains' Pause Buttons description: A new study reveals that the system set up to warn users about insecure behaviors triggers the brain to ignore those warnings after seeing them more than once - habituation. image: https://businessinsights.bitdefender.com/hubfs/Blog_pics/Security_warnings_-_MRI_edited.jpg --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) [#Enterprise Security](https://businessinsights.bitdefender.com/topic/enterprise-security) By [**Ericka Chickowski**](https://businessinsights.bitdefender.com/author/ericka-chickowski) / Apr 07, 2015 # MRIs Prove Security Warnings Push Our Brains' Pause Buttons Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/mris-prove-security-warnings-push-our-brains-pause-buttons&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/mris-prove-security-warnings-push-our-brains-pause-buttons&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/mris-prove-security-warnings-push-our-brains-pause-buttons&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/mris-prove-security-warnings-push-our-brains-pause-buttons&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/mris-prove-security-warnings-push-our-brains-pause-buttons&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/mris-prove-security-warnings-push-our-brains-pause-buttons&utm_medium=social&utm_source=facebook) Perhaps the poor users have been maligned for all these years after all. Security pundits have long decried enterprise and consumer users' tendency to clickety-click their way right through important security warning screens without ever paying heed to the content of the warning. It's a propensity that leaves their machines vulnerable to misconfigurations, makes them easy targets for dangerous attacks that still require user input to download malicious content and otherwise clears the path for all nature of endpoint-oriented social engineering. Last week [Ars Technica reported](http://arstechnica.com/security/2015/03/mris-show-our-brains-shutting-down-when-we-see-security-prompts/) on a new scientific study that'll be presented later in April that shows that it isn't actually users' faults after all. It's just that the system we've set up to warn users about insecure behaviors triggers the brain to ignore those warnings after seeing them more than once. The scientists show that ignoring security warnings is more a function of biology than willful ignorance. The experiments revolve around our predisposition for a learned response called habituation, which is a kind of neurological numbing of response to repeated exposures to certain stimulus. And just as someone who lives near an airport stops hearing the planes overhead, repeated exposure to things like SSL expiration warnings similarly causes the brain to look right through them. Security teams have known this to be anecdotally true for a while, but now there's science behind how and why it happens. ![Security_warnings_MRI](https://businessinsights.bitdefender.com/hubfs/Blog_pics/Security_warnings_-_MRI_edited.jpg "Security_warnings_MRI") In a paper called ["How Polymorphic Warnings Reduce Habituation in the Brain—Insights from an fMRI Study"](http://neurosecurity.byu.edu/media/Anderson_et_al._CHI_2015.pdf), scientists analyzed functional magnetic resonance imaging (fMRI) images of users as they were exposed to security warnings. "Our results show a dramatic drop in the visual processing centers of the brain after only the second exposure to a warning, with further decreases with subsequent exposures," they wrote. It's their belief that part of the answer to this problem lies in changing the appearance of how security warnings look to reduce the effect of habituation around conventional security warnings. These changes included size and color of text, size of the box, background color of the box and border around the box containing the warning. The scientists did note that their research did not tackle whether or not these changes did ultimately affect the click-through rate for these warnings, but instead focused on habituation. It poses some interesting questions for future UI design, though architects may need to consider an unintended consequence of creating polymorphic security warnings. As it is, attackers are taking advantage of the warning system with attacks such as fake AV campaigns that convince users to heed fake warnings to download malicious 'security' products. If security warnings always look different, it may be even more difficult for users to discern real warnings from phony ones in the long run. ### Explore More Topics - [Enterprise Security (743)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (201)](https://businessinsights.bitdefender.com/topic/threat-research) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [SMB Security (170)](https://businessinsights.bitdefender.com/topic/smb-security) - [Ransomware (166)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (137)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (134)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (126)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (124)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (119)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [Threat Intelligence (76)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [IT Compliance & Regulations (71)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (55)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (53)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (46)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (38)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (18)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (9)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (3)](https://businessinsights.bitdefender.com/topic/podcast) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [Automation to Drive Tidal Wave of Spear Phishing Campaigns in 2021, Researchers Predict](https://businessinsights.bitdefender.com/automation-to-drive-tidal-wave-of-spear-phishing-campaigns-in-2021-researchers-predict?hsLang=en-us) ### [FBI Warns of Hackers Abusing Email Forwarding Rules in Recent Attacks](https://businessinsights.bitdefender.com/fbi-warns-hackers-abusing-email-forwarding-rules-recent-attacks?hsLang=en-us) ### [DHS, FBI Alert: SamSam Ransomware Zeroes In on Critical Computer Networks in US](https://businessinsights.bitdefender.com/dhs-fbi-alert-samsam-ransomware-zeroes-in-on-critical-computer-networks-in-us?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ![](https://px.spiceworks.com/px/5rec) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Ericka Chickowski", "url" : "https://businessinsights.bitdefender.com/author/ericka-chickowski" }, "datePublished" : "2015-04-07T13:17:00.000Z", "headline" : "MRIs Prove Security Warnings Push Our Brains' Pause Buttons", "image" : [ "https://businessinsights.bitdefender.com/hubfs/Blog_pics/Security_warnings_-_MRI_edited.jpg" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/mris-prove-security-warnings-push-our-brains-pause-buttons", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```