Umeå universitets logga

Balancing effectiveness with usability remains a core challenge in cybersecurity design. While prior research has addressed issues such as password usability and phishing susceptibility, many studies overlook the broader context in which users make security decisions. Cybersecurity models often assume rational behavior, ignoring real-world factors like cognitive load, time pressure, and competing goals. Users frequently bypass security prompts not out of negligence, but because these measures interrupt workflow and reduce efficiency.

User experience (UX)-driven security solutions have been proposed, yet few are systematically evaluated in real-world environments. It remains unclear which UX principles most effectively improve security compliance while minimizing cognitive burden. Additionally, overly complex mechanisms promote circumvention, while overly permissive ones compromise protection. This tension is exacerbated by digitalization and security fatigue—users’ mental exhaustion from frequent prompts and warnings.

To address these challenges, this study proposes a UX-integrated cybersecurity framework that aligns security measures with human behavior and cognitive limitations. It emphasizes a shift from rigid enforcement to user-centered design, where security becomes seamless and embedded in everyday tasks.

Using a narrative literature review and empirical studies of user interactions with security features, the study identifies key UX design elements that encourage secure behavior without disrupting productivity. The goal is to promote a culture where users see security not as a barrier, but as an enabler. By prioritizing usability in cybersecurity design, organizations can improve adoption, reduce breaches, and foster a more resilient digital ecosystem.