Why security behaviour does not spread the way we assume it does, and what that means for how we design for it
Summary
Security awareness is built on an unstated assumption: that good behaviour spreads like information. Tell enough people, reach enough of the network, and the behaviour will propagate. This paper argues that the assumption is wrong for almost every security behaviour that matters. Information spreads through simple contagion. Behaviour spreads through complex contagion, and the two follow different rules, favour different network structures and require different interventions.
The distinction is not academic. It explains why broadcast awareness campaigns plateau, why phishing click rates fall and then stall, why Security Champions Networks built as distribution lists underperform, and why the same programme can succeed in one division and fail in another. It also gives us something practical: design principles for behaviour change grounded in how behaviour actually moves through organisations.
1. Two kinds of spread
Simple contagion
Some things spread on a single contact. A piece of news, a rumour, a virus, a joke. One exposure is enough. If I hear that the office is closing early on Friday, I do not need to hear it three more times from three different people before I believe it and act on it.
Simple contagion has been studied for decades, and the mathematics is well understood. What matters is reach. The most efficient network for simple contagion is one with long ties, meaning connections that bridge otherwise distant parts of the network. Granovetter's work on weak ties in the 1970s showed that these bridging connections, not close friendships, carry information across a population. Watts and Strogatz later showed that adding just a handful of long-range shortcuts to a clustered network collapses the distance between any two nodes. A few random links and the whole thing becomes a small world.
If you are trying to spread information, this is good news. You do not need to reach everyone. You need to reach a few well-placed people with long ties and let the shortcuts do the work. Every viral marketing campaign and every internal comms strategy is, implicitly, a simple contagion strategy.
Complex contagion
Other things do not spread on a single contact. Adopting a new tool, changing a working habit, speaking up in a meeting, reporting a colleague's mistake, refusing a request from someone senior. These are behaviours, and behaviours carry cost. They take effort, carry social risk, and their value is often uncertain until others are doing them too.
For these, one exposure is rarely enough. People need reinforcement from multiple sources before they change. Centola and Macy called this complex contagion, and the defining feature is a threshold: an individual adopts only when the proportion of their contacts who have already adopted crosses some level. The threshold varies by person and by behaviour, but it is almost never zero.
This changes everything about which network structures work. Long ties are excellent at carrying a single exposure across the network, and nearly useless at delivering the second, third and fourth exposure that a threshold behaviour requires. A behaviour that arrives via one long tie into a cluster where nobody else is doing it will die there. Complex contagion needs wide bridges: multiple overlapping connections between groups, so that when a behaviour reaches a new cluster, it arrives from several directions at once.
Centola demonstrated this experimentally in 2010. He built an online health community and placed participants into either a random network rich in long ties or a clustered network with redundant, overlapping connections. The behaviour he was tracking, registering for a health forum, spread further and faster in the clustered network. The redundancy that makes a network inefficient for information makes it effective for behaviour.
Why the distinction matters
The two models make opposite recommendations. If behaviour spread like information, you would want to identify the most connected individuals, the hubs, and push your message through them. Reach would be the goal, and the awareness campaign would be the tool. If behaviour spreads through complex contagion, hubs are a distraction. You want clusters, redundancy and local density. Reach is not the goal. Reinforcement is.
Most security programmes are designed for the first model and disappointed by results that can only be explained by the second.
2. Which security behaviours are which
It helps to be specific, because not everything in security is a complex contagion.
Some things genuinely are simple. Knowing that a particular phishing campaign is circulating this week is information, and it spreads on one contact. Knowing that the VPN has changed. Knowing whom to email if your laptop is stolen. These benefit from broadcast, from long ties, from the standard comms toolkit. There is nothing wrong with awareness campaigns for awareness.
But the behaviours that actually reduce risk are almost all complex. Consider what each one requires.
Reporting a suspicious email carries the risk of being wrong, of wasting someone's time, of looking foolish. Whether a person does it depends heavily on whether people around them do it and whether the last person who did was thanked or ignored. Threshold behaviour.
Challenging a request that looks legitimate but feels off, particularly one from someone senior, is socially costly. Nobody does this because a training module told them to. They do it because they have seen others do it without consequence, or because their team has developed a norm that makes it normal. Threshold behaviour.
Following a secure process that is slower than the workaround is a decision made repeatedly, under time pressure, in the presence of colleagues who are either doing the same or not. Local norms sustain it and undermine it. Threshold behaviour.
Raising a security concern about a project, a supplier or a design is an act of speaking up, with all the interpersonal risk that implies. Threshold behaviour.
Volunteering as a champion is itself a behaviour with cost, and whether people do it depends on whether the champions they can see are respected, supported and visibly getting something out of it. Threshold behaviour.
Each of these has a threshold, and for each, the threshold is set locally: by the team, the manager, the immediate social environment. None of them can be reliably triggered by a single exposure from a central source, no matter how well produced.
This is the core of the argument. Security awareness has been optimised for spreading the information that matters least and is structurally unsuited to spreading the behaviours that matter most.
3. What this explains
Several persistent patterns in security culture programmes make more sense through this lens.
The plateau. Phishing click rates fall quickly at first and then flatten. The initial fall is simple contagion: people learn what a simulation is, learn what to look for, and the easy gains come through. The plateau is where complex contagion starts. The remaining behaviour, which is real reporting under real uncertainty, needs reinforcement that a simulation platform cannot deliver. Increasing simulation frequency at this point pushes harder on a mechanism that has already done everything it can.
Divisional variation. The same programme, content, and platform produce different results in different parts of the organisation. This is not noise. It reflects differences in local network structure. A division with tight, redundant working relationships and a couple of respected early adopters will cross thresholds that a division with fragmented, transactional relationships never reaches. The programme is the same. The substrate is different.
The champion who makes no difference. Organisations appoint champions, distribute content through them, and see little effect. If the champion is one person in a team of forty with no reinforcing peers, they are a single long tie into a cluster. Their exposure is one exposure. For a threshold behaviour, that is not enough, and no amount of enthusiasm will change the arithmetic.
The senior sponsor who moves nothing. A well-known pattern: a director talks about security at a town hall, and behaviour does not change. The director has enormous reach, which is exactly what simple contagion wants. But reach delivers one exposure. For the person on the team deciding whether to report something, the director's speech is not in the room. Their colleagues are.
The programme that works after it was declared a failure. Complex contagions have a characteristic shape: slow, then fast. Adoption creeps for a long time as local clusters approach their thresholds, then accelerates sharply as clusters tip and reinforce each other. Programmes cut during the slow phase never see the fast one. The measurement problem here is real and we return to it below.
4. Design principles
If security behaviour is a complex contagion, behaviour-change programmes should follow its design. Six principles.
Seed clusters, not hubs
The instinct is to recruit the most connected, most visible people as champions. Complex contagion says otherwise. What you want is several champions in the same cluster, close enough that their colleagues see the behaviour from multiple directions. Two or three champions in one team of twenty will move that team. Twenty champions, one per team across twenty teams, may move nothing.
This is counterintuitive for programme sponsors, who want coverage figures. But coverage is a simple contagion metric. For complex contagion, density beats coverage.
Build wide bridges between clusters
Once a cluster has tipped, the behaviour needs to move to the next one, and it will not travel over a single connection. Deliberately create overlapping ties between champion groups in adjacent parts of the organisation: joint sessions, shared projects, rotation, anything that gives the receiving cluster multiple points of contact with the behaviour. The structure of the champions network is not a detail of programme administration. It is the mechanism.
Aim for the local tipping point
Centola's later work on social conventions found that once a committed minority reaches roughly a quarter of a group, the group's norm can flip. The precise figure will vary, and organisational teams are not laboratory groups, but the principle holds: there is a level of committed adoption within a cluster past which the behaviour becomes self-sustaining and below which it does not. Programme design should be explicit about which clusters are being targeted and what local adoption level is being aimed for, rather than pursuing an organisation-wide percentage that means nothing at the level where thresholds are actually set.
Lower the threshold before pushing the exposure
Thresholds are not fixed. They are set by cost, risk and uncertainty. Every hour spent making reporting easier, making the first reporting experience positive, and making it visibly safe to challenge reduces the reinforcement needed. The COM-B framing is useful here: capability interventions do little to thresholds, but opportunity and motivation interventions lower them directly. Reduce the threshold first, and the same network delivers more adoption.
Make adoption visible
Complex contagion depends on people seeing others adopt. Invisible behaviour cannot reinforce anything. Reporting that vanishes into a mailbox generates no social signal. Reporting that is acknowledged in the team, referenced by the manager, and visible in some lightweight way is exposure for everyone who sees it. Visibility is not a communications nicety. It is what converts one person's behaviour into a contact for their neighbours.
Protect the slow phase
Sponsors need to understand, before the programme starts, that complex contagion is slow before it is fast, and that the slow phase is not evidence of failure. This must be built into governance and reporting from the outset. Otherwise the programme will be judged by simple contagion expectations, and it will lose.
5. Measurement
The measurement implications follow directly, and they are the reason CyBehave's Heroes model separates its indicators by source rather than blending them.
Behavioural outcomes, the things telemetry captures, are lagging indicators of a complex contagion. They move last. If they are the only thing measured, the programme is assessed on the signal least able to show progress during the phase when progress is being made.
Network strength is a structural property: how clustered the champions are, how many wide bridges exist between groups, how many individuals have multiple champion contacts rather than one. It can be measured directly through organisational network analysis and it moves before behaviour does, because it is the precondition for behaviour to spread. A programme that increases local density and bridge width builds the conditions for a tip, even if outcome numbers are flat.
Programme capability is whether the machinery that produces network strength is in place and functioning: recruitment, support, recognition, retention. It moves earliest of all.
Reporting these three separately lets a sponsor see a programme that is working before it produces outcomes. Blending them into a single score hides the movement in the noise. This is not a preference for complexity in reporting. It follows from the fact that the thing being measured has a complex contagion dynamic, and the indicators sit at different points along it.
6. Objections
Is it not simpler just to mandate the behaviour? For some behaviours, yes, and controls that remove choice altogether are always preferable where possible. Complex contagion applies to the discretionary behaviours that remain once technical controls have done their work. Those are the ones that determine whether the residual risk is managed or not, and they cannot be mandated, only cultivated.
Does this not just mean champions programmes? Champions programmes are one mechanism, and a good one when structured for complex contagion. But the principles apply more broadly: how managers are engaged, how incidents are communicated, and how recognition is designed. The point is the model, not any particular programme.
Is the evidence base strong enough? The core distinction between simple and complex contagion is well established in network science, with experimental support. Its application to organisational security behaviour is an extension, and the empirical work is still developing. That is precisely the gap CyBehave's measurement architecture and the underlying doctoral research are trying to close. What we can say with confidence is that the simple contagion model, the implicit basis for most current practice, has had two decades to demonstrate its adequacy and has not.
7. Conclusion
Security behaviour is not information. It does not spread on contact, it does not travel over long ties, and it does not respond to reach. It spreads the way behaviours spread: through reinforcement, through clusters, through the local social environment where thresholds are set and crossed.
Once you accept this, much standard practice looks like a category error. Awareness campaigns are simple-contagion tools applied to complex-contagion problems. Champion networks designed for coverage are optimised for the wrong dynamic. Outcome-only measurement judges a slow-then-fast process by its slow phase and stops it before it becomes fast.
The alternative is not more effort. It is a different model of what is being spread, and a programme designed to match.
References
Centola, D. (2010). The spread of behavior in an online social network experiment. Science, 329(5996), 1194–1197.
Centola, D. (2018). How Behavior Spreads: The Science of Complex Contagions. Princeton University Press.
Centola, D. (2021). Change: How to Make Big Things Happen. Little, Brown Spark.
Centola, D., Becker, J., Brackbill, D., & Baronchelli, A. (2018). Experimental evidence for tipping points in social convention. Science, 360(6393), 1116–1119.
Centola, D., & Macy, M. (2007). Complex contagions and the weakness of long ties. American Journal of Sociology, 113(3), 702–734.
Granovetter, M. S. (1973). The strength of weak ties. American Journal of Sociology, 78(6), 1360–1380.
Granovetter, M. (1978). Threshold models of collective behavior. American Journal of Sociology, 83(6), 1420–1443.
Michie, S., van Stralen, M. M., & West, R. (2011). The behaviour change wheel: A new method for characterising and designing behaviour change interventions. Implementation Science, 6, 42.
Rogers, E. M. (2003). Diffusion of Innovations (5th ed.). Free Press.
Watts, D. J., & Strogatz, S. H. (1998). Collective dynamics of 'small-world' networks. Nature, 393, 440–442.