The Nudging Paradigm in Cybersecurity Research: A PRISMA-Based Systematic Review

Abstract

Background: Nudging has become a prominent approach for influencing secure digital behavior, yet its theoretical coherence and long-term effectiveness remain unclear. Objectives: This systematic review examines how the “nudging paradigm” is interpreted and operationalized in cybersecurity research and evaluates the short-term effectiveness and durability of nudging interventions on user behavior. Methods: Following PRISMA 2020 guidelines, we searched Scopus, APA PsycInfo, IEEE Xplore, and the ACM Digital Library using the query “(cybersecurity OR security) AND nudg*”. We included peer-reviewed empirical studies that explicitly self-identified their intervention as a “nudge” within a digital security context. Two reviewers independently screened records and extracted data. Studies were classified by cybersecurity domain, nudge type, and functional mechanism. Risk of bias was assessed descriptively using a behavior-analytic quality lens focusing on ecological validity, outcome type, and temporal scope. Results were synthesized narratively and descriptively at the study level. Results: Sixty-five studies (2012–December 2025) met inclusion criteria. Most focused on password security and privacy/data security. Informational/feedback nudges predominated, followed by default/design, framing, and social nudges. Many studies reported significant short-term behavioral effects, particularly when interventions embedded response-contingent feedback or altered response effort via protective defaults. Effects were most consistent for direct behavioral outcomes (e.g., password strength, clicks, configuration choices). Only one study met the criterion of post-withdrawal follow-up (≥2 weeks), and it did not demonstrate sustained maintenance of secure behavior once prompts and interface support were fully removed. Limitations: Evidence is constrained by heterogeneous designs, frequent reliance on short online experiments, limited ecological validity, and the near absence of post-withdrawal follow-ups. Interpretation: Nudging in cybersecurity reliably produces short-term improvements when interventions modify immediate contingencies of action. However, the literature does not currently provide empirical tests of durable behavior change under full withdrawal conditions. Future research should integrate consequence-based design, assess maintenance after withdrawal, and test generalization across contexts.

1. Introduction

Cybersecurity is not just a matter of technological infrastructure or automated protection systems; it is, first and foremost, a matter of human behavior. Most security breaches result from users’ actions or omissions, like clicking on phishing links, reusing weak passwords, or ignoring updates. Even the most advanced systems become vulnerable when people fail to adopt safe practices. Recent reports underscore this centrality of the human factor [1,2], with phishing alone accounting for a substantial share of incidents [3]. These figures demonstrate that technology alone is insufficient: cybersecurity ultimately depends on how people act, decide, and allocate effort when interacting with digital systems. Over the past few decades, an increasing number of daily activities have moved online or come to depend on digital tools and services. For generations born before the digital era, this transition has been gradual; younger generations, by contrast, have grown up immersed in digital environments. This difference has created a cultural divide that influences both risk perception and the willingness to adopt security measures: younger users often navigate technologies more fluidly but may perceive lower risk, while less digitally skilled users may view security protocols as obstacles or sources of cognitive strain.

However, adopting effective security practices is often challenging. Secure behaviors require a certain level of knowledge and are frequently perceived as inconvenient disruptors to the normal flow of activity. Consider 2-factor authentication: while it significantly enhances protection, many users avoid it because it introduces an extra step perceived as unnecessary, especially when the benefits are not clearly understood. This example illustrates a key principle: secure systems fail if they do not effectively shape and sustain secure user behavior. Usable security, initially framed as designing security mechanisms that users can and will use correctly as part of their primary tasks [4], emerged in response to this challenge as a research tradition within cybersecurity aimed at aligning security mechanisms with users’ capabilities and everyday practices, rather than depending on brittle compliance alone [5]. However, much of this work is still framed primarily as an interface-design problem, underplaying a central dimension: behavior. Recent studies highlight that usable security is frequently interpreted as ease-of-use rather than sustained performance of secure behavior [6,7]. Individuals operate under information overload, time pressure, and limited risk awareness, conditions that foster heuristics and automatic decision-making [8]. Consequently, cybersecurity should be understood as a problem of predictable and modifiable behavior, not merely as a technical issue.

Behavioral science provides valuable tools to address these dynamics. Among these, nudging has emerged as a widely adopted approach: small contextual changes intended to steer choices toward safer behaviors without imposing restrictions. However, the crucial question remains whether these interventions lead to stable, long-term behavioral change, or only to short-lived, situational compliance that quickly fades over time. Addressing this question means acknowledging that cybersecurity depends not only on what users know, but also, and more importantly, on what they do, and on how consistently they maintain such behaviors.

Although the questions guiding this review are exploratory, we chose a systematic review approach rather than a scoping review for two reasons. First, our aim is not merely to map the literature, but to examine how the nudging paradigm is explicitly interpreted and operationalized in cybersecurity research. That objective requires transparent eligibility criteria, a reproducible search strategy, and systematic screening; these are core features of systematic reviews. Second, scoping reviews are well suited to broad topic mapping and hypothesis generation, whereas this review targets a delimited conceptual object: nudging as a self-declared “paradigm” within cybersecurity. We therefore apply explicit eligibility criteria to identify and analyze recurring patterns in intervention design and the assumptions used to justify them. PRISMA 2020 was adopted as a procedural framework to support rigor and replicability, without implying that the review is a meta-analysis or a quantitative synthesis of effectiveness.

In line with this focus, we use the expression “nudging paradigm” rather than treating nudging as a single technique or isolated strategy. Here, paradigm is used descriptively to denote a relatively coherent cluster of assumptions, design heuristics, and methodological routines that shape how behavioral influence is conceptualized and implemented in cybersecurity, rather than a unified or formally articulated theory. Accordingly, the object of analysis is not nudging as a theory, but nudging as a declared research practice within cybersecurity.

Several authors have noted that nudging lacks a single explanatory model and is often justified post hoc through heterogeneous, and at times incompatible, accounts drawn from decision research, cognitive psychology, and applied behavioral science, particularly in empirical work that self-identifies interventions as nudges. In this respect, nudging resembles what Tinghög et al. [9] describe as a benchmark framework: a flexible and weakly falsifiable structure that persists less because of theoretical precision than because it can be adapted across domains and problem types. As with dual-process theories, the appeal of nudging lies less in explanatory specificity than in its ability to organize research practices, generate intervention ideas, and provide a shared vocabulary for applied work. The present review does not seek to adjudicate among competing cognitive accounts of decision-making; instead, it examines how such frameworks are mobilized (often implicitly) in the design and justification of cybersecurity nudges.

This weakly theoretical status does not prevent nudging from functioning paradigmatically in applied research; if anything, it facilitates convergence. Researchers repeatedly implement similar design strategies (for example, defaults, salience, prompts, and friction adjustments) and rely on broadly comparable evaluation practices despite theoretical underdetermination. On this view, the “nudging paradigm” captures not theoretical unity, but convergence at the level of intervention logic, methodological routines, and normative assumptions about acceptable forms of influence.

From a behavioral perspective, that convergence is frequently centered on antecedent manipulations. Behavior-analytic concepts are used here as an analytic lens to classify intervention mechanisms, not as a competing theory of nudging. Secure performance may be strengthened when interventions modify the immediate conditions under which choices are made (for example, prompts, defaults, and salience), but durable behavior change depends on contact with consequences at the point of action and on how response effort is distributed. Antecedents may occasion behavior, whereas consequences select and maintain it [10,11]. Building on this functional distinction, more recent behavior-analytic discussions have described nudges as a subclass of environmental events that influence behavior primarily through antecedent control; their effects may be amplified when coupled with response-contingent feedback or reinforcement. For example, Simon and Tagliabue [12] argue that nudges are most potent when embedded within broader contingencies that make adaptive behavior consequential.

Finally, because nudging is often loosely described as “behavioral,” it is important to clarify its disciplinary provenance. Nudging does not originate from behavioral psychology in the historical sense of pre-cognitive behaviorism, nor from experimental behavior analysis. Rather, it emerged within the broader behavioral sciences movement, particularly at the intersection of behavioral economics, decision research, and human–computer interaction, and has been further shaped by its implementation in digital environments. In cybersecurity, this line of development aligns with what is commonly termed digital nudging: the design of interfaces and choice architectures that steer behavior in online contexts. In this sense, nudging is best understood as a socio-technical approach to behavioral influence in digital systems, rather than a direct extension of traditional behavioral psychology.

1.1. A Definition of Nudging

The concept of nudging was introduced by Richard Thaler and Cass Sunstein [13] within behavioral economics to describe subtle modifications of the decision-making environment that influence people’s choices without restricting options. A nudge alters how options are presented or how information is framed, guiding individuals toward decisions aligned with long-term interests or socially desirable outcomes. In Thaler and Sunstein’s terms, a nudge is any aspect of the choice architecture that predictably changes behavior without forbidding options or significantly altering economic incentives. In digital contexts, nudging has been extended to interface and system design, where it is commonly referred to as digital nudging. In practice, nudges are frequently paired with persuasive-technology principles [14] to make the secure choice the simplest and most salient option and have become a widely discussed approach for encouraging safer digital behaviors [15]. A recent narrative review [5] examined how nudging has been used to promote safer digital behavior in cybersecurity and privacy contexts, noting that user perception of the nudge itself plays a critical role in effectiveness. The review also observed that nudging often fails to address why people make insecure choices: users may ignore warnings, reuse passwords, or click suspicious links because the secure option is harder, slower, or less rewarding than the risky alternative.

Beyond its popularity, the nudging literature has been repeatedly criticized for lacking a unifying explanatory theory and for relying on post hoc mechanistic accounts. This conceptual looseness can inflate the extension of the term “nudge” to cover heterogeneous interventions, making falsification difficult and blurring boundaries with other behavior-change approaches. In this context, a systematic review is not only useful to summarize “what works,” but also to clarify how the nudging paradigm is currently interpreted and operationalized in a specific applied domain such as cybersecurity.

1.2. A Functional Operationalization of Nudging

Critiques of nudging have emphasized that purported mechanisms are often specified after the intervention is identified, and that the same “nudge” can be retrospectively explained by multiple, competing accounts [16,17]. To reduce interpretative arbitrariness, we adopt a behavior-analytic, mechanism-based operationalization that maps interventions to functional features (stimulus control, motivating operations, effort, and response-contingent consequences). Functionally, a nudge is a light-touch antecedent manipulation, of stimulus arrangement, salience, timing, default state, or response effort, that increases the momentary probability of a secure response without forbidding options or adding explicit incentives/sanctions. Many interventions labeled as “nudges” also deliver response-contingent interface feedback (e.g., meters that turn green; warnings that disappear after compliance). We therefore distinguish pure antecedent prompts (SDs/MOs) from interfaces that embed consequences (conditioned reinforcers or escape/avoidance via warning removal). When a warning or banner disappears contingent on a correct response, this constitutes negative reinforcement (escape/termination of an aversive stimulus) rather than punishment [18,19,20]; conversely, a “success” meter or approval-like signal may function as conditioned reinforcement, or as discriminative feedback, depending on the user’s learning history and whether the signal has been correlated with other reinforcers. This split matters because interfaces that contact consequences during the task typically show larger immediate effects than antecedents alone. Put simply: antecedents set the occasion; consequences select. From a behavior-analytic perspective, this pattern highlights a plausible tension: if durable behavior change is selected and maintained by consequences, why does the cybersecurity literature invest so heavily in antecedent manipulations such as nudges? A likely answer is pragmatic rather than theoretical. Antecedent interventions are comparatively easy to implement, often less ethically contentious, and readily integrated into existing digital infrastructures. They can be deployed without reshaping incentive structures, introducing sanctions, or requiring sustained monitoring of individual behavior. However, implementability is not the same as functional sufficiency. Antecedent manipulations may temporarily increase the probability of a secure response, but when response-contingent consequences are absent or weak, effects tend to be fragile, highly context-dependent, and vulnerable to rapid decay once prompts are removed or attention shifts. The prominence of nudging therefore plausibly reflects a methodological and normative preference for light-touch interventions, rather than evidence that antecedent control alone can sustain secure behavior over time. This distinction is central to the present review. Rather than presuming that nudges are ineffective, we examine how the prevailing focus on antecedents shapes intervention design, outcome measurement, and the interpretation of “effectiveness” in cybersecurity research; we then consider what is lost, analytically and practically, when consequence-based selection mechanisms are neglected in efforts to produce durable behavior change.

Nudges primarily operate through discriminative stimuli (SDs) and motivating operations (MOs) [21] that momentarily raise the probability of the secure response. But durable behavior requires repeated contact with reinforcement contingencies; without them, effects remain fragile and context-bound. Because our eligibility criteria require that interventions explicitly self-identify as “nudges”, the present review maps the literature that adopts the nudging framework in cybersecurity, rather than the full universe of behaviorally effective security interventions; functionally similar designs described under different labels (e.g., warnings, persuasive technologies, friction-by-design, habit-supporting interfaces) fall outside its scope. All claims in the present article therefore concern nudging as a declared paradigm, not behavioral influence in cybersecurity more broadly. By clarifying how nudging is conceptualized, operationalized, and functionally interpreted in cybersecurity research, this review provides a framework for more precise design and evaluation of future behavioral interventions.

1.3. Objectives

Building on this foundation, the present study extends previous accounts [5] by conducting a systematic review of cybersecurity research that adopts a nudging framework, with the aim of clarifying how behavioral influence is conceptualized, implemented, and evaluated in this domain. Rather than offering a quantitative appraisal of the effectiveness of individual interventions, the review examines how nudging is interpreted and operationalized across studies, the assumptions embedded in different nudge designs, and the degree to which these implementations align with the broader principles typically associated with nudging. To align scope and eligibility with our review question, we restrict the corpus to studies that self-identify their intervention as “nudging” within security contexts. This lexical restriction is deliberate: it ensures coherence with the review’s search strategy and transparency of inclusion, and it enables a functional, behavior-analytic reading of “nudge” as a light-touch antecedent manipulation whose effects we interpret via stimulus control (SDs), motivating operations (MOs), response effort, and contact with consequences. Specifically, we pursue four objectives, stated as guiding research questions:

RQ1. What is the immediate impact of nudges on security behavior across domains and nudge types? We estimate effects using a common classification schema (Informational, Default/Design, Social, Framing) and report the distribution of positive and unclear findings (unit: study). This quantification makes clear where effects cluster and where evidence is heterogeneous.

RQ2. To what extent are durability and generalization evaluated in this literature using a priori behavior-analytic criteria? We define maintenance as performance after full withdrawal of prompts and any programmed consequences (planned threshold ≥ 2 weeks), and generalization as performance with untrained stimuli, settings, or responses. We also transparently report whether included studies implemented these assessments (note: only one study implemented a ≥2-week post-withdrawal probe).

RQ3. How can observed effects be explained mechanistically in behavior-analytic terms? We map each intervention to stimulus control (SDs), motivating operations (MOs), response effort, and contact with consequences, operationalized via four pre-specified flags: Response-Contingent Feedback (RCF), Effort, Aversive, Social/Rule. This approach supports interpretation in operant terms rather than labels alone.

RQ4. What are the field-level limitations, and what BA-informed research line follows? We identify limitations and outline a research agenda integrating nudges with programmed reinforcement, shaping or chaining, and stimulus-control transfer.

Contributions of this review: These objectives yield: (a) a corpus level map of nudging-labeled cybersecurity studies by domain and nudge type, (b) a mechanism-based interpretation of effects using four functional flags (RCF, effort, aversive, social/rule), (c) an explicit assessment of durability and generalization after withdrawal, and (d) a forward agenda for more ecologically valid and sustainability-focused evaluations.

2. Methods

This systematic review was conducted in accordance with the PRISMA guidelines [22]. The complete PRISMA checklist is provided in Supplementary Materials.

2.1. Eligibility Criteria

We focused on peer-reviewed empirical studies that treat nudging as an intervention strategy in digital security contexts and that include an explicit behavioral emphasis on user actions, decisions, or compliance. Crucially, we restricted inclusion to studies in which the authors explicitly describe their intervention as a “nudge.” Limiting the corpus to self-labeled nudges therefore enables us to examine the nudging paradigm as it is declared and practiced within cybersecurity research, rather than retrospectively expanding the sample on the basis of subjective similarity judgments.

2.1.1. Inclusion Criteria

• Conceptual relevance: The study explicitly addressed nudging as a behavioral intervention strategy, rather than as a rhetorical or metaphorical concept.
• Security context: The intervention analysis, or theoretical discussion was situated within a domain of security, including but not limited to cybersecurity, information security, data privacy, or online security.
• Empirical or applied approach: The study presented empirical data, experimental design, case studies, or applied projects implementing or evaluating nudging strategies in security-related contexts.
• Behavioral focus: The research investigated user behavior, decision-making, or psychological factors influencing security compliance, awareness, or risk perception.
• Peer-reviewed academic source: Only peer-reviewed journal articles and conference papers were included, ensuring scientific rigor and methodological transparency.

2.1.2. Exclusion Criteria

• Conceptual misalignment: The term nudge and/or security were used with meanings unrelated to behavioral interventions or digital contexts (e.g., political security, data governance or physical safety).
• Rhetorical or non-methodological use: “Nudge” was employed in a merely discursive or metaphorical sense, without empirical or methodological grounding.
• Lack of implementation: The study discussed nudging only at theoretical or conceptual level, without practical application in cybersecurity or user behavior analysis.
• Different focus domains: The focus was on unrelated topics such as smart governance, crisis management, banking authentication without a behavioral intervention component.
• Indirect relation to security behavior: The paper addressed topics such as cybersecurity culture or security perceptions (e.g., cryptocurrency) without explicitly linking them to nudging-based behavioral change.

To align the review’s scope and synthesis with our objectives, eligibility was implemented in two stages.

Stage 1 (corpus eligibility). We included peer-reviewed records situated in a digital security context that explicitly self-identified their approach as a “nudge.” This corpus comprised empirical studies, as well as applied projects (e.g., platforms) and modeling or analysis papers.

Stage 2 (eligibility for behavioral effect counts). Only records reporting a direct behavioral outcome were included in the descriptive effect counts (significant, non-significant, or trend). Records meeting Stage 1 but lacking a behavioral endpoint were retained for mapping domains, study designs, and intervention mechanisms; they were coded as “No behavioral outcome” and excluded from the behavioral effect counts.

2.2. Research Strategy

An initial search was conducted on 23 November 2025 in Scopus, APA PsycInfo, IEEE Xplore, and the ACM Digital Library. During peer review, and in response to reviewers’ requests, the search was updated on 7 February 2026 using the same databases and the query “(cybersecurity OR security) AND nudg*”. The final search results reported in this article correspond to the updated search. The wildcard nudg* was used to capture nudge/nudging/nudges. To preserve the review’s lexical focus on self-declared nudging, the query was implemented using an abstract-field restriction in each database where available. The query was translated and applied consistently across databases; the updated search was run on 7 February 2026. We included only studies that explicitly self-identified their intervention as a nudge. No time frame limits or additional semantic filters were applied, in order to avoid an overly restrictive selection and to include potential interdisciplinary applications of nudging within security contexts. Records from IEEE Xplore, the ACM Digital Library, and APA PsycInfo showed substantial overlap with Scopus. After merging all database exports and removing duplicates, 49 records were unique to the non-Scopus databases.

2.3. Selection Process

All screening counts reported below and in Figure 1 refer to the records retrieved via the final search strategy executed on 7 February 2026. In total, 266 records remained for subsequent screening and analysis. According to the eligibility criteria, we included only peer-reviewed academic publications. Therefore, records classified as gray literature or non-peer-reviewed materials were excluded at this stage (5 doctoral dissertations, 5 books, 24 book chapters, and 1 short survey). This resulted in 231 eligible peer-reviewed records (117 journal articles, 95 conference papers, 3 workshop papers, and 16 reviews) to be screened for appropriateness. During the title and abstract screening, 97 studies were excluded due to a conceptual misalignment, as they referred to forms of security unrelated to cybersecurity domains (e.g., food, energy, physical, or political security); 32 were excluded due to lack of implementation, because they mentioned nudging-related ideas (e.g., frameworks, toolkits, prototypes, or descriptive/attitudinal studies) without deploying and evaluating an actual behavioral intervention; 11 were excluded because nudging was discussed only at a rhetorical level, using the term metaphorically (e.g., policy/governance language or attacker-focused notions) without an applied end-user cybersecurity nudge; 13 were removed because the focus was on different or only indirectly related domains, including security perception without behavioral intervention, or topics centered on governance, risk management, financial authentication, or personality correlates without a nudging strategy; and 12 were excluded due to indirect relation to security behavior, where the work addressed adjacent topics but did not target security-related behaviors through a nudge intervention. A total of 66 records proceeded to full-text assessment; one full-text was not retrievable (n = 1).

Figure 1. PRISMA flowchart [22] for identification, screening, eligibility, and inclusion.

Two reviewers conducted all screening stages independently, resolving discrepancies by discussion; final counts and reasons for exclusion are summarized in the PRISMA flowchart [22] (Figure 1). Inter-rater reliability was assessed using Cohen’s kappa, which indicated an almost perfect level of agreement (κ = 0.87) across the screened records.

2.4. Data Collections Process and Data Items

We used an Excel spreadsheet to record key information from each study, including bibliographic details (authors, year, title, abstract, and document type). For each study, we also extracted the following: cybersecurity domain (password, privacy/data protection, IoT/device, organizational, Wi-Fi/network, phishing, financial, other), primary nudge type (informational, default/design, social, framing, other), behavioral mechanism flags (response-contingent feedback, effort reduction, aversive, social/rule), implementation approach (experimental, simulation/modeling, usability study, other), design type (between-subjects, online between-subjects, within-subjects, mixed models, longitudinal, survey, etc.), sample size, narrative (study-level narrative description), outcome type (adoption/use, password strength, choice/decision, clicks, awareness, intention, and no behavioral outcome), and significant effect (significant or not significant). We additionally coded the presence of follow-ups when conducted after at least two weeks.

2.4.1. Operationalization

We adopt the classical definition of “nudge” as a change in choice architecture that steers behavior without forbidding options or imposing significant incentives or sanctions. Operationally, we treat nudges as light-touch, antecedent-only manipulations (e.g., salience, timing, defaults, response cost) intended to increase the momentary probability of secure responding. Because many cybersecurity papers self-label as “nudges” while embedding response-contingent interface feedback, we use the term nudge-labeled interventions for the full corpus, and reserve pure nudges for antecedent-only arrangements. This preserves the classical definitional constraint while allowing a functional analysis of what the literature actually implements. When the interface delivers response-contingent outcomes (e.g., progress meters; warnings that extinguish upon compliance), these may function as conditioned positive reinforcement or negative reinforcement (removal of an aversive), which typically produces larger and more durable effects than antecedent-only prompts [12,19,20]. Consistent with the aims of this review, PRISMA was adopted as a procedural standard for search, screening, and reporting. However, data extraction and synthesis were theory-driven. In particular, intervention features and outcomes were interpreted through a behavior-analytic framework, which prioritizes stimulus control, response effort, and contact with consequences. This framework does not constitute a universal quality appraisal of studies, but an explicit analytical lens for identifying functional regularities within the nudging-labeled literature.

2.4.2. Classification of Interventions

Interventions were coded at two levels. First, each study was assigned the type of nudge used (e.g., informational/feedback, default/design, social, framing). This pragmatic taxonomy draws on established syntheses of nudge typologies [23,24] and digital nudging frameworks [25], adapted to cybersecurity contexts. We coded nudge types into four recurring categories: informational or feedback, design-based or default, social, and framing. We used these categories as a pragmatic organizing framework to maintain comparability with prior reviews, and then interpreted interventions through an explicit behavior-analytic lens. Accordingly, the taxonomy is an analytically guided synthesis, not a novel theoretical classification. Second, four behavioral mechanisms were coded to enable comparisons regarding how nudges function: response-contingent feedback (RCF), effort reduction, aversive stimulation, and social/normative cues. This structure maintains comparability with prior typologies while enabling a behavior-analytic lens on functional features. Behavioral mechanisms were selected to reflect stimulus control, motivating operations, and contact with consequences; key variables in the operant analysis of the consolidation of behavior as habit. Specifically, the presence of RCF indicates immediate contact with consequences (e.g., success signal, removal of a warning signal), whereas effort and aversion mechanisms track changes in response cost and potential escape/avoidance reactions. We code an aversive element descriptively when warnings, loss frames, or threat cues are present. Functionally, these elements may operate as discriminative stimuli for avoidance, as establishing operations that shift the value of escape, as punishment when presented contingent on risky responding, or as negative reinforcement when their termination is contingent on secure responding. We therefore treat “aversive” as a surface feature whose operant function must be inferred from the programmed contingency. The social/rule mechanism captures verbal SDs and rule-regulated influences. This functional foundation follows standard BA treatments of consequence selection and social control [26].

The significance of effects was coded based on each study’s statistical results. Maintenance was predefined as performance after complete cessation of prompts and any programmed consequences; however, only a few studies report delayed measurements. Only one study evaluated performance after complete withdrawal of the intervention, and it did not demonstrate maintenance under the present behavioral criterion. We planned an interval of ≥2 weeks after cessation for a valid follow-up. Generalization was coded only if studies tested untrained stimuli, settings, or responses; it was not observed in any study. We note that some studies in the corpus report delayed measurements or short-term “follow-up” phases. However, these do not satisfy the present criterion for maintenance, because the intervention (e.g., prompts, feedback, interface modifications) remains in place, or outcomes are merely re-measured after a brief delay. Under a functional definition, such designs cannot distinguish durable behavior change from continued stimulus control or novelty effects. Consistent with our aim to examine how the nudging paradigm is declared and operationalized in cybersecurity, we included applied projects, platforms, and modeling/analysis papers when the authors explicitly self-identified the approach as a “nudge”. To prevent a conceptual mismatch in the synthesis, these records are flagged as “No behavioral outcome” (see Methods) and excluded from behavioral effect counts, while being retained to map design space, mechanisms, and domain coverage.

2.4.3. Study Risk of Bias Assessment

Traditional risk-of-bias tools developed for clinical or epidemiological research (e.g., Cochrane RoB, ROBINS-I) are poorly suited to the heterogeneous designs typical of HCI and cybersecurity research, which include laboratory experiments, online studies, field deployments, simulations, and mixed-methods approaches. Rather than applying a clinical-style appraisal, we adopted a functional quality lens grounded in behavior-analytic theory. Each study was characterized along three dimensions central to behavioral change: (a) ecological validity (laboratory vs. field setting), (b) outcome type (direct behavioral vs. attitudinal or descriptive), and (c) temporal scope (presence of follow-up after complete withdrawal of the intervention). These dimensions were used descriptively to qualify the strength and limitations of the evidence across domains. Two reviewers independently verified these classifications; discrepancies were resolved by discussion. This approach does not provide a universal “risk score,” but offers a transparent and theoretically coherent appraisal of methodological limitations relevant to behavioral durability and generalization. To mitigate coding bias and maximize replicability, all classification variables (e.g., nudge type, cybersecurity domain, outcome, significant result, and behavioral mechanism) were first automatically generated in Excel using predefined keyword dictionaries (e.g., feedback, real-time, real time, password meter, strength indicator, warning, alert, notification, reminder, prompt, crack time, time to crack, visualization, contextual warning, contextual alert, adaptive alert for Informational/Feedback nudges) and Boolean rules (e.g., applied to study abstracts, followed by manual checking through reading the article text and correcting the automatic coding where necessary). This methodology was used to reduce subjective discretion at the time of initial coding and to limit judgment to transparent and verifiable corrections. Two reviewers independently checked the automatically generated labels against the source text. Discrepancies, both between the automation and a reviewer, and between the reviewers themselves, were resolved through discussion using the same a priori criteria. We maintained a complete audit trail (workbook with versions, change log, and a “reason for replacement” field), allowing clear reconstruction of when and why a code deviated from the automatic assignment. The full Boolean rules are provided as Supplementary Material Table S1.

2.4.4. Effect Measures

Given the extreme heterogeneity of designs, outcomes, and reporting formats in the included studies, no common quantitative effect size could be extracted or computed across the corpus, the categorical effect indicator (significant/non-significant/trend) is computed only for studies with a direct behavioral outcome. Records coded as “No behavioral outcomes” were summarized narratively but not entered into behavioral effect tallies. Outcomes range from password strength scores and click-through rates to purchase intentions and awareness measures, often reported using incompatible metrics. Accordingly, the unit of synthesis was the study, and effects were operationalized at the study level as: statistically significant effect in the hypothesized direction; non-significant effect, or trend-level effect as reported by the original authors. This categorical indicator was used solely for descriptive purposes, to identify where effects cluster within the nudging-labeled literature, and not as an estimate of magnitude or comparative efficacy.

2.4.5. Data Preparation for Synthesis

To enable synthesis across heterogeneous designs, outcomes were harmonized at the study level. When a study reported multiple outcomes, we prioritized direct behavioral endpoints over attitudinal measures; if multiple behavioral outcomes were present, the primary outcome emphasized by the authors was retained. When results differed across outcomes within a study, the most conservative classification was applied. Outcomes were recorded into a common taxonomy (e.g., password strength, adoption/use, choice/decision, clicks, intentions, awareness, no behavioral outcome). Statistical results were reduced to four categories (significant, non-significant, trend and not reported) based on the authors’ reports. This procedure allowed consistent cross-study comparison while preserving the direction and interpretive intent of the original analyses.

2.4.6. Reporting Bias Assessment

No formal statistical assessment of reporting bias (e.g., funnel-plot asymmetry or regression-based tests) was conducted. Such methods presuppose commensurable quantitative effect measures, which are absent in the present corpus due to the extreme heterogeneity of designs, outcomes, and reporting formats. Instead, potential reporting bias was considered qualitatively by: documenting the prevalence of studies with no behavioral outcomes, comparing the distribution of significant and non-significant findings across domains and outcome types and explicitly retaining studies reporting null or unclear effects. This descriptive approach is consistent with the study-level synthesis adopted in this review and is reported in the Results section.

3. Results

3.1. Temporal and Topical Evolution of the Corpus (2012–2025)

As shown in Figure 1, the corpus spans 65 studies published between 2012 and December 2025. The temporal pattern is one of gradual emergence followed by acceleration: early contributions are relatively sparse and largely anchored to foundational usability and decision-oriented security problems; in later years the number of nudging-labeled cybersecurity studies increases, reflecting the consolidation of “digital nudging” as a recognizable label within security adjacent HCI work. Across the period, the corpus remains predominantly empirical and intervention-focused, but with growing heterogeneity in designs and settings, ranging from controlled experiments and online studies to usability testing and applied prototypes.

Topically, the corpus is consistently concentrated in password security and privacy/data security, which together account for the majority of included records. This concentration is stable over time, likely because both domains provide frequent, well-defined decision points and measurable behavioral outcomes (for example, password creation choices and privacy setting selections). Over the same period, smaller but increasingly visible clusters extend nudging approaches into organizational and network contexts (including Wi-Fi), IoT and device configuration, phishing related behaviors, and security awareness interventions. Overall, the evolution is best characterized as expansion around a stable core: password and privacy remain the primary application areas, while peripheral domains broaden the scope of problems addressed and diversify the behavioral targets that nudging-labeled interventions attempt to influence.

3.2. Study Selection and Characteristics

The corpus comprises 65 studies (Figure 1) published between 2012 and 18 December 2025, concentrated primarily in password security (27/65) and privacy/data security (13/65), with smaller clusters in organizational security, Wi-Fi/network security, IoT/device security, phishing, and security-awareness contexts. Across this heterogeneous landscape, a recurrent functional pattern emerges: studies that frame their interventions as nudges tend to report more reliable effects when outcomes capture overt performance at the point of action (e.g., password strength, clicks, configuration choices), whereas effects are weaker, inconsistent, or absent when outcomes are attitudinal, self-reported, or indirect. This pattern is reflected in the distribution of reported statistical results across studies, but its interpretive value lies not in the raw count of p-values, rather in the functional structure of the tasks and interfaces in which behavior is embedded. An overview of all included studies and their classification by cybersecurity domain, nudge type, and outcome is reported in Table 1.

Table 1. All included articles by authors, title, year of publication, cybersecurity domain, type of nudge implemented, and behavioral outcome.

Authors	Title	Cybersecurity Domain	Nudge Type	Outcome Measured	Behavioral Mechanisms
Agha et al., 2025 [27]	SocialSim: An Open Source Platform for Conducting Behavioral Intervention Research on Social Media	Security Awareness	Informational/ Feedback	No behavioral outcome	No behavioral mechanism
Alashoor et al., 2023 [28]	An Online Randomized Field Experiment on the Importance of Privacy Education, Training, and Awareness (PETA)	Password Security	Informational/ Feedback	Awareness	Social
Amador et al., 2023 [29]	Prospects for Improving Password Selection	Password Security	Framing	Adoption/Use	Social; Aversive
Baumer et al., 2024 [1]	Digital Nudges for Access Reviews: Guiding Deciders to Revoke Excessive Authorizations	Organizational Security	Default/design	Choice/Decision	Effort
Bayuk and Patrick, 2021 [30]	Is the uphill road the one more taken? How task complexity prompts action on non-pressing tasks	Password Security	Default/design	Adoption/Use	Social; Aversive
Ben Salem et al., 2023 [31]	User modelling for privacy-aware self-disclosure	Privacy/Data Security	Informational/ Feedback	Choice/Decision	RCF; Social
Ben Salem et al., 2020 [32]	A nudge-based recommender system towards responsible online socializing	Privacy/Data Security	Informational/ Feedback	No behavioral outcome	No behavioral mechanism
Bonneau, 2012 [33]	The science of guessing: Analyzing an anonymized corpus of 70 million passwords	Password Security	Informational/ Feedback	Password strength	RCF
Carmichael et al., 2018 [34]	SHRUBS: Simulating influencing human behaviour in security	Organizational Security	Social	No behavioral outcome	No behavioral mechanism
Congiu et al., 2025 [35]	Digital Nudging and Cookie Rejection: An Experiment	Privacy/Data Security	Framing	Choice/Decision	Effort
Coventry et al., 2014 [36]	SCENE: A structured means for creating and evaluating behavioral nudges in a cyber security environment	Wi-Fi/Network Security	Default/design	Choice/Decision	Effort
Dumaru et al., 2024 [37]	“It’s hard for him to make choices sometimes and he needs guidance”: Re-orienting Parental Control for Children	Security Awareness	Informational/ Feedback	No behavioral outcome	No behavioral mechanism
Edwards et al., 2026 [38]	Can a conventional email phishing nudge help fight SMiShing attacks?	Phishing	Informational/ Feedback	Choice/Decision	Social
Egelman and Pe’er, 2015 [39]	The myth of the average user: Improving privacy and security systems through individualization	Privacy/Data security	Default/design	No behavioral outcomes	No behavioral mechanism
Fischer and Grossklags, 2022 [40]	Nudging Software Developers Toward Secure Code	Wi-Fi/Network Security	Default/design	Clicks	RCF; Aversive
Fischer et al., 2019 [41]	Stack overflow considered helpful! Deep learning security nudges toward stronger cryptography	WI-FI/Network Security	Informational/ Feedback	Clicks	RCF; Aversive
Frik et al., 2019 [42]	A promise is a promise the effect of commitment devices on computer security intentions	Password Security	Informational/ Feedback	Intentions	Effort; Social
Furnell et al., 2018 [43]	Enhancing security behavior by supporting the user	Password Security	Informational/ Feedback	Password strength	RCF
Ghaiumy Anaraky et al., 2025 [44]	Would You Preserve Your Privacy or Enhance it? How to Best Frame Privacy Interventions for Older and Younger Users	Privacy/Data Security	Framing	Intentions	Social; Aversive
Goel et al., 2020 [45]	Understanding the role of incentives in security behavior	Organizational security	Social	Adoption/Use	RCF; Social
Guan et al., 2018 [46]	VaultIME: Regaining user control for password managers through auto-correction	Password Security	Default/design	No behavioral outcome	No behavioral mechanism
Hartwig et al., 2021 [47]	Finding secret treasure? Improving memorized secrets through gamification	Password Security	Default/design	Adoption/Use	Social
Hartwig and Reuter, 2022 [48]	Nudging users toward better security decisions in password creation using whitebox-based multidimensional visualizations	Password Security	Informational/ Feedback	Adoption/Use	RCF; Social
Havens and Latulipe, 2024 [49]	Proxy Accounts and Behavioral Nudges: Investigating Support for Older Adults and their Financial Delegates	Privacy/Data Security	Informational/ Feedback	Intentions	Social
Hiraoka et al., 2023 [50]	WiLearn: Design and Implementation of a Microlearning System that Utilizes a Captive Portal of Wi-Fi	Security Awareness	Informational/ Feedback	Awareness	Social; Aversive
Hirschprung et al., 2017 [51]	Analyzing and optimizing access control choice architectures in online social networks	Privacy/Data Security	Default/design	Usability coverage	Effort
Hornemann et al., 2025 [52]	Exploring the Effects of Cybersecurity Awareness and Decision-Making Under Risk	Phishing	Informational/ Feedback	Choice/Decision	Social; Aversive
Ho-Sam-Sooi et al., 2021 [53]	Investigating the effect of security and privacy on IoT device purchase behavior	IoT/Device Security	Framing	Intentions	Social
Hupperich and Dassel, 2020 [54]	On the usefulness of user nudging and strength indication concerning unlock pattern security	Password Security	Informational/ Feedback	Password strength	RCF; Social
Inaba and Terada, 2023 [55]	Nudge to Promote Employees’ Information Security Compliance Behavior: A Field Study	Organizational security	Social	Adoption/Use	Social
Jeske et al., 2014 [56]	Decision justifications for wireless network selection	WI-FI/Network Security	Informational/ Feedback	Choice/Decision	Social; Effort
Kaleta et al., 2019 [57]	Nudging with construal level theory to improve online password use and intended password choice: A security-usability tradeoff perspective	Password Security	Framing	Adoption/Use	Social
Kankane et al., 2018 [58]	Can We Nudge Users Toward Better Password Management? An Initial Study	Password Security	Framing	Adoption/Use	Social; Effort
Kennison et al., 2021 [59]	Who creates strong passwords when nudging fails	Password Security	Framing	Password strength	Social
Lain et al., 2024 [60]	Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training	Phishing	Informational/ Feedback	Clicks	RCF; Social
Mutyavaviri et al., 2024 [61]	Dishonesty, neutralization and nudging	Password Security	Informational/ Feedback	Intentions	Social
Nicholson et al., 2018 [62]	Simple nudges for better password creation	Password Security	Informational/ Feedback	Password strength	RCF
Parish et al., 2021 [63]	A study on priming methods for graphical passwords	Password Security	Default/design	Password strength	Social
Pathmabandu et al., 2021 [64]	ICME: an informed consent management engine for conformance in smart building environments	Privacy/Data Security	Informational/ Feedback	No behavioral outcome	No behavioral mechanism
Peer et al., 2024 [65]	“Protect Me Tomorrow”: Commitment Nudges to Remedy Compromised Passwords	Password Security	Social	Choice/Decision	Effort; Social
Percival et al., 2022 [66]	CryptoScratch: Developing and evaluating a block-based programming tool for teaching K-12 cryptography education using Scratch	Security Awareness	Informational/ Feedback	Task completion	RCF; Social
Prange et al., 2022 [67]	“Secure settings are quick and easy!”–Motivating End-Users to Choose Secure Smart Home Configurations	IoT/Device Security	Informational/ Feedback	Password strength	Social; Aversive
Qu et al., 2023 [68]	Interactions of Framing and Timing in Nudging Online Game Security	Password Security	Framing	Password strength	Social; Aversive
Qu et al., 2022 [69]	Your Behaviors Reveal What You Need: A Practical Scheme Based on User Behaviors for Personalized Security Nudges: A Practical Scheme Based on User Behaviors for Personalized Security Nudges	Password Security	Social	Adoption/Use	Social
Qu et al., 2021 [70]	Design and Evaluation of CFC-targeted Security Nudges	Password Security	Framing	Intentions	Social
Raptis et al., 2021 [71]	Better, Funner, Stronger: A Gameful Approach to Nudge People into Making Less Predictable Graphical Password Choices	Password Security	Default/design	Adoption/Use	Social
Reittinger et al., 2025 [72]	Motivational factors in cybersecurity: linking theory to organizational practice	Organizational security	Informational/ Feedback	No behavioral outcome	No behavioral mechanism
Renaud and Zimmermann, 2018 [73]	Guidelines for ethical nudging in password authentication	Password Security	Informational/ Feedback	Adoption/Use	Social; Effort
Renaud et al., 2017 [74]	Lessons learned from evaluating eight password nudges in the wild	Password Security	Informational/ Feedback	Adoption/Use	Social
Saad and Khan, 2016 [75]	Nudging Pakistani users toward privacy on social networks	Organizational security	Informational/ Feedback	Choice/Decision	RCF; Aversive
Satri et al., 2025 [76]	Digital Nudging for Accelerating the Take Up of Electronic Payment in the Moroccan Port Ecosystem	Privacy/Data Security	Informational/ Feedback	No behavioral outcome	No behavioral mechanism
Sawaya et al., 2023 [77]	Does the Anchoring Effect Influence Individuals’ Anti-phishing Behavior Intentions?	Phishing	Informational/ Feedback	Intentions	Social; Aversive
Stavova et al., 2017 [78]	Factors influencing the purchase of security software for mobile devices-Case study	IoT/Device Security	Default/design	Purchase rate	Social
Story et al., 2020 [79]	From intent to action: Nudging users toward secure mobile payments	Privacy/Data Security	Informational/ Feedback	Adoption/Use	Social
Talukder et al., 2022 [80]	User awareness and defenses against sockpuppet friend invitations in Facebook	Privacy/Data Security	Default/design	Choice/Decision	RCF; Aversive; Social
Turland et al., 2015 [81]	Nudging toward security: Developing an application for wireless network selection for android phones	WI-FI/Network Security	Default/design	Choice/Decision	Social; Aversive; Effort
Ur et al., 2012 [82]	How does your password measure up? The effect of strength meters on password creation	Password Security	Informational/ Feedback	Password strength	RCF
Walterscheid et al., 2024 [83]	Nudging purchase intention toward more secure domestic IoT: The effect of label features and psychological mechanisms	IoT/Device Security	Informational/ Feedback	Intentions	Social; Effort
Wang and Sarkar, 2019 [84]	Nudging young people toward safe internet behavior	Privacy/Data Security	Social	Awareness	No behavioral mechanism
Yevseyeva et al., 2016 [85]	Modeling and analysis of influence power for information security decisions	WI-FI/Network Security	Default/design	No behavioral outcome	No behavioral mechanism
Zahid et al., 2024 [86]	Making EULA Great Again: A Novel Nudge Mechanism to Improve Readability, User Attention and Awareness	Privacy/Data Security	Informational/ Feedback	Awareness	Social; Effort
Zheng and Becker, 2023 [87]	Checking, nudging or scoring? Evaluating email user security tools	Phishing	Informational/ Feedback	Awareness	RCF; Social
Zibaei et al., 2022 [88]	Do Password Managers Nudge Secure (Random) Passwords?	Password Security	Default/design	Adoption/Use	Effort; Social
Zibaei et al., 2023 [89]	Dissecting Nudges in Password Managers: Simple Defaults are Powerful	Password Security	Default/design	Adoption/Use	Effort; Social
Zimmermann and Renaud, 2021 [90]	The nudge puzzle: Matching nudge interventions to cybersecurity de cisions	Password Security	Informational/ Feedback	Password strength	RCF; Social

3.3. Risk of Bias in Studies

Across the corpus, methodological quality varies systematically along the three dimensions used in this review. Most studies rely on short, online, between-subject designs, with limited ecological validity. Direct behavioral outcomes are common in password, network, and phishing domains, but less frequent in organizational and awareness contexts, where attitudinal measures dominate. Evidence on post-intervention persistence is limited. Delayed follow-ups are reported in a minority of studies, and only a few explicitly test behavior after complete removal of the intervention [90].

These features constrain inference about durability and real-world transfer. Non-significant or unclear results cluster in studies lacking direct behavioral endpoints or field deployment, whereas studies embedding consequence contact or effort asymmetries at the point of action show more consistent effects. These patterns qualify the strength of the evidence and highlight systematic risks associated with short-term, antecedent-only designs.

3.4. Results of Individual Studies

Given the pronounced heterogeneity across the included records (N = 65), in study design, target populations, outcome definitions, measurement scales, and intervention structures, a quantitative aggregation with uniform summary statistics or standardized effect sizes was not feasible. Many studies reported outcomes on incomparable metrics and, in several cases, did not provide the information necessary to compute commensurable effect estimates. To avoid spurious precision and misleading comparability, no meta-analysis was conducted.

Instead, findings are presented at the individual-study level in structured tables that preserve study-specific interpretability. For each record, we report the cybersecurity domain, the operationalization of the intervention (nudge type), the outcome class as measured by the authors, and the study’s statistical conclusion as stated in the primary report (“Significant,” “Trend,” or “Not reported”). This study-level presentation maintains fidelity to the original operational definitions and statistical thresholds used in the source studies while preventing inappropriate cross-study pooling when metrics, scales, or endpoints diverge.

To support a transparent and functionally oriented narrative synthesis, studies are grouped along two complementary axes. First, we organize the corpus by domain (e.g., password security, privacy/data security, organizational security, Wi-Fi/network security, phishing, IoT/device security, security awareness) and by nudge type (Informational/Feedback; Default/Design; Framing; Social; Unspecified). Second, we apply a cross-cutting mechanism coding that flags the presence/absence of four behavioral levers within each intervention: response-contingent feedback (RCF), aversive signals, social components, and effort manipulations. These mechanism flags are summarized descriptively (as frequencies of presence), without imputing causal weights or assuming additivity across levers. In other words, mechanisms are used to characterize how interventions were functionally embedded in the task flow, rather than to estimate their independent effects.

Across the corpus, four primary nudge categories were identified, informational/feedback, default/design, framing, and social, alongside a small “other” group and one unspecified entry. Their overall distribution is: informational/feedback 34/65 (52.3%); default/design 16/65 (24.6%); framing 9/65 (13.8%); social 6/65 (9.2%).

Informational/feedback nudges are the most frequently studied (34/65). They include dynamic password meters, strength indicators, contextual warnings, crack-time visualizations, and adaptive alerts. These designs make the consequences of insecure actions perceptually salient during task execution. Prior work suggests that users are especially responsive to such interactive feedback, which embeds security-relevant information directly into ongoing behavior [48,91]. However, their effectiveness depends on boundary conditions such as personalization, cognitive accessibility, and timing [39,92], underscoring that salience alone is insufficient without careful integration into the task flow.

Default/design nudges constitute the second largest group (16/65). These interventions reconfigure interfaces so that secure choices become the path of least resistance (e.g., pre-generated passwords, privacy-protective defaults, secure IoT configurations). Rather than relying on persuasion, they alter response effort and action costs. Studies such as that of Zibaei et al. [88] illustrate how default-based designs increase compliance by lowering the effort required for secure behavior; comparable dynamics appear in consent architectures, where interaction costs and salience systematically shape acceptance patterns [93].

Social nudges are comparatively rare (6/65) and rely on normative messages, peer comparison, or socially framed cues. Their effects are mixed [36,57,58], suggesting sensitivity to user perceptions, cultural context, and immediate task demands. Unlike feedback or defaults, these interventions often operate through verbal or symbolic cues that do not directly modify the contingencies of action.

Framing nudges account for 9/65. These include gain–loss framing, fear appeals, adaptive agents, gamified elements, and emotionally charged warnings. Their impact appears strongly moderated by timing and task relevance [68,94]. In the absence of direct consequence contact or effort asymmetries, framing-based manipulations tend to yield variable and context-dependent outcomes.

Taken together, these distributions indicate that, within the nudging-labeled literature, effectiveness is less a property of the label “nudge” itself than of how interventions are functionally embedded in the task: designs that reshape immediate contingencies, through feedback, effort, or defaults, produce more consistent behavioral change than those that operate primarily through verbal persuasion or attitudinal influence.

Domain Distribution and Analysis of Effects

Evidence is topically concentrated. The largest share of studies falls under password security (27/65; 41.5%), followed by privacy/data security (13/65; 20%). Smaller clusters cover organizational security (6/65; 9.2%), Wi-Fi/network security (6/65; 9.2%), phishing (5/65; 7.7%), IoT/device security (4/65; 6.2%), and security awareness (4/65; 6.2%). Within domains, the distribution of nudge families is uneven. Password security exhibits the greatest methodological breadth, spanning informational/feedback [28,33,42,43,48,54,61,62,73,74,82,90], default/design [30,46,47,63,71,88,89], framing [29,57,58,59,68,70], and social interventions [65,69]. Privacy/data security is dominated by informational/feedback [31,49,64,76,79,86], with smaller contributions from default/design [39,51,80] and framing [35,44] and just one social nudge [84]. Organizational security features a higher proportion of social interventions [34,45,55], complemented by informational/feedback [72,75] and isolated default/design entries [1]. Wi-Fi/network security combines default/design [36,40,81,85] and informational/feedback [41,56], while phishing is almost exclusively informational/feedback [38,52,60,77,87]. IoT/device security is distributed across informational/feedback [67,83], default/design [78], and framing in small numbers [53], and security awareness is represented solely by informational/feedback designs [27,37,50,66]. The cross-tabulation exposes systematic “empty cells” that delimit the currently explored design space: there are no default/design studies in phishing or security awareness, and no social studies in IoT/device security, Wi-Fi/network security, or phishing. Framing is also absent in Wi-Fi/network security (Table 2). These lacunae do not necessarily imply domain-specific unsuitability of the missing nudge families; rather, they indicate constrained exploration to date and a narrow operationalization of “nudging” in less-represented cybersecurity contexts.

Table 2. Frequency of type of nudge implemented per cybersecurity domain (unit of analysis: number of articles).

	Default/Design	Framing	Informational/ Feedback	Social	Total
Password Security	7	6	12	2	27
Privacy/Data Security	3	2	7	1	13
Organizational Security	1	0	2	3	6
WI-FI/Network Security	4	0	2	0	6
Phishing	0	0	5	0	5
IoT/Device Security	1	1	2	0	4
Security Awareness	0	0	4	0	4
Total	16	9	34	6	65

These distributions reveal both topical concentration, most prominently in password security, and methodological concentration around informational/feedback designs. They also expose systematic “empty cells”: for example, no default/design interventions in phishing or security awareness, and no social nudges in IoT/device security, Wi-Fi/network security, or phishing. Rather than reflecting intrinsic limits of these domains, these gaps point to constrained design exploration and a narrow operationalization of what “nudging” entails in less-represented cybersecurity contexts.

Overall, the proportion of significant results is highest in framing (8/9; 88.9%), followed by default/design (11/16; 68.8%), informational/feedback (23/34; 67.6%, with five cases trending and six not reported) and social (4/6; 66.7%, with one trend and one not reported). By domain, in password security (27 studies), significant results appear in all families: default/design 5/7, framing 5/6, informational/feedback 8/12 (plus three trends and one not reported) and social 1/2 (plus one trend). In privacy/data security (13), the significant results are concentrated in informational/feedback 5/7, framing 2/2, and default/design 2/3, while the only social study is not reported. In organizational security (6), all reported results are significant: default/design 1/1, informational/feedback 2/2, social 3/3. In WI-FI/network security (6), default/design prevails (3/4 significant, 1 not reported) alongside 2/2 significant in informational/feedback. In IoT/device security (4), informational/feedback 2/2 and framing 1/1 are significant; the only default/design is not reported. In phishing (5), coverage is exclusively informational/feedback with two significant, one trend, and two not reported. In security awareness (4), only informational/feedback appears with two significant, one trend, and one not reported. These patterns indicate where the positive effects are concentrated (in particular password security and, across the board, informational/feedback) and where reporting is incomplete (e.g., default in IoT, part of informational/feedback in phishing and security awareness), providing the basis for analysis by outcome and mechanism. These patterns directly address RQ1 by showing that short-term behavioral effects are strongest in password and privacy or data security domains, particularly for informational or feedback and default or design nudges that restructure contingencies at the interface.

The analysis indicates that interventions do not act as isolated modules but as coordinated constellations in which four levers, response-contingent feedback (RCF), aversive signals, social components, and effort manipulations, are integrated within the task flow to steer choices toward safer outcomes. At the aggregate level, mechanism flags indicate a cross-cutting presence of social components (48), followed by RCF (19), effort (17), and aversive signals (15). Within informational/feedback designs, co-occurrence is most pronounced: RCF is present in 16 cases, Social in 26, Aversive in 8, and Effort in 7, reflecting configurations in which interface feedback is frequently accompanied by brief explanatory messaging and, in some instances, risk salience. In default/design interventions, Effort predominates (7), with contributions from Social (9) and smaller occurrences of Aversive (4) and RCF (2), indicating that cost/effort asymmetries are often paired with orienting microcopy and only occasionally with contingent feedback. Framing interventions are primarily Social (7), with additional Aversive (3) and occasional Effort (2), consistent with verbally mediated manipulations that sometimes include risk salience and small operational easements. In the Social nudge category, the Social mechanism is present in all cases (6), while RCF and Effort appear sporadically (1 each). Hybrid configurations integrating three levers (e.g., RCF + Aversive + Social; Social + Aversive + Effort) are observed across domains, indicating recurrent overlaps between informational salience, verbal guidance, and cost shaping. These quantitative patterns (Table 3) describe the distribution of mechanisms within nudge types and provide context for interpreting study-level outcomes (intentions; choices/decisions; adoption/use; password strength; clicks), without drawing causal inferences beyond the operational features documented in the included studies. The mechanism analysis is intentionally descriptive. Counts speak to what levers are implemented and how often within each family, not to their independent causal contributions. Given the common co-deployment of levers and the heterogeneity of outcome metrics, the safest inference is functional: designs that reconfigure immediate contingencies (via RCF and/or Effort) tend to be architected differently from those that operate verbally (via Social framing or Aversive cues), and these architectural choices are visible in the mechanism fingerprints summarized above.

Table 3. Frequency of behavioral mechanism implemented per nudge type (unit of analysis: number of mechanisms).

	Aversive	Social	Effort	RCF	Total
Informational/feedback	6	22	5	13	46
Default/design	4	9	6	2	21
Framing	3	8	2	0	13
Social	0	4	1	1	6
Total	13	43	14	16	-

Studies measuring intentions appear mainly in password security [42,61,70], with occurrences also in phishing [77]. In this outcome class, significant results are typically associated with Social levers (messages/commitment/rules) and, when present, with Aversive signals that increase the salience of risk; RCF is less represented because the outcome is declarative rather than performance-based. Where the frame is inserted into the operational flow, small contributions from Effort appear. In summary, Social ± Aversive characterizes positive cases, with informational/feedback used as textual support rather than contingent feedback.

Choice/decision measures are present in password security [65], Wi-Fi/network security [36,56,81], and privacy [31,35,80]. Here, significant outcomes occur when the intervention provides RCF at the point of action (e.g., alerts/labels that update) and/or inserts Aversive elements; in defaults/design, effects are observed when the Effort lever makes the safe option the path of least resistance. The Social component acts as a micro-instruction that clarifies the signal and often co-occurs with RCF or Effort, especially in network choices (sorting/colors) and consent interfaces.

For the adoption/use of secure tools or configurations, the greatest proportion of significant effects is observed with default/design [30,47,88] and informational/feedback [73,79]. The determining lever is Effort (protective defaults, friction on risky paths), frequently accompanied by Social (microcopy that legitimizes the choice). RCF appears in subsets of studies, typically as confirmation or advancement; Aversive is less systematic. The pattern is consistent in domains where the action is observable (activating protections, choosing secure settings).

The results on password strength are almost always linked to informational/feedback (meters/indicators) [33,54,62]. In this family, the significant effects correspond mainly to RCF; the Social lever (short texts) is often co-present and makes the feedback interpretable; Aversive elements appear in some studies as risk warnings, while Effort has no influence on the measured outcome.

Outcomes based on clicks (phishing, code/network selection) show effects when the interface provides immediate RCF (suspicion scores, badges, warnings that extinguish upon compliance), often coupled with Aversive signals that heighten risk salience. Social appears as micro-instructions that clarify the cue; Effort plays a smaller role than for other outcomes.

Awareness measures occur primarily in informational/feedback designs and display variability [28,50,86]: positive cases pair Social + RCF (explanatory prompts with small feedback), whereas not reported or non-significant studies tend to employ purely antecedent prompts. Effort is generally irrelevant for awareness-only outcomes (Table 4).

Table 4. Significant outcomes by cybersecurity domain and outcome measured (unit of analysis: number of articles). Note: Only studies with a direct behavioral outcome are included in this table; records coded as ‘No behavioral outcome’ were excluded from effect tallies.

		Adoption /Use	Awareness	Choice/ Decision	Clicks	Intentions	Password Strength	Other	Total
IoT/Device Security	Not rep.	0	0	0	0	0	0	1	1
	Sign.	0	0	0	0	2	1	0	3
Organ. security	Not rep.	0	0	0	0	0	0	0	0
	Sign.	2	0	2	0	0	0	0	4
Passw. Security	Not rep.	1	0	0	0	0	2	0	3
	Sign.	8	1	1	0	3	6	0	19
	Trend	3	0	0	0	0	1	0	4
Phishing	Not rep.	0	1	1	0	0	0	0	2
	Sign.	0	0	0	1	1	0	0	2
	Trend	0	0	1	0	0	0	0	1
Privacy/Data Security	Not rep.	0	2	0	0	0	0	1	3
	Sign.	1	0	3	0	2	0	0	6
Security Awar.	Not rep.	0	0	0	0	0	0	0	0
	Sign.	0	1	0	0	0	0	0	1
	Trend	0	0	0	0	0	0	1	1
WI-FI/Network Security	Not rep.	0	0	0	0	0	0	0	0
	Sign.	0	0	2	2	0	0	0	4
Total	Sign.	11	2	8	3	8	7	0	39
	Not rep.	1	3	1	0	0	2	2	9
	Trend	3	0	1	0	0	1	1	6

Evidence is concentrated in usability studies (16/65) and online between-subjects experiments (16/65). Online between-subjects studies report the highest share of significant findings (15/16; 93.8%), with one non-reported outcome. Usability studies show 10/16 (62.5%) significant results and 3/16 (18.8%) trends, alongside 3/16 non-reported outcomes. Interviews contribute 4/7 (57%) significant results, with one trend and two non-reported. Modeling/simulation studies yield 2/3, significant and one trend, reflecting their primarily methodological focus. In controlled settings, laboratory between-subjects designs show 5/6 (83%) significant results and one trend. Mixed models are rare (1/2 significant; 1/2 not reported). Single-instance designs, longitudinal between-subjects, survey, and within-subjects, each report a significant effect but are underpowered for generalization. The residual “other” category contains no significant results and is minimally represented (Table 5). Overall, immediate effects are most frequently documented in short, online or usability-style evaluations; longitudinal verification is nearly absent; only one study implemented a two-week post-withdrawal assessment, which did not demonstrate behavioral persistence [90].

Table 5. Significant outcomes by design (unit of analysis: number of articles).

	Not Rep.	Sign.	Trend	Total
Usability study	3	10	3	16
Between subjects (Online)	1	15	0	16
Interview	2	4	1	7
Modeling/simulation	0	2	1	3
Between subjects (Laboratory)	0	5	1	6
Mixed models	1	1	0	2
Other	2	0	0	1
Longitudinal between subjects	0	1	0	1
Survey	0	1	0	1
Within subjects	0	1	0	1

4. Discussion

The behavior-analytic interpretation adopted in this review is intended as an analytic lens rather than a competing theoretical replacement for cognitive or HCI-based models. Alternative frameworks (e.g., dual-process accounts, cognitive load theory, usability models) may offer complementary explanations of observed effects. The present analysis prioritizes functional variables (stimulus control, response effort, consequence contact) to highlight design-level regularities, not to adjudicate among psychological theories.

This review synthesized 65 empirical and applied studies on nudging for secure digital behavior (2012–2025). The interpretation of the present synthesis and its conclusions is explicitly grounded in a behavior-analytic perspective. We deliberately restricted inclusion to studies that explicitly self-identify their intervention as a “nudge”. This choice was theoretical rather than technical: our aim was not to map all forms of choice architecture in cybersecurity, but to examine how the nudging paradigm itself is interpreted, operationalized, and empirically tested in this domain. Including functionally similar interventions under different labels (e.g., warnings, persuasive technologies, friction-by-design) would have shifted the focus from “nudging as a theoretical construct” to behavioral influence in cybersecurity more broadly, which lies outside the scope of the present review. Accordingly, our findings describe the nudging-labeled subset of behavioral interventions in cybersecurity, and our conclusions concern nudging as a declared paradigm in this domain, rather than the effectiveness of all choice-architectural interventions. Other paradigms in HCI and persuasive technology legitimately prioritize different endpoints, such as perceived usability, acceptance, or attitudinal change, and may thus reach different evaluations of success. Our contribution is not to adjudicate between paradigms, but to show what the nudging-labeled literature looks like when interpreted through a functional, operant lens. Consequently, statements regarding “fragility”, “symbolic control”, or “lack of maintenance” should be read as theoretical diagnoses relative to this framework, not as definitive failures of nudging per se. From a behavior-analytic standpoint, effects that depend primarily on antecedent control without sustained contact with consequences are expected to be context-bound and vulnerable to extinction once prompts are withdrawn.

Regarding RQ1, the immediate impact of nudges on security behavior was generally positive but uneven across domains and nudge types. Informational and feedback-based nudges, as well as default and design changes, produced the most consistent short-term improvements in directly observable secure behaviors, such as password strength and secure configuration choices, whereas social and framing nudges showed more variable, context-dependent effects. Overall, the nudging-labeled literature in cybersecurity converges on a specific functional pattern: interventions tend to be effective when they modify the immediate contingencies of action, by providing response-contingent feedback, redistributing effort through defaults, or embedding salient cues at the moment of choice, whereas purely verbal or framing-based manipulations show more variable and fragile effects. At the domain level, password security showed 19/26 significant effects [33,54,62]. Privacy/data security reached 7/10 significant [35,44], while organizational security was mixed [1,55]. Smaller domains were consistently positive in the available strata; phishing [1,87] and Wi-Fi/network security [39,41,56,85]. IoT/device security showed 3/4 significant [53,83]. Security awareness was sparse [28,84]. These patterns align with our prior narrative review of usable security, which highlighted a fragmented methodological landscape and argued for design-driven guidance grounded in behavioral endpoints rather than efficiency/usability alone. The present review extends that agenda to “nudges”, clarifying which mechanisms (feedback, defaults, effort allocation) predict larger and more reliable behavior change [15,33,91,95]. The strongest effects cluster where the secure action is directly observable at the interface and contacts consequences during task completion (e.g., password creation with strength meters; enabling protections; secure configuration choices), and/or where response cost is redistributed via protective defaults or added friction on risky paths. This pattern is consistent with selection by consequences and with evidence that contingent feedback and effort asymmetries outperform purely verbal prompts or framing alone [33,91,95,96].

4.1. Why Some Nudges Work Better: A Functional Reading

Addressing RQ3, a behavior-analytic conceptualization suggests that the most effective cybersecurity nudges are those that arrange response-contingent feedback and redistribute response effort during task completion.

By definition, nudges are non-coercive choice-architectural interventions (i.e., they do not forbid options or impose significant incentives or sanctions). In practice, however, our synthesis suggests that the most effective cybersecurity nudges are those that arrange immediate response-contingent feedback and/or redistribute response effort (e.g., via defaults or friction) during task completion:

• Response-contingent feedback (RCF). Meters that change color/valence as the user types or warnings that terminate upon compliance can function as conditioned reinforcers or opportunities for escape from aversive stimuli. Such arrangements select and consolidate the secure action at the moment it is emitted [12]. In passwords, this pattern appears repeatedly [63,90].
• Effort asymmetries and defaults. Protective defaults and friction against risky paths bias allocation toward secure choices with reliable effects across domains [41,81].
• Social/rule cues. Norms and policy statements act as verbal discriminative stimuli and can evoke compliance as rule-governed behavior [97,98].
• Aversive elements. Loss/fear frames may suppress responding or shift responding toward alternative options in the short term; however, their function (punishment vs. avoidance control vs. negative reinforcement through termination) depends on whether and how the cue is response-contingent [12,18].

By contrast, framing-only manipulations succeed in some studies [29,57] and fail in others [58], indicating that salience alone is often insufficient unless embedded within consequence arrangements or effort redesign. Domain-stratified sensitivity analyses showed consistently higher sign rates whenever at least one behavioral component was present (response-contingent feedback, effort asymmetry, aversive element, or social/rule cue): for password security, the sign rate was 0.90 with components vs. 0.17 without; for privacy/data security, 1.00 vs. 0.00. Endpoints told the same story: behavioral measures: password strength, clicks/choices, adoption/use, dominated positive results [28,40,41,56], whereas non-behavioral outcomes concentrated nulls/not reported, especially in privacy/organizational work.

With respect to RQ2, follow-ups were rare and mixed. We distinguish delayed measurement under unchanged interface conditions from maintenance probes after full withdrawal. Designs were heavily online between-subjects; comparatively few field/longitudinal evaluations limit external validity. Follow-ups were rare and mixed. We distinguish delayed measurement under unchanged interface conditions from maintenance probes after full withdrawal. The former can document persistence of performance under continued stimulus support, but cannot establish maintenance in the operant sense used here. A field series reported months-long persistence under enriched arrangements [73], a large field deployment showed no improvement across multiple nudges [74], and a lab-to-field transition showed decay by two weeks [90]. Taken together, these findings offer a clear answer to RQ2. Under the a priori behavior-analytic criteria adopted here, durability and generalization are virtually untested in the nudging-labeled cybersecurity literature: only one study probed behavior after complete withdrawal of prompts and interface support, and it did not show maintenance, and no study assessed generalization to untrained stimuli, settings, or responses. As a result, current evidence supports short-term, in situ improvements rather than durable, generalized secure behavior. From an operant perspective, behavior evoked by antecedents often extinguishes when prompts or on-screen consequences are removed unless a repertoire has been established via differential reinforcement, shaping/chaining, and transfer of stimulus control to natural cues, processes long emphasized in the analysis of operant behavior and its maintenance [11,12]. This framework helps explain why effects that are dramatic in structured tasks may attenuate “in the wild” without continued consequence contact or effort asymmetry (see also discussions of aversive control, stimulus control, and choice in modern behavior-analytic syntheses).

4.2. Boundary Conditions and Moderators

Three boundary conditions recur:

• Outcome type. Effects are strongest on direct performance; intentions/awareness tend to track but add little beyond behavioral endpoints.
• Task coupling. Nudges tightly coupled to the response (e.g., password meters that change contingent on input) outperform generic prompts.
• Cost structure. When secure actions remain costly relative to insecure alternatives, effects shrink despite salience, consistent with response effort and reinforcement-allocation principles.

Likely moderators include domain (e.g., password vs. organizational), user population (novices vs. experts), and setting (lab vs. field). For instance, default/friction manipulations generalize across network and privacy choices [40,41,81], whereas purely verbal prompts in organizational contexts show mixed returns [1,55]. These patterns align with analyses of stimulus control, motivating operations, and the limits of aversive control (e.g., avoiding costly paths, escaping warnings) in sustaining performance.

4.3. Field-Level Limitations and Design Implications

With respect to RQ4, the existing nudging-labeled cybersecurity literature shows several field-level limitations that qualify the present findings and motivate a behavior-analytic research agenda. As noted above, studies are predominantly short, online, and between subjects, with comparatively few field or longitudinal evaluations; follow-ups are rare and often involve delayed measurement under unchanged interface conditions rather than maintenance probes after full withdrawal of prompts and programmed consequences; generalization to untrained tasks, settings, or responses is not assessed; and reporting often treats nudges as unitary interventions without specifying which components are active at the decision point or how they are contingently arranged with respect to the target response. These characteristics constrain what can be inferred about durable, generalized behavior change in real security environments.

Taken together, the evidence supports a behavioral design approach to security environments: interfaces should be engineered so that secure behavior is established and maintained at the point of action, where the choice is emitted. In practice, effective deployments rarely rely on a single lever; instead, they operate as configurable bundles delivered at the decision point. A pragmatic baseline is RCF plus Social: response-contingent feedback (for example, meters that advance or warnings that extinguish upon compliance) paired with brief, policy consistent microcopy that renders the cue immediately interpretable and specifies what to do now. Aversive elements can be layered when the objective is to inhibit a risky response, provided salience is calibrated and alarmism is avoided. Effort becomes appropriate when a persistent bias toward the protective option is required, for example via protective defaults and light friction on unsafe paths. Across levers, timing and cognitive parsimony are critical: components should appear exactly at the moment of choice, remain cognitively lean, and not demand interpretation outside the task flow.

Hybridization mitigates the principal failure modes of isolated levers. Social only prompts frequently attenuate as novelty fades and may devolve into background noise. Aversive only cues risk reactance, strategic avoidance, or disengagement when users experience the signal as punitive or disproportionate. Effort only designs can be bypassed, worked around, or “optimized away” when the rationale is opaque or the cost is perceived as arbitrary. Framing-only manipulations are often variable and unstable unless tightly coupled to the response and embedded in the action sequence. Layered configurations can therefore be designed functionally: RCF to differentially strengthen the secure response through consequence contact; Social to specify the operative rule and render the cue interpretable; and Effort to stabilize allocation by making the protective path reliably easier than the risky alternative. Done well, this produces clearer stimulus control at the decision point without resorting to excessive salience or heavy friction. After acquisition, programmed feedback can be thinned or faded while explicitly verifying transfer of stimulus control to natural task cues; maintenance probes should be planned a priori rather than added post hoc.

For practice and reporting, nudges should be treated and described as bundles rather than as unitary interventions. Reports should specify which components are active (RCF, Social, Aversive, Effort), their sequencing at the decision point, and their contingency with respect to the target response. Where feasible, factorial contrasts should be used to isolate main effects and interactions among components rather than inferring mechanism from outcomes alone. Critically, maintenance assessments should be scheduled after complete withdrawal of prompts and feedback, using behavioral endpoints as primary outcomes. This level of transparency preserves cross-study interpretability and clarifies why some interventions function as pure antecedent arrangements, whereas others operate as hybrid arrangements that more reliably support immediate selection and early maintenance.

Operationally, this translates into three joint design principles to be applied at the point of action. First, in task reinforcement via response-contingent feedback that advances or extinguishes upon compliance. Second, cost asymmetries that make the protective option easier than the risky alternative, for example protective defaults and light friction on unsafe paths. Third, clear, policy consistent verbal cues that occasion the response and make the signal immediately interpretable. These elements should be presented with tight temporal coupling to the decision and with cognitive parsimony. After acquisition, feedback can be progressively thinned while verifying transfer of stimulus control to naturally occurring cues, and maintenance probes should be scheduled at follow-up. In this way, hybrid bundles preserve the immediacy required to select the secure response while creating the conditions for stabilizing that response beyond the initial prompts.

The domains with the best outcomes are precisely those in which users emit measurable behaviors—for example, creating stronger passwords, choosing secure configurations, and adopting protections—that are best supported by consequence contact and effort asymmetries at the moment of performance [40,41,63,81,90]. Building on this, the design implication is straightforward: when security tasks are defined as observable performances, the interface should reliably arrange contact with consequences and effort asymmetries at the moment of action, because those features are exactly what support the best outcomes [41,63,81,90]. Under a behavior-analytic account, antecedents set the occasion, but selection by consequences and the allocation of responding under differential response cost determine whether performance is strengthened and retained; durable skill also depends on stimulus control and procedures—for example, shaping, chaining, and programmed reinforcement—that move behavior beyond initial prompts into the control of natural task cues [11,12].

Accordingly, future studies should treat consequence contact and effort asymmetries not as optional add ons but as core design variables to be tested and reported alongside outcomes. Concretely, studies should:

• embed response-contingent feedback, for example meters that advance or warnings that terminate upon compliance, and protective defaults or friction against risky paths during acquisition;
• plan maintenance probes at or beyond two weeks after complete removal of prompts and programmed consequences to test persistence;
• thin or fade programmed feedback while verifying transfer of stimulus control to naturally occurring cues;
• assess generalization across tasks and platforms, for example from password strength to privacy settings, from desktop to mobile;
• prioritize behavioral endpoints, such as strength, choices or clicks, and adoption or use, over purely attitudinal measures.

These recommendations outline the behavior-analytic research line requested in RQ4, directly extending the domains where the strongest effects are already observed, for example passwords and network or privacy choices, and the mechanisms most plausibly producing them, namely consequence contact at the point of performance and structured response costs. This agenda is also aligned with an operant model of how behavior is selected and maintained through consequences, response effort, and stimulus control [11,12].

5. Limitations

This PRISMA-guided review has several methodological limitations that qualify its conclusions. The first limitation is that we do not cover the full landscape of choice-architectural or persuasive interventions in cybersecurity. The lexical restriction necessarily excludes a large body of cybersecurity research that implements functionally similar choice-architectural or behavior-shaping interventions under different labels (e.g., warnings, persuasive technologies, friction-by-design, habit-supporting interfaces). For example, several widely cited password-strength and phishing-warning studies do not self-identify as “nudges” and are therefore outside the present corpus. Our results should thus not be interpreted as a map of all behavioral influence techniques in cybersecurity, but as an analysis of how the nudging paradigm itself is declared, interpreted, and operationalized in this domain. However, this restriction is consistent with longstanding critiques that “nudge” lacks clear theoretical boundaries and is often applied as an umbrella label. Our results should therefore be read as evidence about nudging as a declared paradigm in cybersecurity research, not as a comprehensive effectiveness review of all behavioral influence strategies. Second, the search strategy (databases queried, temporal bounds, language restrictions, and treatment of gray literature) and screening/coding decisions (e.g., operationalization of nudge types and outcomes) may have introduced selection and classification bias. Third, because the included studies differ widely in design, sample size, outcome type, and number of tests, counts of statistically significant results cannot be interpreted as estimates of effect magnitude or reliability. In this review, such counts are therefore used descriptively, while inference is grounded in cross-study functional regularities, specifically, in how interventions reshape immediate contingencies of action through feedback, effort, and stimulus control rather than in the raw prevalence of p-values. Fourth, a few studies report delayed measurements or short-term follow-ups; however, none satisfy the behavioral criterion adopted here, which requires assessment after full withdrawal of prompts and interface support. In these cases, the intervention remains in place or is merely re-measured after a brief delay, preventing any inference about durable behavior change. Our conclusion is therefore not that follow-up is entirely absent, but that maintenance, as behavior persisting independently of ongoing stimulus control, has not yet been demonstrated in the nudging-labeled literature.

6. Conclusions

This review shows that nudging can reliably improve secure digital behavior in the short term, especially when interventions either: (a) provide response-contingent feedback during the task (e.g., password meters that advance or warnings that terminate upon compliance) or (b) redistribute effort so the secure option is the path of least resistance (e.g., protective defaults, added friction for risky paths). These patterns were most evident in password and privacy/data security studies, whereas organizational and awareness contexts yielded mixed results. Across the corpus, durable change was rarely assessed; when it was, effects often waned once prompts and on-screen consequences were withdrawn, consistent with longstanding operant findings that antecedents set the occasion but consequences select and maintain behavior [11,12,90]. These conclusions are strengthened by converging evidence that direct behavioral endpoints (strength, clicks/choices, adoption/use) outperform attitudinal measures for detecting change, and by consistent gains when at least one behavioral mechanism (feedback, effort, aversive, or social/rule cue) is present [40,41,81]. At the same time, the literature is topically concentrated (passwords) and methodologically narrow (informational/feedback nudges dominate), with scant tests of maintenance after complete withdrawal, and virtually no generalization assessments. Designs are often online, between-subjects, and short-lived, limiting ecological validity and obscuring whether effects persist in real workflows [22,99]. Framing-only manipulations succeed inconsistently, suggesting salience without programmed consequence contact or effort redesign is usually insufficient [29,58,70].

A behavior-analytic reading clarifies a path forward. Effective “choice architecture” tends to embed operant mechanisms: immediate contact with consequences (conditioned reinforcement or escape from warnings), lower response cost for secure actions, and clear verbal SDs/rules at decision points [11,12]. We therefore recommend that future research and practice:

• Engineer consequence contact and effort asymmetries during critical responses. Concretely: progressive meters and compliance-terminating warnings for passwords; privacy-protective defaults and added steps for risky Wi-Fi joins or permissive settings [40,41,81,85,90];
• Plan maintenance probes after complete withdrawal (≥2 weeks) and fade/thin feedback while verifying transfer of control to natural cues;
• Test generalization across stimuli, tasks, and platforms (e.g., from password creation to privacy settings; desktop to mobile);
• Prioritize behavioral endpoints over intentions/awareness; report design quality and risk of bias transparently [22,99].

Practically, this means treating “nudge” not as a cosmetic prompt but as behavior-based design: arrange interfaces so secure behavior is immediately reinforced, easier than alternatives, and occasioned by explicit rules at the moment of action. Such integration aligns nudging with selection by consequences, shaping, and stimulus-control strategies known to support maintenance and generalization-moving from situational compliance toward stable security habits [12,26,40,41,81]. In sum, nudges work best when they function as light-touch behavior programs. The field now needs longitudinal, field-based tests that combine defaults/friction, task-contingent feedback, and explicit rules with planned fading and follow-ups. Doing so will help convert immediate gains into sustained, generalized secure behavior across the digital ecosystem [13,73,90,96].