Help yourself overcome obstacles and adopt secure behaviours
The best cybersecurity actions are those you no longer need to think about. You may already know many secure habits that would be useful:
- “I will lock my screen whenever I leave my PC.”
- “I will regularly update my IT devices.”
- “I will create a unique password for every account.”
- “I will double-check before clicking an unexpected link.”
Before these behaviours become automatic, however, you must perform them intentionally. Habits take time to develop, and obstacles can interfere along the way.
Suppose you want to create a unique, strong password whenever you register a new account. If you are in a hurry, you may want to complete the registration as quickly as possible. You may also feel overwhelmed by having to create and remember another strong password. When this happens, you might abandon your goal despite understanding its importance. People commonly encounter obstacles such as:
- Feeling that there is not enough time
- Forgetting the intended behaviour
- Being distracted by a more urgent task
- Perceiving the secure option as additional effort
- Falling back into familiar routines
This is not necessarily a mere excuse. Psychological research shows that obstacles frequently stand between good intentions and actual behaviour. One method designed to address this gap is MCII, short for Mental Contrasting with Implementation Intentions. Described by researchers Gabriele Oettingen and Peter Gollwitzer in 2010, MCII combines a strategy for choosing worthwhile goals with a strategy for acting on them.
The four steps of MCII
Step 1: Identify a wish
Choose one specific behaviour you would like to adopt. It should be realistic and within your control.
For example: “I want to pause before clicking unexpected links.”
Step 2: Imagine the best outcome
Consider what would improve if you consistently performed this behaviour.
For example: “I would reduce my risk of falling for a phishing attack, protect university data, and help prevent security incidents.”
It is important that you actively try to picture the outcome and how you would feel.
Step 3: Identify the main obstacle
This step distinguishes MCII from positive thinking alone. Instead of imagining only the desired future, you deliberately examine what is most likely to prevent it.
Ask yourself: “What is the main obstacle within me or my daily routine?”
Your answer might be: “When I am busy, I tend to click quickly without thinking.”
Try to focus on one or a few significant obstacles rather than creating a long list of every possible difficulty.
Step 4: Create an if-then plan
Turn the obstacle into a concrete response using this structure: If obstacle X occurs, then I will perform behaviour Y.
For example: “If I receive an unexpected email asking me to click a link, then I will take one deep breath and verify the sender before taking any action.”
Researchers call such plans implementation intentions. Connecting a recognisable situation with a specific response can help you notice the relevant moment and carry out the intended behaviour.
A complete example
Imagine that you want to lock your screen whenever you leave your desk.
- Wish: “I want to lock my screen every time I leave my workplace.”
- Desired outcome: “Sensitive information remains protected, and nobody can misuse my account while I am away.”
- Main obstacle: “When I am in a hurry, I tell myself that I will only be gone for a moment.”
- If-then plan: “If I stand up to leave my desk, then I will use the screen-lock shortcut before taking my first step away.”
The method is intentionally simple. You do not need to remember a long checklist. You identify the obstacle most likely to interfere with your goal and prepare yourself mentally in advance.
A final note on difficult obstacles
MCII is most useful when you can influence the obstacle through your own behaviour. Not every cybersecurity obstacle meets that condition.
You may lack the permissions needed to follow a recommendation. A researcher may depend on legacy software that cannot easily be updated. An IT administrator may recognise a risk but be constrained by technical dependencies, budgets, or organisational requirements.
In these situations, trying harder is unlikely to solve the underlying problem. Treat the obstacle as useful information instead and discuss it with the appropriate people, such as your supervisor, IT support team, or information security officer. Some challenges require changes to technology, processes, resources, or organisational policies rather than individual behaviour.
Recognising this distinction is part of using MCII wisely. The goal is not to force every obstacle into a personal action plan. It is to determine which obstacles you can address yourself and which require cooperation or organisational action.
Choose one secure behaviour, work through the four steps, and practise it consistently. Once you start to feel proficient, move on to another. Small improvements, repeated over time, can help create a stronger security culture and also protect your very own data.
About the author
Kai Weeber works as Security Awareness Consultant for universities at the HITS IS, the public information security service for universities in Bavaria, Germany. He provides consulting on awareness programs, develops various awareness resources and conducts live training sessions at universities. With a background in communication sciences and educational research, he works on how to design awareness strategies and activities more effective and motivating.
