Tech Pains: Characterizations of Lived Cybersecurity Experiences

The permeation of technology into every facet of life has profoundly shifted the nature and ramifications of cybersecurity incidents. As a consequence, a complete and refined characterization of these adverse events necessitates a sociotechnical approach that takes into account the subjective lived experiences of the victims. Although researchers have examined such experiences pertaining to specific types of incidents, a broad understanding of the harmful impact of cybersecurity incidents requires an investigation of how people characterize and cope with these adverse experiences in general. To that end, we conducted semi-structured interviews with 21 individuals who reported a variety of cybersecurity incidents, consequences, and coping mechanisms. We found that the experiences can be characterized along a bounded to fuzzy spectrum. As the majority of current cybersecurity efforts focus on relatively bounded incidents, we make the case that fuzzy incidents deserve similar attention because their harmful impacts are deeper and longer-lasting. Our insight can be applied to improve and personalize the delivery of cybersecurity interventions.