Behavior needs motivation, ability, and a prompt. Use the Fogg Behavior Model to find which one your security program is missing, and fix that one first.
The Fogg Behavior Model says a behavior happens only when three things meet at the same moment: motivation, ability, and a prompt. Most security programs invest heavily in the first and neglect the other two. That helps explain why awareness alone has not fixed risky behavior. This post shows how to use the model as a diagnostic. When a secure behavior does not happen, find which of the three is missing, then fix that one.
BJ Fogg’s model is simple. The model’s own site states it as B=MAP. Behavior happens when motivation, ability, and a prompt come together at the same time. When a behavior does not occur, at least one of the three is missing.
Security teams can use this as a checklist. Motivation is whether the person wants to act securely. Ability is how easy the secure action is. A prompt is the cue that says “act now.” A person with strong motivation and a hard task fails. Likewise, a person with an easy task and no cue forgets.
Most programs concentrate on motivation. They run awareness courses and explain the consequences of a breach. Yet Verizon’s 2026 breach report still found the human element in 62% of breaches, so knowing has not become doing. Human risk management exists to close that gap.
| Element | In security terms | Where programs invest | Common gap |
|---|---|---|---|
| Motivation | Wanting to act securely | Awareness courses, breach stories | Compliance feeling, little personal relevance |
| Ability | How easy the secure action is | Rarely measured | Reporting takes many steps, and verification has no script |
| Prompt | The cue at the moment of risk | Annual reminders, occasional simulations | Cues arrive weeks from the decision |
Most spending lands in the first row. The model suggests that many failures sit in the second and third.
Discover how Threatcop protects your workforce from modern cyber threats.
Motivation built in a training session does not last by itself. Hermann Ebbinghaus first mapped how memory decays in the 1880s, and field data on security training points the same way. A SOUPS 2020 study by Reinheimer and colleagues, covering 409 employees, found that phishing detection held at four months and was gone by six. Reminders restored it.
So prompts have to repeat. A single annual dose cannot hold a behavior in place. The cue has to return before the memory fades, and it works best when it arrives near the real decision.
Use the model backward. When a secure behavior does not happen, ask which element is missing.
| What you observe | Likely missing element | A fix that matches |
|---|---|---|
| Staff do not report phishing | Ability | Add one-click reporting and remove steps |
| Staff skip payment callbacks | Prompt | Put a reminder inside the payment workflow |
| Staff reuse passwords | Ability | Provide a password manager and single sign-on |
| Staff ignore security warnings | Motivation and prompt | Make warnings rare and specific so they stay meaningful |
| Staff finish training, then change nothing | Motivation | Tie lessons to real incidents and each person’s role |
The fix is rarely “more training.” Each row points at a different element, so each needs a different answer.
Take a common failure. Employees receive suspicious emails, but few of them report. Run the three checks in order.
First, motivation. Do staff believe reporting matters? If they fear blame for a false alarm, they will stay quiet. Thank people for reports, including wrong ones, and share what each report caught, as a healthy incident reporting culture does.
Second, ability. How many steps does a report take? Forwarding an email and writing an explanation is too many. One click from inside the mail client is not.
Third, prompt. What reminds people to report at the right moment? A banner on external email, plus a simulation that rewards reporting, supplies the cue. Fix all three, and reporting rises. Fix only the first, and it usually does not.
Ability is the cheapest element to improve, because it depends on design rather than persuasion. Design changes also last longer than reminders, and they reach every employee without extra effort. Five changes raise it.
Motivation still matters. However, keep it honest. Fear fades fast, while relevance lasts, so show each role the attacks it will actually face. A well-run security culture makes the secure choice feel normal.
Three mistakes undermine the Fogg Behavior Model in practice.
Remember that the model is a diagnostic, not a guarantee. It tells you where to look. Afterward, measure behavior to confirm the fix worked, such as the share of staff who report and how fast they do it.
Some vendors describe a parallel challenge for AI agents. The model fits people because it describes motivation, and an agent has none. The equivalent for an agent is design. That means narrow permissions, guardrails the agent cannot talk its way past, and checks placed where it acts. Treat agent security as its own discipline, not as an extension of this human model.
Threatcop’s People Security Management approach maps onto the model. Threatcop Security Awareness Training (TSAT) supplies the prompt. It runs simulations across multiple attack vectors, so staff meet realistic cues rather than abstract ones. Its Employee Vulnerability Score and repeat-offender identification then show who still fails, which tells you where to apply the fix. Average breach time adds a number click rate cannot, showing how long a missing cue leaves an attacker with room to act.
TLMS builds motivation through gamified, role-appropriate lessons that people finish, and TPIR raises ability by making a report take one click, with a threat-level check before the employee decides. Used together, the three cover motivation, ability, and prompt rather than only the first.
Awareness builds motivation, and motivation is only one of three elements. Behavior needs ability and a prompt as well. So when a secure habit fails, resist the urge to add another course. Ask which element is missing. If reporting is hard, cut steps. When cues arrive too late, move them into the workflow. And where lessons feel irrelevant, tie them to each role’s real risks. Fix the missing element, then measure whether behavior changed. That diagnostic habit is worth more than any single training program, because it points your effort at the real cause.
The Fogg Behavior Model is a framework from behavior scientist BJ Fogg. It states that a behavior happens when motivation, ability, and a prompt converge at the same moment, and that a missing element explains why a behavior does not occur.
B=MAP is the short form of the Fogg Behavior Model. B stands for behavior, M for motivation, A for ability, and P for prompt. Behavior occurs only when all three are present together.
The Fogg Behavior Model works as a diagnostic for security programs. When staff skip a secure behavior, check whether they lacked motivation, found the action too hard, or never received a cue. Then fix that element specifically rather than adding more courses.
Awareness training mainly builds motivation and knowledge. Behavior also needs an easy action and a timely cue. Knowledge also fades, with one field study showing detection gains gone by six months, so training without prompts and easy actions leaves two of the three elements empty. A lasting security culture supplies the missing cues and easy actions.
A prompt in cybersecurity is a cue that tells someone to act at the right moment. Examples include an external-sender banner, a payment-workflow reminder, or a simulation that tests a reflex. Prompts work best when they appear near the decision.
Nikunj is a CISO focused on helping organizations build effective security programs and resilient cultures. With a strong track record across industries, he drives governance and risk strategies that protect what matters most. Outside work, he mentors professionals and explores emerging trends shaping the future of cybersecurity.
A portable security behavior score sounds useful, but scores are not comparable, cannot be disputed, and face privacy limits....
Agent Tesla steals passwords and keystrokes through phishing attachments. See how an attack unfolds, which controls break the chain,...
Account takeover slips past email filters because the login is real. See the sign-in and mailbox signals worth alerting...