Most people we talked to already knew that weak passwords were unsafe and that two-factor authentication (2FA) helps protect their accounts. The real problem was not a lack of knowledge; it was convenience. They knew what to do, but it was annoying, or they put it off until something bad happened. By putting ourselves in their position, we were able to understand this perspective better. For most people, cybersecurity feels like an extra task added onto their day. It is not something they are excited to do, so it often gets ignored.

This changed how we understood the problem. Initially, we thought the issue was a lack of awareness, but after talking to people, we realized it is more about behavior and habits. People are not ignoring cybersecurity because they do not care. People weren't ignoring cybersecurity because they didn't care; they were ignoring it because it felt inconvenient and easy to put off. By stepping into their perspective, we were able to see how cybersecurity fits into their daily lives. Most of the people we talked to were busy with school, work, or other responsibilities. Security was not something they thought about unless something went wrong. This helped us understand that any solution needed to be simple, quick, and easy to stay consistent with.

Our main users are students, employees, and everyday technology users. From our conversations, we learned that even though they understood the importance of cybersecurity, they didn't always follow through with it. Some common responses were that it was annoying, they forgot, or it didn't matter in the moment. We realized people were more likely to take action when there was a clear benefit for them. This is where we started to change our thinking. This shifted our focus from educating users to keeping them engaged.