An official website of the United States government
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Experts struggle with explaining cybersecurity in a language and tone appropriate for non-expert audiences. This communication gap may make it difficult for a broad and diverse audience to fully engage in cybersecurity. Fundamental forms of communication
Julie Haney, Matthew Canham, Mike Elkins, Lisa Flynn, Matthew Gordin, Victoria Granova, Wenjing Huang, Jody Jacobs, Greg Moody, Ann Rangarajan, Michael Ross, Robert Thomson, Joe Uchill
In August 2024, the National Institute of Standards and Technology (NIST) co-sponsored ConnectCon, an interactive workshop that facilitated meaningful conversations and connections between researchers and practitioners on the topic of human-centered
Lynn Baumeister, Whitney Quesenbery, Sharon J. Laskowski
Voting systems must support multiple interaction modes: presenting information both visually and auditorily, accepting navigation and selections from both screen touches and key presses on a tactile controller. The best practices outlined in this document
Lynn Baumeister, Whitney Quesenbery, Sharon J. Laskowski
The ability of voters to review and verify their selections before casting their ballot is an important step in the voting process. This report explores the legibility and readability of summary ballots printed by ballot marking devices (BMDs) and the
Margaret Cunningham, Calvin Nobles, Nikki Robinson, Julie Haney
"The Human Factor" department co-editor Julie Haney recently spoke with three human factors experts to get to the bottom of what the oft-misunderstood human factors discipline actually is, how the cybersecurity community and organizations can benefit from
There is a growing recognition of the need for a transformation from organizational security awareness programs focused on compliance measured by training completion rates to those resulting in behavior change. However, few researchers or practitioners
Yee-Yin Choong, Johanna Camara, Tracey Schock, Clay Davis
One way NIST ensures that measurements are accurate and compatible is by certifying and providing over 1 300 Standard Reference Materials® (SRM®) with well-characterized composition, properties, or both. Customers use these materials to calibrate
Theodore Jensen, Mary Frances Theofanos, Kristen K. Greene, Olivia Williams, Kurtis Goad, Janet Bih Fofang
The increasing prevalence of artificial intelligence (AI) will likely lead to new interactions and impacts for the general public. An understanding of people's perceptions of AI can be leveraged to design and deploy AI systems toward human needs and values
Repeat clickers refer to individuals who repeatedly fall prey to phishing at-tempts, posing a disproportionately higher risk to the organizations they inhabit. This study sought to explore the potential influence of three factors on repeat clicking
Whitney Quesenbery, Suzanne Chapman, Christopher Patten, Roberto Spreggiaro, Shanee Dawkins
One of the major issues for voting systems today is whether they provide voters with a meaningful opportunity to verify their ballot before casting it. This opportunity is important in helping them vote their intent by catching errors or omissions made
Qualitative research to gain deeper insights about how voters mark, review, verify, and cast their ballots. Conducted as part of the work to update the human factors—accessibility, privacy, and usability—requirements in federal voting system standards and
Human-centered cybersecurity (HCC) researchers seek to improve people's experiences with cybersecurity. However, a disconnect between researchers and practitioners, the research-practice gap, can prevent the application of research into practice. While
Jacob Collard, Valeria de Paiva, Eswaran Subrahmanian
Mathematics is a highly specialized domain with its own unique set of challenges. Despite this, there has been relatively little research on natural language processing for mathematical texts, and there are few mathematical language resources aimed at NLP
Research insights critical to improving people's cybersecurity experiences and outcomes may not be integrated into practice, demonstrating the often-observed and dreaded "research-practice gap." This talk will describe recent NIST research efforts to
Collaborative robot tasks in manufacturing often involve manually placing and recording the robot in various positions throughout the intended task. However, existing methods for programming robot have been shown to cause physical strain and confusion for
Julie Haney, Clyburn Cunningham, Susanne M. Furman
The "research-practice gap" can prevent the appli- cation of valuable research insights into practice. While the gap has been studied in several fields, it is unclear if prior findings and recommendations apply to human-centered cybersecurity (HCC), which
Smart home technology may expose adopters to increased risk to network security, information privacy, and physical safety. However, users of this technology may lack understanding of the privacy and security implications, and manufacturers often fail to
This document is the second part of a series of documents on the usability of electronic pollbooks. It contains a procedure for how e-pollbooks might be evaluated, including a preliminary protocol for running a usability test. It can be used by people
This publication is a report on the exploration of the use of electronic pollbooks (e-pollbooks) in elections. The scope of this report is on usability and accessibility of e-pollbooks, that is, their use by poll workers and voters, rather than on
The phishing cyber threat exploits vulnerabilities in the U.S. and around the world across private and public sectors. Embedded phishing awareness training programs, where simulated phishing emails are sent to employees, are designed to prepare employees
This talk will cover findings from over 4 years of NIST phishing training data, highlighting user context as the key to phishing susceptibility. We will discuss the NIST Phish Scale, our research on why users click, and how it can help users spot a phish.
Augmented reality (AR) technology is developing at a fast pace. Usability evaluation methodologies for AR need to be updated to accommodate the increasing complexity of how people interact with AR technology. Eye tracking metrics, which have been
The NIST Phish Scale is a method for measuring human phishing detection difficulty, providing a metric – a phishing email detection difficulty rating – for phishing training implementers to gain a better understanding of the variability in click rates
Organizations around the world are using the NIST Phish Scale (NPS) in their phishing awareness training programs. As a new metric for measuring human phish-ing detection difficulty of phishing emails, the use of the NPS by phishing training implementers