I mean yelling “Fire” metaphorically, of course.
I was reviewing a lot of market research this week about consumers’ attitudes toward computer security. What’s amazing is that the all over the world, the blissful ignorance of threats prevails. Mac users think only PC’s are targeted. People in some countries believe that as long as they navigate to “brand name” web sites, they are safe.
What us computer security vendors know is that most everyone is exposed to threat of some kind. But we (should) have a distaste for using Fear, Uncertainty and Doubt (yelling “Fire”) to motivate users to do or buy something. Even just to install a free product.
So we’re in a Catch-22.
And the Internet isn’t going to change such that the threats go away. Its arguably flawed design as it pertains to security was baked a long time ago, and inertia will prevail in my lifetime.
What to do? Education without alarmism feels right to me. Some of which comes from direct vendor engagement with a communityof users. Think Facebook, for example. And some of which comes from equipping “influencers” to help spread the word.
When I told people I was joining AVG, the most common response amongst those who knew the company was, “Yeah, I installed it on my parents’/uncle’s/home computer.” Clearly, these persons were key influencers over someone else’s computer if not their behavior.
I’m reminded of Malcolm Gladwell’s intense interest in the role of influencers. I am too, as you’ve probably surmised from this and past posts.
My take is that influencers are apt to find you as vendor, not the other way around. Somehow, they are self-selecting. And they are born not made. So, the role of the vendor is to make it easy for influencers to find and engage you.
So, should vendors yell, “Fire”? No. Let someone else do it for you. They know best how to send the message in a way that is palatable to the target: otherwise innocent users. Who said children can’t teach their parents something?
Don MacLennan | High Tech Yankee 
Great points Don!
I think the trick here is to know when the “tipping point” has been reached — not in a Gladwell sense but rather in the sense of the point after which you are irresponsible to not yell loudly.
I think you’re non-alarmist, information-based approach is the right one. My biggest peeve is when vendors start screaming or scaring others without giving them a lens or way to hear the message and know how it affects them and the real likelihood of an event.
The criminals out there are subtly changing their behavior to be less noticeable, more beneficial and to “bleed” their victims over a long period of time rather than to “butcher” them. That’s what’s really scary: the alarmists will make this like the “boy who cried wolf” and leave everyone desensitized to the ongoing, pernicious threat.