Effects of information security risk visualization on managerial decision making

This paper documents a controlled experiment on the effect of adding a graphical model to a fictitious corporate security decision problem. The control group (N=44) saw a textual description, and the treatment group (N=41) was presented a graphical representation using the ArchiMate security extension modeling language in addition to the textual description. Besides the security investment decision, indicators of comprehension, risk perception, and decision confidence were measured as dependent variables. Significant positive effects were found for decision confidence and risk perception, but not for the main investment decision and indicators measuring problem comprehension. Two intervening variables, domain knowledge and spatial ability, both derived from the Cognitive Theory of Multimedia Learning, were found to have no significant effect. The experiment presents preliminary evidence from a small sample of educated professionals indicating that visualizations may not have an unconditional advantage over text for decision support in the security domain.