Carrots, Sticks, and Culture: The Art and Science of Social Signaling

Perry Carpenter: Hi, I'm Perry Carpenter, and you're listening to 8th Layer Insights. I'm really glad you joined us today because I think today's topic is extremely important for us. And it's not something that most people would naturally associate with cybersecurity or even think to do research on. What's the topic? It's the art and science of how to create, influence, and reinforce social signaling and how incentives, those things that we often call carrots and sticks, can both work and fail. Most of us do recognize that many of our behaviors, beliefs, and values are caught rather than taught. If you're interested in developing a positive security culture in your workplace, then it is really important to understand the dynamics of how people can both receive and signal their security-related beliefs and values so that associated security-related behaviors become a natural result. My guest today is Uri Gneezy. He's a well-known behavioral economist and professor of economics and strategy at the Rady School of Management at the University of California at San Diego. I recently reached out to Uri to speak with him about his new book, "Mixed Signals: How Incentives Really Work." This book is a fascinating deep dive into Uri's research. And it has immediate applicability for anyone needing to design programs that work with rather than against human nature. And so, on today's show, what cybersecurity professionals need to understand about how social signaling and incentives really work. Welcome to 8th Layer Insights. This podcast is a multidisciplinary exploration into the complexities of human nature and how those complexities impact everything, from why we think the things that we think to why we do the things that we do and how we can all make better decisions every day. This is 8th Layer Insights, Season 4, Episode 3. I'm Perry Carpenter.

[ Music ]

Welcome back. Let's dive right in with Uri Gneezy.

Uri Gneezy: My name is Uri Gneezy. And I'm a Behavioral Economist at the Rady School of Management, UC San Diego, studying mainly incentives.

Perry Carpenter: So, for folks that are listening to this show and aren't yet familiar with the field of behavioral economics, can you give a little bit of a background on what that is and some of the interesting and significant things within that field over the past few years?

Uri Gneezy: Sure. So after World War II, economics turned into a very mathematical direction. This was very useful in making a unifying theory and treating the world with the scientific tools. But it moved away from the fact that we are dealing with people, from all the psychology. So we're making some very simplified assumptions. For example, that people are selfish or that they're completely rational, and they can calculate and compute everything immediately. And while it was useful to learn financial markets, for example, it's not very useful when you study labor markets because they do care about how much my colleague is making, not just how much I'm making. I care about not being selfish, maybe not polluted the world, maybe all area of things. Behavioral economics doesn't start with assumptions. It says, okay, we want to understand how the world works. For example, in my case, how incentives work. I do believe that incentives work, but I know that I don't always get it right just by guessing. I'm trying to figure out how people react to incentives and then build some economic models in understanding of the world.

Perry Carpenter: Yeah. Well, thank you for that. Let's dive into incentives. I think when most people think about incentives, at least from the security perspective or the training perspective, they think about both positive and negative reinforcement types of incentives. Can you give some background on the ecosystem of incentives that exist? And then we can narrow in on the signaling piece that you cover in the book.

Uri Gneezy: As you said, incentives are both positive and negative. So I can get, you called it, reinforcement. And that's part of the way that the psychologists are looking at it. But any positive thing that you'll get or any negative thing that you'll get will be incentives. In general, the way I define incentives is something that will make you take an action or whatever that you wouldn't do without the incentives, right? So that's the way I look at it. And it could be both positive and negative and doesn't have to be money. Many people confuse it with money. It could definitely be many other things. It could be social status. It could be learning. It could be many other things.

Perry Carpenter: I want to go back for just a second and ask one broader question about behavioral economics and some of the studies recently. One of the major criticisms of behavioral economics, and I think several areas within the field of psychology, has been the tendency of some scientists and researchers to go forward and make very big claims. And then other researchers try to replicate the same study, and they come up against issues. And they're not able to replicate those claims that seem to push themselves into a popular understanding about the way that behavioral economics may work. Can you address some of those criticisms?

Uri Gneezy: That's basically what you described is all because of incentives, surprisingly.

Perry Carpenter: Mm.

Uri Gneezy: So my incentive as a researcher is to publish as many papers in good places as I can and to find surprising results. Now, if I'm incentivized to publish surprising results, I'll find surprising results. And I'm not necessarily going to check that carefully whether the surprising results are just a fluke, a statistical fluke. Or maybe I did something in order to get to there. My incentive as a researcher is to find these surprising results and push them forward. And I need to oversell what I have. Because if I tell you, look, you want to tell me how can I get people to go to the gym or a [inaudible]? I'll give you a very simple way of doing it, very simple incentives. You'll pay $5, and your kids will go to the gym or will do homework. You're going to hire me as a consultant. You're going to read my book. Put me on the radio. On the other end [inaudible] look, it's really complicated. I don't really know how to do it. You can try this, but that's probably not going to work. You have to -- That's not going to sell.

Perry Carpenter: Yeah.

Uri Gneezy: I want to sell my book. I want to tell you how amazing it is. You'll read five pages, and you'll fix the world. It's not like that. The world is more complicated. So we live in a world in which our incentives is to oversell what we have over the reality. And I think what you mentioned about the profession trying to fix this that's also incentives because if 10 years ago I knew that I'll publish a paper, no one will try to replicate it because no one would get anything out of trying to replicate it. Then I would feel more free to maybe to round out the corners and try to show surprising stuff. Now if I know that people are actually going to say, if that's a surprising, interesting result, people are going to try and replicate it. If they'll fail, my reputation will suffer. My incentives change. Now I'm going to be much more careful in telling stories. And I think that that's relating. And by the way, it's not just in economics. I think it is even more severe in psychology.

Perry Carpenter: Right.

Uri Gneezy: Because economists are a bit more disciplined in what we are doing. We are a bit more boring than psychologists but a bit more disciplined in the way we do it. For example, we pay people for their -- So if I ask you, do you prefer A over B? I'm going to pay you according to your choices. And psychologists live more in the imagine that world.

Perry Carpenter: Ah.

Uri Gneezy: At least used to, so --

Perry Carpenter: Okay. Interesting. All right, so let's jump into the book. It's called "Mixed Signals: How Incentives Really Work." And I think you've already been giving an indication into the science and the thought behind this. But from your perspective, when you decided to write this book, what was the thesis statement in your mind?

Uri Gneezy: What I care about is the signals that you send with your incentives. So incentives are not just changing the payoffs. But it also tells you what I expect you to do. What are my expectations? If we go back to the examples about publications, before that, the signal that I received from my profession was you should publish surprising results. Now the signal is you should publish correct results. Of course, I'm exaggerating. In both cases, there is a balance between the two.

Perry Carpenter: Right.

Uri Gneezy: But 10 years ago, the balance was more, we expect you to publish surprising. Now the balance is more on, we expect you to be correct, and that's a signal. So the incentives are, of course, incentives because I want to have reputation. I want to be successful. But it's also a signal about what's important. And that's what I'm trying to say in this book, that every incentive that you give on top of the monetary or whatever benefit that you get, it also sends a signal. Now, it starts with the frustration. You go to companies. I go to companies very often and try to convince them to use incentives. And they say, no, we tried incentives, and incentives don't work. For me, it's like saying, you know, going to a bad Japanese restaurant and concluding that Japanese food is bad.

Perry Carpenter: Mm.

Uri Gneezy: No, you just went to a bad restaurant, right? And the same is true about incentives. No, the fact that your incentives didn't work, it doesn't have to be because incentives don't work because incentives do work. It's just you didn't use them in the right way. And that's what I tried to do in this book. Try to teach you how to do it in the right way.

Perry Carpenter: Right. So I think most of the people that think about incentives immediately think about carrots or sticks. And I think you're getting at something that encompasses that but is also a little bit more nuanced because there's also the social signaling piece of this where you're Influencing those around you who are part of your peer group or creating a culture in some way. Can you talk a little bit about that ecosystem of types of incentives and the signaling piece of this, where that comes in? And then I know you've got some great examples within the book. And I want to tease some of those out too.

Uri Gneezy: So social signaling is me caring about what you think about me.

Perry Carpenter: Mm.

Uri Gneezy: I want to signal with my action. I want to signal to you that I'm a good person, whatever a good person is. It could be that I'm a mass murderer if that's what the society is about. And self-signaling is to yourself because, in many cases, we don't really know how good we are. And we look at our actions in some funny way and conclude from that whether we are good people or not. So imagine that you live in a very cold place. In the morning, you see your neighbor, Jane, walking with a large bag filled with soda cans to the recycling center. You're going to say, well, she is a good person. Jane is a good person. She cares about the environment. She could have thrown away the soda cans. She chose to do it. She probably feels good about herself because, again, she could have just avoided it. But everyone gets a positive signal. Now imagine that in this place, you get 5 cents for every soda can that you recycle. Exactly the same story. Cold morning, you see your neighbor, Jane, walking to the -- Now you conclude she's cheap, right? So everything else is the same. But now there is a 5-cent incentives. And you say, well, she's cheap. For $5, really, Jane? And the social signaling is basically destroyed. Probably also the self-signaling because Jane now doesn't think, oh, I'm a great person. She thinks, well, for $5, I collected this for two weeks. And now I'm walking in the cold to the recycling center. It's not worth it, right? Once you understand this signaling, you can actually use it to your advantage. So think about blood donation. The economy of blood donation is very interesting because all over the chain are hundreds of millions of dollars, if not billions of dollars, exchanging hands. So then blood sell it to hospital. They need it. There is a shortage in it. Yet the donors, the people that actually give the blood, don't get paid. And you could have solved it by pay them. So, for example, for plasma, you can get paid and paid nicely. So many people go and give plasma, sell their plasma, but blood is not. And why is that? So imagine a person -- We talked about Jane. Let's talk about Steve. Steve donates blood, right? Feels good about himself. You know, I spent, I wasted, or I sacrificed a few hours of my day, got, you know, this unpleasant needle. I feel good about myself. I care about giving back to the society. You know, Steve can go to his friends over lunch and tell them, well, this morning I couldn't work because I donated blood. So he gets also social signaling.

Perry Carpenter: Mm-hmm.

Uri Gneezy: If you would've paid Steve $50, that would be a very different story. Now, Steve would build a different story, like with the soda can. Did I do it because I'm a good person, or did I do it because of the $50? And the same goes for lunch, right --

Perry Carpenter: Right.

Uri Gneezy: -- for the lunch with his friends. Now, imagine that instead of $50, you give Steve a $10 coffee mug with the logo of the blood bank. Now that's a very different story. Now he can, every day when he'll get to work and make his coffee, drink his coffee, he'll say, wow. He'll see the logo and say, wow, I'm a good person. I donated blood. When he goes to lunch or to a meeting, he can just put the coffee mug on the table. He doesn't have to tell everyone that he's a good person. They'll see, right? So by understanding the signaling that comes out of the incentives, you can actually use them in a more efficient way. You can maybe give less and get a much better outcome.

Perry Carpenter: Yeah, that actually makes a lot of sense. As you were talking about that way that it affects your internal and external signaling, it reminded me of -- I wish I remembered the name of the study. It's probably about 20 years old now. But it was a meta-analysis of -- or 128 other studies that showed that internal motivation over the long term is much more effective than any kind of external motivation, even though an external motivator might be more effective in a short term. But for long-term results, that internal motivation and internal signaling both to yourself and to those around you is extremely important.

Uri Gneezy: I think that what you're referring to is the work in psychology, starting with DC in the early seventies. It's a really impressive and important work that, you know, they, exactly like you said, is that many things we are doing because we are intrinsically motivated to do. Once you'll pay, maybe I'll do it more, but you'll destroy my intrinsic motivation to do it. And after, you'll stop paying. During in the long run, I'm not going to do it.

Perry Carpenter: Mm-hmm.

Uri Gneezy: Absolutely true. What economists, I think, pushed it way further than this about the information that you get. So I can, for example, insult you with money. So imagine that you're my assistant, and I ask you to stay over the weekend and work on something while I'm going on vacation. I come back on Monday morning and give you $10. You'll be very insulted. Why? Because basically, I'm telling you, that's what it's worth to me. Everything that you did is worth $10 for me. Now imagine instead that I give you a chocolate bar, some nice chocolate that I brought might also cost $10. That's going to signal something different. It will signal, look, I cared about your staying. I thought about you. That's nice, right? So that's a different signaling. If I'll pay you $10,000 instead of $10, you'll be happy as my assistant. I don't think that my assistant would mind getting $10,000, right? So the size of the amount, the size of the incentive is, of course, again, the money. But it also signals, look, if I'll give you $10,000, that means that what you did is huge. It's a huge thing that you did for me, a signal to you.

Perry Carpenter: It also sets up an expectation for next time, though, right?

Uri Gneezy: That's absolutely true. If I'll give you $10,000 now and next time I'll give you only $8,000, you'll be, hey, what's going on over here?

Perry Carpenter: Really interesting. So what are some of your favorite examples from the book? I know that there's an interesting one really early in the book that talks about somebody wanting to be part of a biker group. And so they are either going to choose whether or not to get a tattoo. And that has different effects. Walk us through maybe that one and a few of your other favorites.

Uri Gneezy: So the idea is that if I want to signal to you something, I need to send a credible signal. So my accountant, very nice guy. I always go there late in April because I procrastinate, and many people --

Perry Carpenter: Me too.

Uri Gneezy: -- many other people do. Yeah, exactly. I'm not unique in this. And one day, I asked him, you know, what keeps you going on this? And he said, well, you know, after this craziness, there is another month in which I need to clear up my desk. And then I go with my buddies. We take our leaves and go out to ride.

Perry Carpenter: Mm.

Uri Gneezy: And then I thought that you know, the guy is a very nice guy. He can buy everything. You know, he can buy the jacket. He can buy the boots. He can buy the motorcycle. But you'll never confuse him with the real biker, with the real, you know, Hell Angel because they do something else, which is the tattoos, right? So imagine that, you know, you decide that you want to be part of this culture. You get a very big, very large neck tattoo. Then you say, look, I'm one of you. And if my accountant will do that, he will not be able to go back to the office because many people will say, well, just a minute, I want my accountant to be a boring person that can actually --

Perry Carpenter: Right.

Uri Gneezy: -- that I can actually trust. And the guy with the neck tattoo signals something very differently. And because of that, this tattoo is a very strong signal that you are into the bike culture. You don't just buy the gloves and the jacket. You actually invested such that a very costly investment. And that's very important for signals to be because I can tell you whatever I want. Talk is cheap, but you need to back it up with some actions.

Perry Carpenter: Yeah. And as you have these examples within the book, I want to talk just for a second about the format of the book because I think it's very inviting for people. You have diagrams as examples within each type of signal that you're talking about. You also have a number of cartoons that is part of that. Can you talk a little bit about the creative decisions that went into that?

Uri Gneezy: We discuss resources that we all think about now is attention. It used to be much simpler. Attention was easier to get. Now we are bombarded. I have my iPhone everywhere. I listen to podcasts. I watch YouTube. I'm really busy with attention, and our attention span becomes shorter and shorter, I think. And in many cases, I find myself, even when I read books after five pages, not remembering what I just saw.

Perry Carpenter: Right.

Uri Gneezy: Right? I just, you know, I wasn't there. I think that diagrams like this are really nice in the sense that, you know, some kind of game tree, I call them decision tree, if you like, that really emphasize what you want in a clean and clear way without all the nice stories. Just the clearest thing and that really helps, at least me. It helps with thinking about it. And the cartoons, I think, are just a funny way of doing it. I worked with a very talented guy called Luigi that really did a good job at making it funny and interesting, I think so.

Perry Carpenter: Right. So let's talk about where the idea of incentives can go awry. What are our choices when it comes to thinking about how to get certain results as employee to employee or parent to child or even peer to peer, and how can we start to frame somebody's decisions and actions in a way that are most likely going to favor the result that we're hoping for?

Uri Gneezy: Let me give you an example. At some point, the CEO of Coca-Cola understood that in vending machines, you can charge different prices at different times. So on a hot day, you can charge more than on a cold day.

Perry Carpenter: Mm.

Uri Gneezy: That's Econ 101 again. We call it price discrimination or dynamic pricing. We see it everywhere.

Perry Carpenter: Right.

Uri Gneezy: So we see it in airlines, in hotels. It's very common to see it. So he basically decided, let's say, that the regular price is going to be dollar, but on hot days the vending machine will charge $1.50. Of course, many people got upset by this. Why are you taking advantage of us? What you should have done is make the regular price $1.50 and then, on cold days, give a discount of 50 cents. So on a cold day, it's going to be a dollar. So instead of, oh, when it's hot, I'm going to take advantage of you. Now it is when it's cold, I'm going to be nice to you and give you a discount. Exactly the same numbers, right?

Perry Carpenter: Right.

Uri Gneezy: So exactly, everything is the same, but you frame it differently. And the point is that incentive tell a story. We negotiate the world, if you like, with our brain by seeing types of data and actually filling up the gaps, right? So we see -- In the book, I have a series of just abstract shapes and ask people to come up with stories. Everyone can come up with an interesting story, but it's just abstract shapes. Our brain is really good at filling up the gaps of this and making it a story. Same story over here. We come up with a story of Coca-Cola is a bad company because they take advantage of us. Or we come up with a story, Coca-Cola is a nice company because it gives us a discount when they can. So the way you frame your incentives could really make a big difference in how it's perceived by your audience and how people react to it.

Perry Carpenter: More of our interview with Uri Gneezy after this.

[ Music ]

Welcome back to our interview with Uri Gneezy. Speaking about the idea of framing, you give an example in the book of Peloton and a California winery. And they both saw an uptick in sales whenever they raised the cost of their product. Can you explain the logic behind how people might resonate with a company differently when they decide to raise prices?

Uri Gneezy: In many cases, the quality of what we buy is very highly correlated with the price. If I want to buy a laptop, the more whatever, CPU, the better the CPU, the lighter it is, it's going to cost more. That works, and that makes sense. However, we take this intuition that works in many cases and apply it in places where we shouldn't necessarily. Think about wine. Maybe usually you drink a $20 wine, and now tonight you're going to celebrate your birthday. So you go to the wine store and say, well, give me a $50 bottle of wine because you associate more expensive wines with better ones, right? So that's the way. What we showed with the winery was that when people went for tasting, if you had a good wine and you increased the price, in our case, it was a winery near San Diego, in our case, we had this one condition in which the price of the Cabernet was $10 and another one it was $20. People actually bought more wine when the price was $20 because they said, oh, that must be a good wine. Ten dollar is probably not that good. Twenty dollar, it must be good.

Perry Carpenter: Right.

Uri Gneezy: The Peloton example that you mentioned, I don't remember the exact numbers, but the CEO wrote it. He said, look, we started with the price of $1,000, and people didn't buy. They thought that the bike cannot be good if it's only $1,000. We doubled the price and sold the entire stock immediately. Again, you assume that a bike that cost $2,000 is much better than a bike that cost $1,000.

Perry Carpenter: Yeah. And I do also think that with that, so there's the perception of luxury and quality that comes with that. There's also the social signaling piece, I think, that comes with that too, is now I'm also associated with a group of people who can afford to do that and are dedicated in the same way and are part of this more exclusive type of group. Do you think that that plays a part of that?

Uri Gneezy: I think so. I think that you're very much right. It told a story about your expectations. And by the way, if you're selling a bad product and you'll double the price, people are going to be upset at you.

Perry Carpenter: Right.

Uri Gneezy: Imagine a motel that costs $70 a night versus a luxury hotel that costs $500 a night. You'll go to the $500 a night, and it's going to be a bit noisy. You'll be upset.

Perry Carpenter: Right.

Uri Gneezy: You're going to give them much lower, less stars than the motel that you expected much less, right? So it really depends on your expectations. If you expect, if the price increases your expectations and then you're disappointed, that's not good for the company.

Perry Carpenter: Yeah.

Uri Gneezy: That's going to get backlash, right? So the expectations that are created by the price in these cases are important.

Perry Carpenter: So when we're thinking about incentives, we're really getting at how do I get somebody to do the thing that I'm hoping that they'll do? And one of the things that society and organizations, and parents tend to do over and over and over again is think about how do I disincentivize the negative behavior. And so that's where things like fines and regulatory penalties and a whole range of other consequence-based negative incentives come in. Can you talk about times when that may backfire or the counterintuitive use of those?

Uri Gneezy: So in one of my first studies, we studied what happens when you introduce fine for parents coming late to pick up their kids from a daycare. So my wife and I lived in a suburb of Tel Aviv at the time. And we had two girls in a daycare. And we were supposed to pick them up by 4:00 p.m. We used to go to have lunch in Tel Aviv. And then I remember one day driving like crazy because there was a traffic jam, and I was afraid to be late. We got there on time, everything was good. And then the principal introduced 10 shekels, I think it was $3 at the time, fine if you came more than 10 minutes late. Again, we were in Tel Aviv. Again, lunch, again, traffic. This time I didn't drive like crazy because I'm not going to risk my life for $3, right? So what happens is that the fine really changes what your perception about what you're doing. Before that, it was, well, I don't know how bad it is. Maybe the principal doesn't care. She has to clean up the daycare anyway. Or maybe she's so upset she takes my kids to the back room and pinch them.

Perry Carpenter: Mm.

Uri Gneezy: I don't know how bad it is. Now you told me that it's only $3. That's fine. And indeed, we saw that it's not just that I'm paying for babysitting, and I think that it's okay because in the experiment that we did [inaudible] and I, what we saw was that once we removed -- So we had a group that didn't have a fine, and we followed them.

Perry Carpenter: Right.

Uri Gneezy: And then we had a group that we introduced a fine, we saw a big jump in late-coming parents. And then when we removed the fine, there was no fine anymore. This group continued to be late because now they got the information. They knew how bad it is. Well, the signal told them that it's not so bad. It's only $3 bad. You're not going to risk your life for that. In general, I think that the study of negative incentives is really -- we really don't know a lot about it because if you think about the regular tool that psychologists and economists are using, it's lab experiments. In the lab, we cannot really punish our subjects. So there are some experiments in which you can give them electric shocks. But that's kind of weird. You cannot take money. You cannot have a participant come into your lab and leaving with less money than they showed --

Perry Carpenter: Right.

Uri Gneezy: And if you read the literature in psychology, they usually say, oh, positive in, you know, giving some -- giving someone money is better than taking away. It's more effective. But they never really studied negative incentives. I think that if you think about traffic fines or things like that, I think that they are very effective. People don't like losing money. They don't like to get fines. The empirical evidence of this is a bit lacking.

Perry Carpenter: Yeah, I think when it's low-stakes money, like $3 or $10, some people will pay for it and almost come to see it as a convenience fee.

Uri Gneezy: Exactly.

Perry Carpenter: Oh, you're going to keep my kids an extra 30 minutes. It only costs me $3. It flips within our heads very quickly. But when it's serious money to the point of paying, then we may rethink that. But corporations, I think, make these decisions all the time. You know, the fine for this is only X amount. And my business return for having this behavior is going to be higher than that. So there's an ROI piece that comes into play.

Uri Gneezy: Absolutely. So, like you said, the fine, in our case, was only $3. And we called our paper. By the way, a fine is a price. Basically, you put a price on the bad behavior. Now there are places in the US that charge you $10 a minute. That's a serious fine.

Perry Carpenter: Right.

Uri Gneezy: And the words I've heard is from someone told me that in Paris, in some places, if you're late to pick up your kid, you have to pick the kid up from the police station.

Perry Carpenter: Oh, wow.

Uri Gneezy: Now that's a serious -- it's not money, but --

Perry Carpenter: Right.

Uri Gneezy: That's serious. Go explain to your spouse why you are coming back from the police station, why your kid is coming back with stories about policemen. So with companies, in some cases, they can really give you negative incentives. It can also really backfire. It seems, you know, that you have white hair like I do. You remember Blockbuster.

Perry Carpenter: Mm-hmm.

Uri Gneezy: Blockbuster had all these late fees, right? That was so annoying. The story goes that that's how Netflix started because of these late fees. So they did give you negative incentives. It was very annoying. It worked for them in the short run. It didn't work for them in the long run. But you can create negative incentives that will deter people. There is no question about that.

Perry Carpenter: Right. So let's think about, if you don't mind, thinking about some applications for this that may be interesting to this specific group of listeners, many of whom are security professionals that are trying to think about how do I get the people within the organization that I work for to make more secure choices or to maybe even just take the training that I'm giving them? When you're trying to think through incentives for behaviors that have to do with, you know, personal or organizational security, how do you start to think about that as a behavioral economist?

Uri Gneezy: So, I work for the University of California. And every two years, I have to take this cybersecurity training. And the way it structures, at least here, is such that basically, I just want to get rid of it.

Perry Carpenter: Right.

Uri Gneezy: I don't think that I learned anything in it. It seems like university is going to through the motion. It's not really -- It teaches me exactly zero.

Perry Carpenter: Yeah.

Uri Gneezy: Now there is a signal in it. So the university does signal to me, look, it's so important. There are few things that we ask you to do: the sexual harassment training, the cybersecurity training. Those are things that are really important for us. So in that sense, it has value. But it has very little value apart from that. There are other places. So I have a friend that works in a company in which, for example, they send phishing emails to their employees. And when the employee clicks on it, they take them to a website that shows them how bad that could be.

Perry Carpenter: Right

Uri Gneezy: Now, that's an interesting way of educating me and give me a piece of information how to avoid such mistakes in the future, right? So there should be ways. We talked about attention. There should be ways to get my attention to why it is bad. And I think that that's the big thing that you need to find out, how to make me care about this, not just when it happens, and my computer crashes and I come crying to you. But before that. For example, by a surprise phishing exercise by you, that could be one way of doing it.

Perry Carpenter: Yeah. And would some of the other social signaling, like what you were talking about with giving blood and all that, potentially work in this case too? Like if you finish your mandatory training within a certain amount of time, that you don't get necessarily anything monetary. But you might get something symbolic that shows that you cared to a certain extent.

Uri Gneezy: Absolutely. Or, in this case, you can think about the negative one. You can just shut up my connection to the server --

Perry Carpenter: Right.

Uri Gneezy: -- if, right, automatically, right? So that's a place where a negative incentives could actually work. Look, if you didn't go through this, it's shut down. You want to reconnect. You need to do it.

Perry Carpenter: Right. Well, that brings up one other thing that maybe we can touch on if you have some opinions here. In these situations where you have a group within an organization like a security team or like an HR and benefits team, people who are constantly vying for your attention, when sometimes that's the last thing on your mind, and you apply a negative incentive, like shutting off access, does that impact the longer-term relationship? And what I'm trying to get at is there's this other relational component where maybe you're hoping that people will view you or interact with you in a certain way in the long term. How do incentives play within those types of circumstances?

Uri Gneezy: So the right way to do it, it's not that Jerry from it is going to shut me off, right?

Perry Carpenter: Right.

Uri Gneezy: Should be automatically done, and Jerry is coming to help me.

Perry Carpenter: Ah. I love that.

Uri Gneezy: Right? So again, it's just the way you're telling the story. So it's not that Jerry is annoying because he shut down this exactly when I need it. But, look, that's automatic. I'm not controlling it. That's someone else from higher up. So imagine going to a car dealership and going with a salesperson out for a drive. And then you go to the dealership and start negotiating the price. The salesperson that became your friend is going to tell you, look, it's the manager.

Perry Carpenter: Right.

Uri Gneezy: I'm the nice guy. I'm trying to help you, but the manager is, you know, he is the one that insists on something like that. So the same could be over here. The IT person can be your friend, but the IT can tell you, the IT person can tell you, look, it's not me. That's how the system is done. So just different framing of who's the good guy and who's the bad guy. But the fact is that if you don't do it, you just can't be on our system.

Perry Carpenter: Yeah. I love you're talking about the framing use there. I think that that makes a lot of sense. So from your perspective, as we start to close out our time, is there anything else that you really want to touch on that I haven't thought to ask about yet? Is there a message that you really want to get to people within these interviews? And do you want to take a couple minutes to get that message out?

Uri Gneezy: So, I'm not in your world. But I thought that you were going to ask me about open source and people that contribute a lot to things without any, you know, they're not getting paid for it.

Perry Carpenter: Right. Right.

Uri Gneezy: Right? So why are they doing this, right? And that's, I think that's a very interesting area of, yeah. So why do people spend so much time in developing software, developing things that are just for probably good? And I think that's a good place where I feel good if I'm solving the problem and I'm helping other people to do it. Sometimes I get some recognition.

Perry Carpenter: Mm-hmm.

Uri Gneezy: So people write how nice it is even if they don't know me, I still, I can still get the good signal in that I was able to solve, and I was able to help other people. And I think that that's fascinating. And in general, it's important to understand that incentives that can work on you will not necessarily work on me and on other people. I talk, for example, about incentives to buy Prius, to buy a hybrid car.

Perry Carpenter: Right.

Uri Gneezy: Now, some people are going to drive their pickup and just going to look down at the people in Prius and think they're idiots. And other people really care about the environment and really feel good about driving a hybrid car. The same is true over here. I cannot understand people that develop software that solves other people's problem. So it's not that -- the incentive should not be, you shouldn't think, what would Uri -- what would motivate Uri? It should think, what would motivate people like you that sits and write code that is useful for others? And my daughter is a software engineer. And I'm fascinating many times by things that she's doing. But understanding this, I think that that's an interesting --

Perry Carpenter: Yeah, that makes a lot of sense. Do you know if there's been any formal studies in these types of groups? And maybe it's not specifically around open source versus closed source, but anything that is volunteer work versus paid work, maybe things like Habitat for Humanity or other groups like that.

Uri Gneezy: Right, right. So there is a lot of work, a lot of ways to try and understand what motivates volunteers, right? So it's the good feeling. And if it's the good feeling, we can have the problem. If I'll pay you, we can get the problem that we talked about before.

Perry Carpenter: Mm-hmm.

Uri Gneezy: Right? But you can pay me. For example, you can reimburse me for everything, right? That's fine.

Perry Carpenter: Yeah.

Uri Gneezy: You can say, okay, at the end, we are going to send you to a nice dinner, right? So there are ways of doing it without just reducing the benefit that you get from volunteering and being a good person, right? So I can give you some rewards that will actually say, okay, you were -- imagine that you developed something. So I tell you, you know what? Let's have a get-together, and we'll go to a fancy restaurant. I'll pay for it as a thank you for all of you that contributed to this for your spare time. Things that are outside -- The coffee mug that I mentioned before, right? So things that are outside of direct pain, that's the trick, finding that for what is it for the group that you care about.

Perry Carpenter: So it's the difference between appreciation and compensation.

Uri Gneezy: Exactly.

Perry Carpenter: So if I appreciate you, there's a relationship, and there's interesting signaling. And there's a stoking of the internal value that somebody has. And when you're compensated, it is totally something on the outside. It's value for value. People can kind of decide to take or leave that as their moods change.

Uri Gneezy: I couldn't have said it better.

Perry Carpenter: Ah. Okay. Yeah, I think you've given us a lot to think about.

Uri Gneezy: Thank you. I really enjoyed the conversation.

Perry Carpenter: I hope you enjoyed that interview with Uri Gneezy. And more than that, I hope you can see how immediately useful this type of information can be for your cybersecurity program. When we talk about working with an understanding and an awareness of the realities of human nature, this is exactly the kind of thing we're talking about. It is through this kind of research that we see the implications of how we frame our incentives and how we and others around us communicate what we value, and how that communication of our values impacts the beliefs and choices of others. And with that, thanks so much for listening. And thank you to my guest, Uri Gneezy. If you are interested in understanding how to drive secure behaviors and mindsets in your organization, be sure to check out Uri's book, "Mixed Signals: How Incentives Really Work." It's not a cybersecurity book, but it definitely deserves a place on your bookshelf. I've loaded up the show notes with more information about Uri as well as all the relevant links and references to the information that we covered today. If you've been enjoying 8th Layer Insights and you want to know how you can help make the show successful, there are, as always, two big ways you can do so, and both are still super important. First, if you haven't yet, please go ahead and take just a couple seconds to give us five stars and to leave a short review on Apple Podcasts or Spotify or any other podcast platform that lets you do so. That helps other people who stumble upon this show have the confidence that this show is worth their most valuable resource, their time. And the second big way that you can help is by telling someone else about this show. Word-of-mouth referrals are the lifeblood of helping people find good podcasts. And if you haven't yet, please go ahead and subscribe or follow wherever you get your podcast. If you want to connect with me, feel free to do so. You can find my contact information at the very bottom of the show notes for this episode. This show was written, recorded, sound designed, and edited by me, Perry Carpenter. Cover art and branding for 8th Layer Insights was designed by Chris Machowski at ransomwear.net. The 8th Layer Insights theme song was composed and performed by Marcus Moscat. Until next time, I'm Perry Carpenter signing off.

[ Music ]