CyberPsychwith Connor
Psychology concept

Status Quo Bias

Status quo bias is the tendency to prefer an existing choice or current state over an available change, partly because staying put can feel easier, safer, or less disruptive.

Plain-language guide

Why it matters online

Digital systems can keep functioning while an important risk remains hard to see. Changing a credential, workflow, or configuration may feel more dangerous than leaving it alone because the cost of change is immediate and the cost of inaction is uncertain.

How it can be exploited

An attacker does not need to persuade someone to make a new unsafe choice if an old exposed credential or weak configuration is simply left in place. The existing system can provide continuing access while change keeps being postponed.

Recognition signals

  • The main reason for keeping something is that it still appears to work.
  • A known risk is being postponed because changing the current setup might be inconvenient.
  • The danger of doing nothing feels less real than the disruption caused by taking action now.

Protective questions

  1. If this were not already the current setup, would we choose it today?
  2. What risk are we accepting each day that we leave this unchanged?
  3. How can we test and stage the change so disruption is easier to manage?

Staying put can feel safer than changing course

Status quo bias is a preference for keeping an existing choice in place. The current option does not need to be objectively better. It can receive an advantage simply because it is already the default.

Change creates visible work. Someone may need to learn a new process, update a system, coordinate with other people, or accept a chance that something will go wrong. The risk of leaving the current choice alone may feel distant by comparison.

That does not mean every unchanged system is evidence of a bias. Stability can be valuable, and some changes carry real costs. Status quo bias is useful when the fact that something is already in place begins to substitute for a fresh evaluation of whether it is still the best option.

What the 1988 experiments found

William Samuelson and Richard Zeckhauser gave people a series of hypothetical decision problems. Participants saw the same available choices, but the researchers changed which option was described as the current choice.

People were more likely to select an option when it was presented as the status quo. In several scenarios, that preference became stronger when participants had more alternatives to consider.

The experiments did not involve passwords, cloud systems, or cybersecurity teams. They demonstrate a general effect of how an existing choice is framed. They do not predict what one person or organization will do.

Why it matters in cybersecurity

A system can keep working while its risk quietly grows. A credential may be public. A patch may be overdue. A temporary exception may have become permanent. The harm is not always visible, but the effort required to change the system is.

That imbalance can make “later” feel like the responsible choice. The current setup is familiar, and nobody wants to be the person who breaks a working application.

The safer habit is to separate “working” from “safe enough.” Ask whether the current choice would still be acceptable if it were being proposed for the first time today.

Make a safer change easier to choose

Recognizing status quo bias does not remove the real work behind a change. It helps a team design that work more deliberately.

  • Name an owner and a deadline.
  • Test the change in a controlled environment.
  • Plan a rollback path when one is appropriate.
  • Break a large change into smaller, verifiable steps.
  • Record the risk of waiting alongside the risk of acting.

When the safer option is easier to understand and carry out, keeping the old choice no longer wins simply because it is already there.

If this were not already our current setup, would we choose it today?

Sources

  1. Status Quo Bias in Decision Making (opens in a new tab)

    Journal of Risk and Uncertainty · Supports: Primary paper for the experimental finding that people were more likely to choose an option when it was framed as the current or existing choice.

Related cases

Related concepts