for tomorrow’s test when your antivirus software prompts you with a message indicating new virus definitions are available. Would you update the antivirus software now or later or not at all? Imagine now that you’re browsing online and you receive an instant message (IM) with a friendly greeting and a Web page link from one of your IM buddies. She asks that you follow the link to see an amusing picture. You’re not busy at the moment but would you click on the link? These vignettes illustrate the kinds of computer-security situations that people encounter on a daily basis. They are often mundane, seemingly small decisions that hide the potential for a security incident. While new authentication mechanisms can replace passwords to offer more secure and user-friendly security, any computer security situation that involves an action or decision from the user is open to risk. Therefore, understanding how users perceive and make security decisions is fundamental to designing security features that users will use and use well.