Companies often tell customers they have been hit by "phishing" or a "malware attack." The words sound technical and official. But new research suggests that many people do not really understand them, and so may not know how to protect themselves.
The study was carried out by Sky Marsen, a language researcher at Flinders University in Australia, and Robert Biddle, a computer scientist at Carleton University in Canada. Published in the International Journal of Business Communication, it tested a common belief in science communication: that metaphors help nonexperts understand complex ideas.
The researchers wrote short stories about cyberattacks in two versions. One used figurative terms such as "phishing," "virus," and "trojan." The other described the same events in plain, literal language. Participants read the stories and then answered questions in an online survey.
People who read the plain version understood the attacks significantly better. In cybersecurity, it seems, metaphors may confuse more than they help.
"These terms weren't designed for the public in the first place," Marsen explains. "They emerged from within hacker culture." Words that sound creative and playful inside expert communities, she says, are often unclear to everyone else.
That matters because unclear words have real costs. "If people don't fully understand what that means, they may not know how to respond or protect themselves," Marsen says. Unclear language can also downplay a company's responsibility or leave users at risk.
Plain language is not a complete fix, though. Readers of both versions still made important mistakes. That, the researchers say, is why organizations need to choose their words carefully and explain cyberattacks more fully. For Marsen, the choice of words is not just a matter of style. It is a matter of public safety.