Fifty Shades of Orange: Construal Levels, Cognitive Biases, and The Amber Dilemma in Cybersecurity Risk Communication - Barre, Gulet; Khoi Nguyen, Dinh; Huygh, Tim; Nuijten, Arno (39th Bled eConference: Co-Creating Human-Centred and Responsible Digital Futures; Conference Proceedings, 2026)
Board-level decisions on cybersecurity risks are strongly shaped by how information is communicated. Traffic light reporting offers simplicity, but especially the amber light leads to inconsistent interpretations. This paper applies Construal Level Theory (CLT) to explore how psychological distance structures risk responses. Based on interviews with 11 CISOs, we focus on four exemplary biases arising from psychological distance in board-level risk perception. Our results indicate that these biases are not random flaws in judgement but patterned outcomes of directors’ and executives’ construal levels, influencing whether risks are seen in abstract or concrete terms. Our contribution lies in applying CLT to cybersecurity governance, demonstrating how psychological distance shapes board-level biases, and highlighting how CISOs can manage psychological distance through framing and narrative to support more balanced decision-making. Future work will conduct additional CISO interviews and design an experiment to test how psychological distance shapes board responses to amber risk signals.