# Concrete Steps Convert Alert Anxiety Into Action ## Claim When a risk message can't be fully certain about the underlying threat, giving the recipient one concrete, doable action still lowers their anxiety more than a more "honest" but vague warning would. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds when the recipient has genuine agency to act on the step offered — e.g., "click here to change your password" is a real, completable action. - Breaks when the concrete step is itself wrong, or the recipient has no real ability to act on it — offering false agency is worse than honest uncertainty. - Doesn't argue for overstating certainty; the claim is specifically about pairing hedged/uncertain detection with a still-concrete recommended action, not about hiding the uncertainty. ## Evidence Aaron Campbell (VP of Product, Monarx) describes designing dark-web monitoring alerts where the underlying detection often can't confirm whether a specific stored password is currently vulnerable — so messaging has to hedge ("you *may* need to change your password"). His design rule: keep the recommended *action* concrete even when the underlying certainty is fuzzy, rather than let hedged detection produce a hedged, non-actionable message. > "make sure that at least the steps that they can do are concrete" ## Links - [[3. Resources/Permanent Notes/A Privileged Setup Flow Needs Explicit Consent at Every Trust-Boundary Crossing]] — because contrasts: that note is about making a boundary crossing explicit before it happens; this note is about making the recommended response explicit after a risk is detected — both are instances of clarity mattering more than technical accuracy alone at the interface layer. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in: directly shapes how host-level security alerts and breach notifications should be designed. ## Tests / falsifiers - A/B test two alert copy variants (vague-but-honest vs. vague-plus-concrete-step) against the same underlying uncertain detection, measuring self-reported anxiety and remediation completion rate. - If a cohort shown a concrete-but-wrong step reports lower trust after correction than a cohort shown an honestly vague warning, that would undercut the claim that concreteness beats certainty regardless of accuracy. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/How Can Hosts Communicate Security Risks Without Creating Fear]] — Impressive Hosting podcast, Jesse Friedman interviewing Aaron Campbell (Monarx).