# Disclosed Automated Security Action Builds More Trust ## Claim Automated security or backup protection builds more user trust when it's disclosed to the person it's protecting than when the same action happens silently. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for protective actions with a visible, positive framing: a blocked attack, an activated safeguard, a "you're all clear" status. - Doesn't establish whether the same holds for disclosed false positives — a legitimate user blocked by mistake. The source this claim comes from doesn't address that case, and it's a real open question, not an assumed extension. - Applies specifically to security/backup automation; not a general claim about all silent-vs-disclosed automation. ## Evidence Two hosting-security veterans (Jesse Friedman, Aaron Campbell) converge on this from two directions: WordFence's early growth came partly from a simple dashboard widget showing a running count of attacks thwarted, which built passive, cumulative user awareness without alert fatigue; and WP Cloud's "defender mode" is designed to be disclosed to the user rather than run invisibly. Both frame automate-then-disclose as the trust-building pattern, contrasted directly against a recurring support-ticket failure mode: users who assumed a backup existed by default and only discovered it was never activated when they needed to restore. ## Links - [[3. Resources/Permanent Notes/A Safeguard That Cannot Distinguish Attack From Defense Penalizes the Defender]] — because contrasts on failure mode; that note is about a safeguard's inability to tell attack from defense, this one about the trust cost of not telling the *user* what the safeguard is doing. - [[3. Resources/Permanent Notes/Trust Erosion in Concentrated Systems Is Slow to Build and Fast to Manifest]] — because extends; disclosure is a concrete lever for the slow, deliberate trust-building side of that dynamic. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in the vault's hosting-security transparency thread. ## Tests / falsifiers - A controlled comparison of disclosed vs. silent automated blocking, measuring support-ticket volume, NPS, or renewal rate, would directly test this — if disclosure shows no measurable trust/retention difference, the claim doesn't hold. - If disclosed false positives (blocking a legitimate user) turn out to *reduce* trust more than silent false positives, that would specifically falsify the assumed extension noted in Scope & conditions, not the core claim about legitimate blocks. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Literature Notes/How Is AI Changing the Security Arms Race (with Aaron Campbell)]] — the WordFence attack-counter widget and WP Cloud "defender mode" examples, contrasted with the backup-activation support-ticket pattern.