BiasValuation & choice · Cognitive Bias · Entry 115
Prevention Bias – favoring preventive security controls over detection and response
Prevention Bias is a domain-specific label from experimental research on information-security investment. In the studied allocation task, participants favored preventive controls over detection-and-response controls even when both categories were designed to offer the same return on investment. This evidence does not establish a general rule that people overvalue prevention in healthcare, insurance, relationships, or every other domain.
Where it can show up
- Security budgeting – prevention receives more funding simply because stopping an incident feels more compelling than detecting and responding to one.
- Portfolio design – teams compare control categories by intuition or cultural preference instead of by marginal risk reduction and expected loss.
- Generalization – a result from information-security investment is retold as a universal preference for prevention.
A practical countermeasure
- Compare prevention, detection, and response using the same expected-loss and marginal-value framework.
- Make trade-offs explicit when the same budget cannot maximize every control category.
- Separate the observed security-investment finding from claims about other domains unless those claims have their own evidence.
- Revisit the allocation when threat probabilities, control effectiveness, or response capability changes.
Evidence review
single-study / domain-specificWhat the evidence supports
Prevention Bias is a label introduced in experimental research on information-security investment. In that task, participants favored preventive controls over detection-and-response controls even when the experiment was designed so the two classes had the same return on investment. The evidence does not establish a broad psychological law that people generally overvalue prevention in healthcare, insurance, relationships, or every other domain.
How researchers describe the pattern
The original information-security study interprets the pattern through behavioral decision-making mechanisms including reference points, loss aversion, affect, and fast intuitive processing. Those mechanisms are plausible background explanations, but the named Prevention Bias itself is a domain-specific construct from this research program rather than a broadly replicated general-purpose bias.
Practical interpretation
When allocating a security budget, compare prevention, detection, and response using the same expected-loss and marginal-value framework instead of assuming prevention is automatically the superior category. For other domains, do not import the label without evidence that the same allocation pattern and incentives actually apply.
Reviewed sources
- Mis-spending on information security measures: Theory and experimental evidence domain-specific behavioral experiment · 2021 · DOI 10.1016/j.ijinfomgt.2020.102291
- Prospect Theory: An Analysis of Decision under Risk mechanism background / foundational theory · 1979 · DOI 10.2307/1914185
Editorial review: 2026-08-18. Evidence status describes this entry, not every study ever published on the topic.