Defining cybersecurity is not always straight forward ²⁰ . Although often used interchangeably with information security, von Solms and van Niekerk ²¹ see cybersecurity in broader terms encompassing other assets including technology users themselves and not just their information. An asset, then, is “anything that has value... and which, therefore, requires protection” ¹⁹ to avoid attack (“attempt[s] to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset” ^{18, 19} ) by threats or the “potential cause(s) of an unwanted incident, which can result in harm” ¹⁸ . Threats exploit vulnerabilities (“weakness(es) of an asset” ¹⁸ ), and cause risks (the likelihood and impact of loss or damage). They may be either malicious behaviours ( attacks), or unintentional or inadvertent behaviours that lead to similar harms. The “well-intentioned" user ⁹ is likely to fall into the latter category. A control is a “measure that is modifying risk" ¹⁸ by either reducing the likelihood of a threat attacking an asset (reducing the asset's vulnerability) or lowering consequent impact or both. Figure 1 summarises relationships between these concepts, where threat events (an amalgam of threat and event in 18) exploit vulnerabilities leading to cybersecurity risks to particular assets.

Following Ganin and his colleagues ²² , we emphasise that understanding the threat landscape requires a holistic approach. For simplicity, we use threat as shorthand for risk, threat and threat event, and control for any measure taken to contain the threat or mitigate the risk. This leads to our first two research questions (RQ):

As mentioned, people represent a significant source of risk ¹⁰ and ideally need to become part of the solution rather than the problem ⁹ . Context, demographics, affect and beliefs around responsibility all seem to influence cybersecurity adoption decisions. For example, willingness to undertake security-appropriate behaviours may be generalised rather than specific ²⁴ . That assumes individuals attend fully to all information, though, which may not be the case ²⁵ , meaning no appropriate protective behaviours are undertaken ²⁶ . Individual responses appear to differ by how developed a country is ²⁷ , the measures that country adopts ²⁸ , cultural differences ²⁶ , and context-determined affect ²⁹ . For security professionals, as the amount of relevant information decreases, so the subjectivity of their responses increases ^{30, 31} . For these experts and private individuals alike, though, affective responses to risk perceptions ^{16, 32, 33} reveal a complicated interrelationship between emotional response and the intention to act based on risk perception ³⁴ . This may depend on self-belief (or self-efficacy ³⁵ ) in applying mitigating controls ³⁶ , and to some degree personality traits ^{37, 38} . Further, if experts are believed to be responsible for controls, when private individuals are unable to access and assess all relevant information ³⁹ , then trust plays a mediating, but complex ^{38, 40} role as a socially constructed phenomenon related to confidence in system function ⁴¹ . With specific reference to technology, trust is a moderating factor along with risk perceptions, subjective norms and self-efficacy all influencing perceived usefulness decisions in adoption ⁴² . Ultimately, though, too much emphasis on the consequences of a given risk may leave individuals overwhelmed, the resulting “security fatigue” leading to inaction ²⁶ or even maladaptive behaviours ^{39, 40} .

For context, we will focus on the potential for sharing health data. These data are defined as special category personal data (Art. 9 ⁴³ ) and therefore require additional measures from any provider processing such data than other data types, including other types of personal data. Regarding the contextual effects outlined, we targeted the following RQs:

If risk perception is the result of the integration of an analytical with a more emotional pathway (see, for instance, 29), we must contextualise risks as relevant to individuals to encourage them to adopt any associated controls on the one hand, but also account for affect in the decision-making process. Behavioural models related to risk prevention suggest that the decision to adopt appropriate measures depends on the balance between perceptions of threats and the benefits of adoption (cost-benefit) with self-efficacy and social norms (personal beliefs, experience and ingroup perceptions). All of these have been mentioned in the previous sections as significant for cybersecurity related behaviours.

One common model in this area derives from Protection Motivation Theory (PMT) as shown in Figure 2 ^{15, 42, 43} . The PMT has been used to explore cybersecurity awareness and the willingness to adopt security-enhancing measures ¹⁵ . Comparing Figure 1 with Figure 2, Threat Appraisal is effectively a risk assessment: what is the likelihood (or Susceptibility in Figure 2, vulnerability in Figure 1) of an event and what would its impact (or Severity in Figure 2 or risk in Figure 1) be? The Coping Appraisal is a judgement about how effective a control may be in dealing with the threat (or Response efficacy in Figure 2 or control in Figure 1) and whether an individual feels able to implement that control (or Self-efficacy). To undertake this cost-benefit analysis leading to Protection Motivation (the intention to adopt the control), individuals must also feel themselves personally responsible.

1.2.3.1 Sources of information and security-related behaviours. The Cognitive Mediating Processes of the PMT model ( Figure 2), as the name suggests, represents the more rational decision-making arm of a dual process model. Such processing can be assumed to take place within a specific context, including an individual’s experience and that of significant others (their ingroup). In their meta-analysis, Floyd and her colleagues ⁴² also refer to Sources of Information such as contextual and individual factors (their Figure 1). Although not explicitly identified, others have suggested that individuals equate privacy (individual concern about how data are used) and security (how data are protected) orthogonally ³⁷ and may be behaviour specific ⁴⁴ ; that trait mindfulness can reduce vulnerability ⁴⁵ while other traits influence antecedents of privacy concern ³⁸ ; and that priming (i.e., contextual effects) can influence cybersecurity behaviours, though not in a straightforward manner ²⁹ . Our final RQ, therefore:

For ranking and matching, seven common threats were identified in the project: six relate to typical technology scenarios such as data misuse (T1), the loss of or unwise use of the end user's device (T3, T7), insecure ICT infrastructure at the healthcare provider (T4, T6), or misbehaviour of an application running on the user's equipment (T5); the seventh, a common source of information about data use etc. which may be overlooked by users (T2) (see Table 1). Seven appropriate security controls were suggested (see the last two columns of Table 1). These included measures to protect data at rest and in transit (C1), process issues (C2, C5 - restricting access; C3 - providing training); and technology-centric controls (C4, C6, C7). Positioning these controls against the threats in the first two columns as shown in Table 1 is for illustrative purposes only: these matchings were not exposed to survey participants; and many of the controls could be used to mitigate more than one threat.

A draft of the survey was reviewed by peers to ensure that wording was clear, and to estimate how long the survey would take to complete. The colleagues all have some experience with cybersecurity. They took an average of 10 to 11 minutes. Using this, we established a level of payment. Participants were therefore paid a modest amount ² for taking part.

Some 801 ³ participants were recruited via a crowd-sourcing platform ( Prolific.co), since others report comparable results from crowd-sourcing platforms and student participant panels ⁴⁷ and slightly better demographic coverage ⁴⁸ . In our survey, participants were asked to self-report Gender Identity, Age Group and what they claimed to be their level of Expertise. This information is summarised in Table 2 and compares well with existing UK population projects on (binary) gender, though there is a bias towards younger citizens regarding age group ⁴⁹ .

The survey was hosted on an external platform ( Qualtrics.com) and comprised four main sections ⁴⁶ . First, respondents were asked to read a short passage on the threat of cybersecurity retrieved from an online website ⁵⁰ . This was followed by a task where respondents were asked to rank threats for seriousness or controls for effectiveness, match controls against threats, or identify who they thought responsible for implementing the control (see Section 1.3.3.1). Third, they were asked to respond to a set of pre-validated, PMT-derived assertions (see Section 1.3.3.2). Finally, they were given an opportunity to leave any general comments and asked to provide selected demographic information. None of the questions or tasks was mandatory.

The survey ran twice. Initially, 500 participants responded. However, there was confusion with the way the matching task had been presented. In Section 1.3.3.1 below, these are grouped as condition None. A second iteration with 301 participants was run making sure the matching task was rendered appropriately. This time, they were asked to match threats and controls, but were randomly assigned to one of two conditions: either they were given a discursive description of the control to aid understanding ( Matching – Long Description) or a more succinct one, enough only to identify the control ( Matching – Short Description). Different participants took part in the first and second iterations; and different participants were assigned randomly to a different task.

1.3.3.1 Priming task. Different participants took part in the first and second iterations; and different participants were assigned randomly to each different task (see Table 3). Each activity was intended to act as a primer: threats to lead to negative affect, controls and responsibility as well as the matching tasks to positive affect.

The number in the third column shows the total number randomly assigned to a given activity once outliers were removed (see Section 1.4.1). The fourth column shows the median time taken to respond to the whole survey. The timings for Control, Threat and Responsibility are approximately the same. For None, the time increases reflecting the confusion which the formatting caused ⁴ . For the Long and Short matching task, participants took longer as expected: they had to read the description of the threat, the description of the control, and then match the two. With that in mind and based on time taken, therefore, we do not believe any of the tasks to have been more or less demanding. The final column indicates the RQ targeted with the task.

The intention with these tasks was to provide a positive or negative context for participants to respond to the PMT assertions: for instance, asking them to rank threats was expected to highlight vulnerability, whereas ranking controls might reduce the perceived vulnerability. Matching controls to threat would be expected to increase self-efficacy. These, therefore, target RQ4. Finally, asking participants to identify who they believed responsible for implementing controls would indicate whether they felt it their job to adopt appropriate protective behaviours (RQ5). These may be regarded as priming tasks ^{51, 52} (RQ4).

1.3.3.2 PMT questionnaire. Based on work reported by 53, six constructs from a PMT model were selected as shown in Table 4. According to the PMT, these are assumed to relate to the following latent variables as follows: Threat Appraisal is comprised of SUS and SEV; Coping Appraisal of COST, BENE and SELF; and Intention to Act of INTEN. To pace presentation in the online survey, they were presented in pairs: SUS and SEV appeared in a section titled “ How do you feel about cyber security now?”; COST and BENE in “ How do you feel about the security measures available to protect your information?”; and SELF and INTEN in “ Finally, how do you feel in general about threats to your information and what can be done to protect you?”; the construct labels were not exposed to participants. A six-point Likert scale was used to collect participant responses to each of the assertions (" Strongly Agree" to " Strongly Disagree"). In common with other such surveys, some items were presented with opposite valence: I believe that... became I don't believe that... (see, for instance, 54). The PMT-derived assertions targeted RQ6.

None of the individual items in the survey was mandatory. In consequence, there were occasions when responses were missing. For the PMT assertions, we removed the whole set of responses if any individual answers were missing ⁶ . From the original 801 original, removing incomplete responses in this way left 776 responses.

From experience with crowd sourcing survey responses, we know that participants will generally complete all questions within a relatively short period of time; in our case, all initial 500 participants had responded within a matter of hours ⁷ . The average time was 7 minutes 7 seconds (median duration: 5 minutes 52 seconds); the shortest time was 1 minute 12 seconds, the longest 53 minutes 29 seconds. We removed any responses which were returned in less than 210 seconds (3.5 minutes), which we felt was reasonable for this survey and these participants who were accustomed to responding to surveys. This left us with a total of 676 responses.

For Threats and Controls, an overall score for ranking purposes was calculated as follows. When a threat was ranked first (most concerning), it was given a score of 7; when ranked second, it was given a score of 6; down to when it was ranked as the least concerning, it was given a score of 1. For example, for Threat T1, it was ranked most concerning 15 times, ranked second 11 times, and ranked least concerning 8 times. The overall score of 379 in Table 5 was calculated as ((7 * 15)+(6 *11)+(5 * 11)+(4 * 14)+(3 * 19)+(2 * 16)+(1 * 8)). This process was repeated for the Control context.

1.4.2.1 Threats. Table 5 summarises the calculated overall rankings provided by private individuals assigned to this task. The highest threat (T3) was deemed to come from loss of a personal device (the threat event), leading to a breach of personal health data (the risk). Similarly, T4 refers to a breach at the service provider (in this case, a hospital) premises. There was less concern for threats relating to actions they could take (T7 and T2), or about secondary use of data (T1). Private individuals are therefore capable of assessing the relative importance of cybersecurity threats. RQ1 is therefore partially answered ⁸ .

1.4.2.2 Controls. Table 6 summarises the rankings assigned to the suggested controls when presented in isolation. Overall, participants regarded measures to protect their data wherever they are stored or transmitted (C1) as the most effective control. Controls restricting access (C5 and C4) were next. The infrastructure in the terms of data stored outside the data controller’s premises (C7) was regarded as least important. As with threats, private individuals were able to make decisions about cybersecurity controls. In terms of effectiveness, encryption is a reasonable control as a default mechanism to protect the data. Along with ranking threats ( Section 1.4.2.1), RQ1 is answered: private individuals in the UK can evaluate threats and controls in terms of perceived severity / effectiveness.

1.4.2.3 Matching threats and controls. In the second iteration of the survey, participants were asked to match a control to a threat, i.e., how would they mitigate the risk associated with a given threat? Participants could match the same control to different threats. Table 7 and Table 8 summarise the results using short and long descriptions respectively.

A Mann-Whitney U test on the totals in these two tables showed no significant differences based on the length of the control description when matched against a potential threat (Z = 23.00, p = 0.902).

Table 9 compares the selection of controls from the matching task with the selection of controls in isolation, that is when participants were asked to rank controls from the most effective to the least effective with no reference to threat (see Table 6 ¹¹ ). C1 ( Adding protection (encryption) to all medical data wherever it's stored, sent or viewed, so it can't be tampered with) has been ranked as most effective and matched most often to the threats presented in the survey. On its own, this may indicate that participants regarded this control as a catchall. However, since other rankings lower down in effectiveness are close across the matching task and ranking in isolation, this may suggest that participants are making informed decisions about cybersecurity controls. We therefore believe RQ2 has also been answered affirmatively.

1.4.2.4 Responsibility for implementing cybersecurity controls. Table 10 summarises private individual perceptions of who is responsible for implementing a given control. Looking at the final column (labelled ‘ Total’), not surprisingly since participants were asked to consider health data, it is the data controller (the NHS or the hospital) who is regarded as responsible for implementing controls in most cases. On the other hand, since data encryption at rest and in transit was regarded as the most effective control (see Table 9 and Control C1), presumably data subjects believe someone else to be responsible for the secure handling of their data.

Looking at the detail in Table 10 (the columns marked C1 to C7), there are two exceptions to the data controller having responsibility for all controls. First, in response to C4 ( Having an automatic lock on a phone or computer app, so my data stays safe even if the phone or computer is stolen), the individual who owns or manages the device is identified as responsible. Encouragingly, private individuals recognise their own obligation to protect their own devices. Secondly, for C6 ( Having threats identified continuously and counter measures automatically activated to help me manage my medical data) , private individuals identify the manufacturer or network provider as responsible. This makes sense a priori in that the developer could be expected to maintain cybersecurity standards on behalf of the end user. Further, it is common nowadays for software by default to install necessary updates whenever they become available and the device running the software is connected to the Internet.

There is some indication, therefore, that private individuals are making informed decisions about cybersecurity threats and controls. More importantly, that they may also decide who is responsible when it comes to implementing a control based on the specific context as illustrated in Table 10. RQ5 is therefore answered for this context (healthcare data).

Pooled responses to the PMT-type assertions ( 676 after initial screening for outliers as described) were quantified including reverse coded items marked with an asterisk (*) in Table 11 ( Strongly Agree as 6 to Strongly Disagree as 1; reverse coded items: Strongly Agree as 1 to Strongly Disagree as 6). The Likert scores were used to drive an exploratory factor analysis (EFA) ¹² . The rationale for factor analysis was to find structure within a data set as it might relate to the PMT model (see Figure 2).

Using all 676 response sets, a Principal Axis Factoring analysis with Oblimin rotation ¹⁶ and Kaiser normalisation yielded a determinant of 0.00037, Kaiser-Meyer-Olkin of 0.892, and a significant Bartlett’s test of sphericity result ( χ ² (276) = 6861.08, p<.001). This suggested the data were suitable for factor analysis. With that in mind, the analysis was repeated iteratively as follows: any items where correlations were ≤ |0.300| were removed; any extraction communalities below 0.300 and factor loadings less than |0.400| were all removed. After an initial analysis retaining factors with eigenvalues ≥ 1 and using the .40-.30-.20 rule ⁵⁵ and the scree plot, a 5 factor solution was generated ¹⁷ : Principal Axis Factoring with Oblimin rotation and Kaiser normalisation and rotation converging in 7 iterations, accounting for 68.61% of the variance. Table 11 summarises the solution; reliability of each construct ranges between 0.890 and 0.631, as measured with Cronbach’s α. The table shows the individual items, their extraction communalities, and factor loadings. Note that all five items for the Intention to Act construct (see Table 4) contribute to the model; this is not the case for the others.

Table 12 shows corresponding correlations between the factors. Correlations generally indicate reasonable separation between factors. Factors 1 ( Intention to Act) and 4 ( Severity) represent a possible exception. With a correlation of 0.501 suggesting the factors covary and so may effectively reflect similar constructs, this is not surprising though, since it is to be expected that as perceived Severity increases, so the intention to take action will increase. Excepting possibly Factor 4 ( Severity), all factors correlate with the Factor 5 (which we have labelled: Sources of Information). This suggests that this factor is significant in the decisions making leading to the Intention to Adopt security measures.

The subscale Cost is not represented in the 5-factor solution, which may be either because another party is assumed to take responsibility to implement controls or simply that it’s accepted as part and parcel of online activity (see below). Apart from Cost, therefore , the PMT model (see Section 1.2.3 is partially validated as expected: specifically, with reference to the original model (see Figure 2), private individuals do make some kind of Threat Appraisal (Factor 4, Severity) and corresponding Coping Appraisal (Factors 3, Benefit, and 2, Self-Efficacy), leading to an intention to do something to counter the threats (Factor 1, Intention to Act). Factor 5, which we have labelled Sources of Information in Table 11, does not fit the Cognitive Mediating Processes of the PMT model completely, however. In answer to RQ6, therefore, there is evidence that private individuals in the UK rely on additional Sources of Information when making decisions about implementing cybersecurity controls.

1.4.3.1 Freeform comments. There were 72 comments left including expressing thanks, pointing out issues with the survey format, and so forth. However, there was evidence that participants had given some thought independently to cybersecurity. From identifying who should be responsible:

Including recognising problems of visibility online:

Concerns about cost:

And about the field in general:

Participants are aware, of course, and had been primed if not by the ranking and matching tasks, then at least by the introductory passage on cybersecurity. But they do recognise that there are multiple factors associated with maintaining cybersecurity readiness. This includes:

Their comments seem to expand on Factor 5 ( Sources of Information) in the EFA model above ( Table 11): participants appreciate that something must be done, that there are multiple aspects to ensuring cybersecurity readiness, that this will be costly, but do not see themselves solely responsible to implement controls.

For each of the six constructs in Table 4, the total Likert response score for a given respondent was summed across all items to give a total score for that construct. Thus, for each participant responding to the four items under Susceptibility a total was derived by summing the individual responses for each of those four items. Parametric tests were undertaken to identify potential effects of these contexts on responses to the PMT-derived assertions. Given the assumptions associated with parametric tests, we first reviewed the frequency distributions for the total values for each construct and for Threat Appraisal, Coping Appraisal and the grand total for each participant. Although Susceptibility, Severity and Intention to Act showed a negative skew by eye, all other constructs approximated a normal distribution. Much has been written about violation of the assumption of a normal distribution (see, for example, 56). Because of the sample sizes here and an assumption based on the central limit theorem that with sufficient samples the distribution of sample means will tend towards a normal distribution, we decided to proceed with parametric tests. The assumptions of equal variance were individually tested as reported below.

1.4.4.1 Priming. To test if the priming tasks affected the total Likert scores for each construct, a MANOVA was run ¹² . First, responses from the original survey associated with matching controls and threats (labelled None) were removed, giving a revised total of (676 – 113 =) 563 responses. Box’s M (85.371, p=0.499) was not significant, indicating that there was no violation of the assumption of homogeneity of the variance-covariance matrices. Further, there was a significant difference in total Likert scores across the constructs depending on priming task: F(24,1930.40) = 1.594, Wilks’ λ = 0.934, p = 0.034, η ² = 0.017. Although significant, the effect is small accounting for around 1.7% of the variance.

1.4.4.2 Demographic category removal. When testing for any significant effects of context, and to avoid very large discrepancies in the samples within a given category, responses from Gender Identity (for Third gender… and Prefer not to say), from Age Group , (for 70 or over), and Expertise , (for I’m a novice…) were removed for the significance testing only. This left two groups for Gender Identity and Expertise, and three for Age Group.

1.4.4.2.1 Self-reported expertise

Although Box’s test was significant (M = 33.995, p=.040), differences between the total Likert scores associated with Self-Reported Expertise seemed to be significant ( F(6,543) = 8.245, Wilks’ λ = 0.916, p < 0.001, η ² = 0.084). From visual inspection of plots for the means associated with self-reported expertise, all Likert totals were higher for the experts than for those reporting that they were OK with technology…. Between-Subject tests, however, revealed the differences for the constructs COST (p < .001, η ² = .029), BENE (p = .045, η ² = .007), SELF (p<.001, η ² = .069) and INTEN (p < .001, η ² = .025) to be significant. These differences, therefore, account for at least .7 % (for Benefit) but no more than 6.9% (for Self-Efficacy) of the variance in the data.

1.4.4.2.2 Age

Box’s test was not significant (M = 54.960, p=.104). The differences between the total Likert scores associated with Age Group was significant ( F(12,1084) = 2.765, Wilks’ λ = 0.941, p = 0.001, η ² = 0.030). Visual inspection of the plots of the means associated with age group, for SUS, SEV, COST, and INTEN, the oldest group (50 to 69) reported the highest and the youngest (18 to 29) the lowest total Likert scores; for BENE and SELF, the oldest group reported scores lower than the middle age group. However, Between-Subject tests revealed that only SEV (p=.010, η ² = .017), COST (p=.001, η ² = .025), SELF (p=.031, η ² = .013), and INTEN (p=.004, η ² = .020) showed significant effects for age group. These differences account for between 1.3% ( Self-Efficacy) and 2.5% ( Cost) in the variance.

1.4.4.2.3 Gender identity

Box’s test was not significant (M = 29.526, p=.110). The differences between the total Likert scores associated with self-reported Gender Identity was significant ( F(6,543) = 8.330, Wilks’ λ = 0.916, p < 0.001, η ² = 0.084). From visual inspection of plots for self-reported expertise, Likert totals for construct SUS were higher for Females than for Males; for all other constructs, the opposite was true. Between-Subject tests, however, revealed the differences for the constructs SUS (p = .010, η ² = .012), COST (p < .001, η ² = .023), SELF (p<.001, η ² = .045) and INTEN (p = .020, η ² = .010) to be significant. Gender Identity appears to account for between 1% ( Intention to Act) and 4.5% ( Self-Efficacy) of the variance.

1.4.4.3 Does context affect responses? From Section 1.4.4.1, and assuming priming to influence affect (i.e., an emotional response ²⁹ ), there is some evidence to support RQ4: context does have a small effect (here about 1.7% of variance) on cybersecurity judgements based on the constructs of the PMT. From Section 1.4.4.2 and the associated subsections, there is further evidence to support RQ4: speaker characteristics also have a small effect (though no more than would account for 6.9% of the variance) on cybersecurity judgements. This suggests that the five factors identified in Section 1.4.3 are generally robust across contexts (including demographics), with other some minor influence from such factors.