Do They Accept or Resist Cybersecurity Measures? Development and Validation of the 13-Item Security Attitude Inventory (SA-13)

TL;DR

This paper introduces and validates SA-13, a concise survey tool for assessing cybersecurity attitudes, capturing engagement, attentiveness, resistance, and concern, with proven psychometric reliability and links to security behaviors.

Contribution

The paper develops and validates the SA-13 inventory, a novel, lightweight measure of cybersecurity attitudes with demonstrated reliability and behavioral relevance.

Findings

SA-13 exhibits desirable psychometric qualities.

Higher SA-13 scores correlate with increased security behaviors.

Subscales effectively measure distinct attitude dimensions.

Abstract

We present SA-13, the 13-item Security Attitude inventory. We develop and validate this assessment of cybersecurity attitudes by conducting an exploratory factor analysis, confirmatory factor analysis, and other tests with data from a U.S. Census-weighted Qualtrics panel (N=209). Beyond a core six indicators of Engagement with Security Measures (SA-Engagement, three items) and Attentiveness to Security Measures (SA-Attentiveness, three items), our SA-13 inventory adds indicators of Resistance to Security Measures (SA-Resistance, four items) and Concernedness with Improving Compliance (SA-Concernedness, three items). SA-13 and the subscales exhibit desirable psychometric qualities; and higher scores on SA-13 and on the SA-Engagement and SA-Attentiveness subscales are associated with higher scores for security behavior intention and for self-reported recent security behaviors. SA-13 and the subscales are useful for researchers and security awareness teams who need a lightweight survey measure of user security attitudes. The composite score of the 13 indicators provides a compact measurement of cybersecurity decisional balance.