# Combating Digital Exclusion with Cybersecurity Training – An Interview Study with Swedish Seniors

Joakim Kävrestad, David Lindvall, Marcus Nohlberg

► To cite this version:

Joakim Kävrestad, David Lindvall, Marcus Nohlberg. Combating Digital Exclusion with Cybersecurity Training – An Interview Study with Swedish Seniors. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.3-12, 10.1007/978-3-031-38530-8_1 . hal-05462117

HAL Id: hal-05462117

https://inria.hal.science/hal-05462117v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# Combating Digital Exclusion with Cybersecurity Training – An Interview Study with Swedish Seniors

Joakim Kävrestad<fnref n="1" />(✉), David Lindvall<fnref n="2" />, and Marcus Nohlberg<fnref n="1" />

**Abstract.** While rapid digitalization is beneficial for a majority of all people, some people struggle to adopt digital technology. Not only do these persons miss the potential benefits of digitalization, but they are also suffering from the fact that many services are no longer provided in a non-digital way. Previous research suggests that a lack of security literacy and awareness is one driving factor behind the digital exclusion for senior citizens. To that end, this research focuses on cybersecurity training for seniors. Seniors are here defined as those aged above 65. Using interviews with eight seniors, this research evaluates the use of contextual training in this user group. The rationale is that contextual training has been found to have positive results in other user groups. The results suggest that contextual cybersecurity training can increase cybersecurity awareness for senior citizens and be appreciated by the users. The participants also confirm previous research describing that cybersecurity concerns are a driving factor behind digital exclusion and that contextual cybersecurity training can make seniors more comfortable adopting digital services.

**Keywords:** cybersecurity · awareness · senior · digital · exclusion · contextual · training

## 1 Introduction

Rapid digitalization creates a society where more and more services are becoming increasingly available to a wide population [1]. However, some population groups struggle to adopt those digital services, and senior citizens make one such group [2]. Curiously, many services that are increasing their availability through digitalization, such as healthcare and public service, have senior citizens as one of their main target groups [3]. Furthermore, as clearly shown during the COVID-19 pandemic, being able to benefit from digital services means improved access to everything from shopping and communication to entertainment. In contrast, not being able to benefit from digital services leads to digital exclusion, which can be an equality problem [4].

<footnote n="1">¹ University of Skövde, Skövde, Sweden</footnote>

<footnote>{joakim.kavrestad,marcus.nohlberg}@his.se</footnote>

<footnote n="2">² Skövde Municipality, Skövde, Sweden</footnote>

<footnote>david.lindvall@skovde.se</footnote>
Holgersson and Söderström [3] present fear of using technology as one factor that prohibits seniors from adopting technology. That is further elaborated on by Holgersson, Kävrestad, and Nohlberg [5], who suggest that a central fear is a fear of being exposed to frauds and other cybercrimes and that those fears can have a paralyzing effect. That means that the mere fear of what might happen online can prohibit senior citizens from even trying to use online services. To make matters worse, previous research has shown that seniors are a user group that is often specifically targeted by online criminals [6, 7]. Alwanain [8] show that seniors are a common target group for online criminals and attributes that to a lack of security awareness. Alwanain [8] further show that an increased level of awareness will lead to lower susceptibility to phishing. A similar view is presented by Holgersson, Kävrestad, and Nohlberg [5], who suggest that cybersecurity training should be an integral part of efforts toward digital inclusion.

As demonstrated by Aldawood and Skinner [9] and Hu, Hsu, and Zhou [10], there is a multitude of approaches for cybersecurity training which can be roughly divided as follows:

* Physical training where an instructor teaches participants, for instance, classroom training.

* Computer Based Training where participants access training on demand, for instance, online videos or gamified training.

* Contextual training where users are provided with training when they are about to do something, for instance, phishing training that is provided to users when they open their inboxes.

Previous research suggests that contextual training can be an effective way to train users in cybersecurity [11–13]. An explanation can be that such training puts security on top of the user’s mind and that it feels relevant to the user since it is presented in a situation where it is of direct relevance. To the best of our knowledge, however, no previous research focuses on contextual cybersecurity training for senior citizens. To that end, this research aims to research senior citizens’ perceptions of contextual cybersecurity training.

Focusing on user perception is important since previous research shows that user perception is an important precursor to user adoption [14, 15]. Furthermore, user satisfaction will lead to user stickiness, meaning that positive users will continue to use a given training tool [16]. Consequently, while user perception of cybersecurity training can not be argued to equal secure behaviour, it is a crucial enabler for behaviour.

## 2 Methodology

Semi-structured interviews were selected for this study. The rationale was that a qualitative approach would generate data-rich answers that would allow for a better understanding of the topic than a survey design [17]. Furthermore, the method allowed the participants to experience a contextual cybersecurity training tool during the interviews. The interviews were transcribed and analyzed using thematic coding [18].

To access the intended target group, a purposive sampling technique was used [19]. For this research, participants aged 65 or older, living in the city of Skövde with access
to a personal computer and internet were included. Participants were invited via a local municipality project, and eight participants, three male and five female, agreed to participate. An overview of the participants is presented in Table 1. All participants signed an informed consent form before the interview. Ethical approval of the research was not need in accordance with Vetenskapsrådet [20].

<table><caption>**Table 1.** Participant description. Literacy and usage are self-reported.</caption><thead><tr><td>Part.</td><td>Age</td><td>Gender</td><td>Computer literacy</td><td>Current computer usage</td></tr></thead><tbody><tr><td>1</td><td>83</td><td>Female</td><td>Passable</td><td>Gaming, Social media, mail, news</td></tr><tr><td>2</td><td>80</td><td>Female</td><td>Bad</td><td>Banking</td></tr><tr><td>3</td><td>70</td><td>Male</td><td>Pretty good</td><td>News, banking, excel</td></tr><tr><td>4</td><td>65</td><td>Female</td><td>Good</td><td>Social media</td></tr><tr><td>5</td><td>70</td><td>Male</td><td>Not very advanced</td><td>Banking</td></tr><tr><td>6</td><td>72</td><td>Male</td><td>Overall good</td><td>Business and social media</td></tr><tr><td>7</td><td>65</td><td>Female</td><td>Very good</td><td>Work, banking, social media, googling, shopping</td></tr><tr><td>8</td><td>68</td><td>Female</td><td>Good</td><td>Banking, news, social media</td></tr></tbody></table>

The interviews were divided into two parts. In the first part, the participants were asked general questions about their understanding and experience of phishing. They were then subjected to contextual training using a tool called WebSec Coach<fnref n="1" />. WebSec Coach is a training tool that provides users with training on passwords, phishing, fraud and fake news detection and is developed according to a method called Context-Based Micro-Training (CBMT) [21]. This research only used the phishing training, which appears to users in the upper left corner of the screen when they open an inbox, as shown in Fig. 1. Following the WebSec Coach training, the participants were asked questions about their perception of it. The research process is visualized in Fig. 2.

## 3 Results

The interviews were recorded and then transcribed. The transcriptions were analyzed using a thematic approach and four pre-established themes:

* Perception of phishing before and after using WebSec Coach.

* Their own security awareness before and after using WebSec Coach.

* Perception of WebSec Coach.

* Perception of contextual training in general.

The remainder of this section will present the results in each theme.

<footnote n="1">¹ https://chrome.google.com/webstore/detail/websec-coach/fppabiaolagdpchoicgfikcjnilbdkl?hl=sv.</footnote>
<figure><img src="image_4.png" /><figcaption>Fig. 1. Demonstration of WebSec Coach</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>Fig. 2. Research process ovreview</figcaption></figure>
## 3.1 Phishing

The questions in the phishing theme were intended to reveal if the participants knew what phishing was and if they had encountered it. They further sought to understand the participants' perception of phishing after using WebSec coach. Table 2 provides a summary of the interview responses.

<table><caption>**Table 2.** Summary of results for the theme phishing</caption><thead><tr><td>Sub-Theme</td><td>Answers</td></tr></thead><tbody><tr><td>Phishing knowledge</td><td>4/8 participants knew the term phishing. The other four did not know the term but recognized what phishing was when it was described to them</td></tr><tr><td>Victimization</td><td>All but one participant explicitly stated that they had received phishing mail, and two had been tricked. Furthermore, another four knew friends and family who had been tricked by phishing. In all cases, monetary loss and sadness/despair were the effects of phishing</td></tr><tr><td>Perception after training</td><td>All participants state that they now know more about phishing and know what to look for. 6/8 describe the training as an eye-opener in the sense that they learned that there is more to think about than they previously knew. 7/8 described that they would pay more attention to links and/or addresses in the future</td></tr></tbody></table>

## 3.2 Security Awareness

The intention of the security awareness theme was to analyze the participants perceived security awareness before and after using WebSec Coach. The questions also covered the possible connection between digital exclusion and cybersecurity awareness. The interview responses are summarized in Table 3.

## 3.3 WebSec Coach

This theme intended to capture the participants' perception of the WebSec coach tool itself. The sub-themes and results are presented in Table 4.

## 3.4 Contextual Training

The final theme considered contextual training in general. It intended to capture the participants' perception of contextual training both for learning about phishing and other cybersecurity topics. The sub-themes and results are presented in Table 5.
<table><caption>**Table 3.** Summary of results for the theme cybersecurity awareness</caption><thead><tr><td>Sub-Theme</td><td>Answers</td></tr></thead><tbody><tr><td>Perceived security awareness before training</td><td>2/8 participants state that they worry about cyber threats, while 6/8 do not. Most (6/8) of the participants state that they exercise caution when using computers and 4/8 rely on security software to keep them secure. Only 2/8 of participants state that they do not think about security at all</td></tr><tr><td>Perceived change in security awareness after training</td><td>All participants expressed an increased security awareness after using WebSec coach. 3/8 participants said that the training could lead to reduced anxiety online. 6/8 participants describe that they learned new things, leading to an increased understanding of what they need to be cautious about</td></tr><tr><td>Cybersecurity and digital exclusion</td><td>All participants believe that increased cybersecurity knowledge can reduce digital exclusion. 7/8 describe that increased security knowledge can make people feel more comfortable using the internet. 2/8 mention that they know several seniors who are afraid to use computers and therefore avoid doing so</td></tr></tbody></table>

<table><caption>**Table 4.** Summary of results for the theme WebSec coach</caption><thead><tr><td>Sub-theme</td><td>Answers</td></tr></thead><tbody><tr><td>General perception of WebSec coach</td><td>The participants provided an overall positive view of WebSec coach. All participants stated that it was user-friendly, easy to understand and added an extra layer of security. The tool contains a text-to-speech function which 4/8 of participants appreciated. Further, 2/8 participants mentioned that it is important that the tool is kept up-to-date</td></tr><tr><td>Attitude towards using WebSec coach</td><td>All participants were positive towards using WebSec coach on their own computers</td></tr><tr><td>Perception of other seniors' willingness to use WebSec coach</td><td>All participants believe that many seniors would be interested in using the tool. However, they suggest that it is important to find a way to inform about it and provide help with installing it</td></tr></tbody></table>
<table><caption>**Table 5.** Summary of results for the theme contextual training</caption><thead><tr><td>Sub-theme</td><td>Answers</td></tr></thead><tbody><tr><td>Increased knowledge of phishing</td><td>All participants described increased knowledge about phishing after using the training. The participants further stated an increased interest in knowing about phishing, and four participants mentioned that it was good to have brief, easy-to-understand information</td></tr><tr><td>Warning function</td><td>5/8 participants explicitly stated that it is good to have a warning function that warns you when something bad might happen. Further, all participants described that the tool made them more aware of security issues</td></tr><tr><td>General perception</td><td>At a general level, all participants were positive towards using contextual training to learn about cybersecurity. In addition to the positive views on the warning functions, all participants described that it is good to receive brief information which is easy to digest. 6/8 explicitly stated that it is good to receive practical tips on how to act in specific situations</td></tr></tbody></table>

# 4 Conclusions

The aim of this research was to research senior citizens' perception of contextual cybersecurity training. The aim was met using an interview study where participants were subjected to contextual cybersecurity training using a tool called WebSec coach. At a high level, the results suggest that the participants are positive towards using contextual training to receive cybersecurity information. The participants described that they and other seniors would be likely to use the tool on their own computers. The research also shows that the participants' level of security awareness increased after using the tool. After participating in the research, they also described an increased interest in learning more about phishing. In conclusion, this research suggests that contextual training can be a good way to educate senior citizens about cybersecurity. The remainder of this section will, in turn, elaborate on this research's results, contributions, and limitations before outlining suggestions for future research.

## 4.1 Results Discussion

At its core, contextual training means that cybersecurity training is presented to users when they are in a situation where that training is of direct relevance [11, 12]. The intention is to increase the user's awareness of a specific security risk when that security risk is relevant. While the security benefits can be great, a previously reported risk of this approach can be that perceived usability is lowered because the user's workflow is disrupted [22]. Interestingly, none of the participants in this research perceived that aspect of contextual training as negative. Rather, providing a warning was mentioned by 5/8 participants as a positive function of the provided training. The participants further
liked that the provided training was short and easy to understand, which they described as seldom the case with security information.

Previous research describes that fear of online threats may prevent senior citizens from using technology and lead to digital exclusion [5]. Most of the participants in this research describe that they, or people they know, had been the victims of phishing attacks. 2/8 participants also mention that they know seniors who chose not to use computers because of fears, and in that way this research supports the results presented by Holgersson, Kävrestad, and Nohlberg [5]. 50% of the participants in this research describe that they are less worried about using the internet now than before the training. All participants also state that they believe that increased knowledge about cybersecurity will make more seniors feel comfortable using digital services. In that regard, this research suggests that cybersecurity training for senior citizens can help reduce digital exclusion.

## 4.2 Contributions

Previous research evaluating contextual cybersecurity training for senior citizens is scarce, and the present research fills that gap by contributing knowledge about how senior citizens perceive such training. It builds on the research by Holgersson, Kävrestad, and Nohlberg [5] and confirms that anxiety and fear of security threats can be contributing factors to digital exclusion. On that note, this research suggests that contextual training can empower senior citizens to feel comfortable using digital services. Ng et al. [23] argues that using digital services independently is important since asking for help may imply additional risk, since the helper may exploit the person who asks for assistance. Interestingly, previous research shows that senior users are interested in protecting themselves [24]. The present research provides a possible direction on how.

Practically, this research describes a ready-to-use cybersecurity training tool usable for senior citizens. However, the research suggests that an important challenge is to support those seniors in starting to use the tool. A given conundrum is that using digital services to inform users who are in digital exclusion does not work. Participants in this research suggested finding physical venues where seniors can be given assistance with installing the tool and that such events can take place in cooperation with municipalities or organizations for seniors.

## 4.3 Limitations and Future Work

This research included senior citizens who all had access to a computer and the internet. They were all users of digital services to some extent. For that reason, they are not a representative sample of senior citizens. However, we argue that previous experience of digital services makes them an information-rich population which is able to discuss phishing and security issues. Nevertheless, future research targeting persons who are not using digital services is needed to fully understand the problem of digital exclusion.

It can also be noted that the sample size of eight participants makes it difficult to generalize the results of this research. Nevertheless, the interviews provided information-rich responses and made it possible to demonstrate the cybersecurity training tool during the interviews. A reasonable continuation of this work would be to research similar
research questions using a methodology that allows for a bigger sample, such as a
survey.

References

1. OECD, How Life in the Digital Age? (2019)

2. Gulbrandsen, K.S., Sheehan, M.: Social exclusion as human insecurity: a human cybersecurity framework applied to the European high north. In: Salminen, M., Zojer, G., Hossain, K. (eds.) Digitalisation and Human Security, pp. 113–140. Springer, Heidelberg (2020). https://doi.org/10.1007/978-3-030-48070-7_5

3. Holgersson, J., Söderström, E.: Bridging the gap: exploring elderly citizens’ perceptions of digital exclusion. In: 27th European Conference on Information Systems (ECIS), Stockholm & Uppsala, Sweden, 8–14 June 2019. Association for Information Systems (2019)

4. Aissaoui, N.: The digital divide: a literature review and some directions for future research in light of COVID-19. Global Knowledge, Memory and Communication (2021)

5. Holgersson, J., Kävrestad, J., Nohlberg, M.: Cybersecurity and digital exclusion of seniors: what do they fear? In: Furnell, S., Clarke, N. (eds.) Human Aspects of Information Security and Assurance. HAISA 2021. IFIP Advances in Information and Communication Technology, vol. 613, pp. 12–21. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-81111-2_2

6. Trautman, L.J., Hussein, M., Opara, E.U., Molesky, M.J., Rahman, S.: Posted: no phishing (2020)

7. Zulkipli, N.H.N.: Synthesizing cybersecurity issues and challenges for the elderly. Turk. J. Comput. Math. Educ. (TURCOMAT) **12**(5), 1775–1781 (2021)

8. Alwanain, M.I.: Phishing awareness and elderly users in social media. Int. J. Comput. Sci. Netw. Secur. **20**(9), 114–119 (2020)

9. Aldawood, H., Skinner, G.: Educating and raising awareness on cyber security social engineering: a literature review. In: Proceedings of 2018 IEEE International Conference on Teaching, Assessment, and Learning for Engineering, pp. 62–68. IEEE (2018)

10. Hu, S., Hsu, C., Zhou, Z.: Security education, training, and awareness programs: literature review. J. Comput. Inf. Syst. **62**(4), 752–764 (2022)

11. Sharma, K., Zhan, X., Nah, F.F.-H., Siau, K., Cheng, M.X.: Impact of digital nudging on information security behavior: an experimental study on framing and priming in cybersecurity. Organ. Cybersecur. J.: Pract. Process People **1**(1) (2021)

12. Xiong, A., Proctor, R.W., Yang, W., Li, N.: Embedding training within warnings improves skills of identifying phishing webpages. Hum. Factors **61**(4), 577–595 (2019)

13. Kumaraguru, P., Rhee, Y., Acquisti, A., Cranor, L.F., Hong, J., Nunge, E.: Protecting people from phishing: the design and evaluation of an embedded training email system. In: Proceedings of ACM CHI 2007 Conference on Human Factors in Computing Systems (2007)

14. Davis, F.D.: Perceived usefulness, perceived ease of use, and user acceptance of information technology. MIS Q. **13**(3), 319–340 (1989)

15. Jin, G., Tu, M., Kim, T.-H., Heffron, J., White, J.: Game based cybersecurity training for high school students. In: Proceedings of the 49th ACM Technical Symposium on Computer Science Education (2018)

16. Ma, S.F., Zhang, S.X., Li, G., Wu, Y.: Exploring information security education on social media use Perspective of uses and gratifications theory. Aslib J. Inf. Manag. **71**(5), 618–636 (2019)

17. Oates, B.J., Griffiths, M., McLean, R.: Researching Information Systems and Computing. Sage (2022)
18. Braun, V., Clarke, V.: Using thematic analysis in psychology. Qual. Res. Psychol. **3**(2), 77–101 (2006)

19. Etikan, I., Musa, S.A., Alkassim, R.S.: Comparison of convenience sampling and purposive sampling. Am. J. Theor. Appl. Stat. **5**(1), 1–4 (2016)

20. Vetenskapsrådet, Good Research Practice (2017)

21. Kävrestad, J., Hagberg, A., Nohlberg, M., Rambusch, J., Roos, R., Furnell, S.: Evaluation of contextual and game-based training for phishing detection. Future Internet **14**(4), 104 (2022)

22. Kävrestad, J., Friman, E., Bohlander, J., Nohlberg, M.: Can Johnny actually like security training? In: Proceedings of the 6th International Workshop on Socio-Technical Perspective in IS development. CEUR-WS (2020)

23. Ng, I.Y., Sun, L.S., Pang, N., Lim, D., Soh, G.: From digital exclusion to universal digital access in Singapore. Faculty of Arts and Social Sciences, National University of Singapore, Singapore (2021)

24. Morrison, B., Coventry, L., Briggs, P.: How do older adults feel about engaging with cyber-security? Hum. Behav. Emerg. Technol. **3**(5), 1033–1049 (2021)