# Survey of Users' Willingness to Adopt and Pay for
Cybersecurity Training

Joakim Kävrestad, Martin Gellerstedt, Marcus Nohlberg, Jana Rambusch

► To cite this version:

Joakim Kävrestad, Martin Gellerstedt, Marcus Nohlberg, Jana Rambusch. Survey of Users' Willingness to Adopt and Pay for Cybersecurity Training. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.14-23, 10.1007/978-3-031-12172-2_2. hal-05324932

HAL Id: hal-05324932

https://inria.hal.science/hal-05324932v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Survey of Users' Willingness to Adopt and Pay for Cybersecurity Training

Joakim Kävrestad✉, Martin Gellerstedt✉, Marcus Nohlberg✉, and Jana Rambusch

University of Skövde, Skövde, Sweden

{joakim.kavrestad, martin.gellerstedt, marcus.nohlberg, jana.rambusch}@his.se

**Abstract.** The importance of user behaviour in the cybersecurity domain is widely acknowledged. Users face cyberthreats such as phishing and fraud daily, both at work and in their private use of technology. Using training interventions to improve users' knowledge, awareness, and behaviour is a widely accepted approach to improving the security posture of users. Research into cybersecurity training has traditionally assumed that users are provided such training as members of an organization. However, users in their private capacity are expected to cater for their own security. This research addresses this gap with a survey where 1437 Swedish adults participated. Willingness to adopt and pay for different cybersecurity training types was measured. The included types were; training delivered to users in a context where the training is of direct relevance, eLearning and game-based training. The participants were most willing to adopt and pay for contextual training, while eLearning was the second most favoured training type. We also measured if willingness to pay and adopt cybersecurity training was impacted by the participant's worry about various cyber threats. Surprisingly, no meaningful correlation was found, suggesting that something else than worry mediates willingness to adopt and pay for cybersecurity training.

**Keywords:** Cybersecurity · Training · User · Adoption · Willingness · Pay

## 1 Introduction

Cybersecurity training for end-users is an integral part of common frameworks and standards covering organizational cybersecurity operations [1, 2]. That is unsurprising given the many research publications which suggest cybersecurity training as a crucial part of promoting secure user behaviour [3–5]. Since user behaviour has long been acknowledged as one of, if not the, biggest cybersecurity risks, using training measures to support secure behaviour is reasonable [6, 7]. Indeed, several different options for cybersecurity training have been proposed. A broad classification of those is physical and digital efforts [8]. This research focuses on digital training efforts, which are argued to be more scalable and cost-efficient than lectures or other in-person training [9, 10]. While there are a plethora of different options for digital cybersecurity training methods, they can be grouped as follows [3, 8, 11]:
* E-learning platforms that users access on-demand or where the material is broadcasted to users at regular intervals.

* Game-based training where game mechanics are used for teaching. That includes competitive games, single-player story-based games, quizzes and more.

* Contextual training where users are provided with training when they encounter situations that pose an elevated cybersecurity risk or experience such situations as part of a simulation.

Previous research has shown that those approaches can have beneficial results in different circumstances [11]. As exemplified by [12, 13], those evaluations have assumed that cybersecurity training is to be implemented for users of an organization. To the best of our knowledge, no research evaluating cybersecurity training methods for users in their private capacity has been conducted. That is a gap that this research intends to fill, and the motivation is twofold. First, users in their private capacity are not safeguarded by other security mechanism provided to users in an organization. Consequently, the responsibility for ensuring private cybersecurity falls on the user alone. Second, without organizational support, a private user must seek out, and possibly pay for, cybersecurity measures of their own. As such, research into private users' willingness to adopt and pay for cybersecurity training is much needed. Three research questions have been developed for this research:

1. To what extent are private users willing to adopt the different types of cybersecurity training?

2. To what extent are private users willing to pay for the different types of cybersecurity training?

3. Does worrying about cyber threats impact private users' willingness to adopt or pay for cybersecurity training?

This research seeks to understand private users' willingness to adopt and pay for the different types of cybersecurity training. The rationale is that cybersecurity training can only be effective if users adopt it [14]. Further, willingness to pay becomes important when private users, in contrast to users in an organization, need to procure cybersecurity training for themselves. Finally, we assume that users who perceive cyberthreats as harmful are more willing to pay for protective measures than users who do not. The third research question tests that assumption. The research contributes to the scientific community by increasing the understanding of private users' willingness to use and pay for cybersecurity training. These insights can guide future research efforts. The research is also practically usable for organizations seeking to develop cybersecurity training products for the private market. They can also guide national and international efforts to raise national cybersecurity awareness, which is an emergent challenge [15, 16].

The remainder of this paper will, in turn, describe the method used before outlining the results and conclusions of this research.
## 2 Methodology

This research was conducted as a web-based survey using a web panel located in Sweden, which includes Swedish users. Following an informed consent and demographic questions, the survey included four sections. Sections one to three measured willingness to adopt (WTA) and willingness to pay (WTP) for the categories of cybersecurity training. WTA was measured using a Likert scale [17] with five statements that the participant responded to on a six-pointed scale ranging from “1-do not agree at all” to “6-fully agree”. WTP was measured by asking the respondents if they would be willing to pay for cybersecurity training and, in that case, what amount. While WTP can be measured differently, directly asking the participants provides a simple and easily comparative metric [18]. The survey ended with a Likert scale developed to measure the participants’ worry about cyberthreats. It contained six statements that the participant responded to on a six-pointed scale ranging from “1-do not agree at all” to “6-fully agree”. The statements included in the scales are presented in the results section to preserve space.

As suggested by [19], the research group drafted the survey, which was then evaluated by an external survey professional before it was pilot tested by 34 participants who were asked to complete the survey and provide feedback on the questions. Following the pilot, 1437 participants were recruited using a web panel provided by Webropol<fnref n="1" />. That allowed for the use of a stratified sampling approach [20]. Strata were created based on gender, age and place of living to ensure a sample representative of the Swedish adult population.

For data analysis, an index value was created for each Likert scale. The index was calculated as the mean answer of all items on the scale. The indexes reflect the participants’ overall WTA for each respective cybersecurity training type and the participants’ overall worry about cybersecurity threats. Cronbach’s Alpha was computed to measure the internal consistency of each scale, and 0.70 was accepted as the threshold for acceptance of a scale’s internal consistency, as suggested by [21]. Repeated measures ANOVA was used to identify differences between the WTA indexes, as suggested by [22], and the Friedman test was used as a non-parametric alternative for ordinal data. Pearson’s correlation coefficient [23] was calculated to identify correlations between WTA and WTP for the different training types and the worry index. The conventional significance level of 95% was adopted in this research.

The data set includes 1437 participants, and the demographic composition of the sample is shown in Table 1. As shown in Table 1, the gender and age distribution in the sample is roughly equal, but one age group, 28–37, is slightly overrepresented.

## 3 Results

Following the demographic questions, the participants were presented with a description of a cybersecurity training type and then asked to respond to the WTA and WTP questions. That was repeated for all three cybersecurity training types. Table 2 shows the statements used in the WTA scale, mean response values, mean index value and scale

<footnote n="1">¹ https://webropol.se/.</footnote>
<table><caption>**Table 1.** Age and gender distribution in the data sample.</caption><thead><tr><th>Variable</th><th>Answer</th><th>Proportion</th></tr></thead><tbody><tr><td rowspan="3">Gender</td><td>Male</td><td>48.2%</td></tr><tr><td>Female</td><td>51.3%</td></tr><tr><td>Other/Prefer not to say</td><td>0.5%</td></tr><tr><td rowspan="7">Age</td><td>18–27</td><td>15.5%</td></tr><tr><td>28–37</td><td>20.2%</td></tr><tr><td>38–47</td><td>12.6%</td></tr><tr><td>48–57</td><td>14.1%</td></tr><tr><td>58–67</td><td>18.0%</td></tr><tr><td>68 or above</td><td>19.0%</td></tr><tr><td>Prefer not to say</td><td>0.6%</td></tr></tbody></table>

Alpha. Table 2 also reports the proportion of respondents who hand an index value of at least 4. At seen in Table 2, the answer values for the individual statements are systemat- ically highest for contextual training, followed by eLearning and Game-based with the lowest score. The same tendency is seen for the index and reflected by the proportion of respondents with an index value of at least 4. Moreover, 71% of respondents had an index value over 4 for at least one of the included training types.

<table><caption>**Table 2.** Descriptive statistics for WTA scales. Note that the responses for statement 3 were inverted when computing the index and that the statements are translated from Swedish.</caption><thead><tr><th>Statement</th><th>Contextual</th><th>eLearning</th><th>Game-based</th></tr></thead><tbody><tr><td>I would use it if it was recommended by someone I trust</td><td>4.37</td><td>3.73</td><td>2.91</td></tr><tr><td>I would use it if a trusted organization recommended it</td><td>4.10</td><td>3.45</td><td>2.71</td></tr><tr><td>I would not use the product at all</td><td>2.37</td><td>2.92</td><td>3.50</td></tr><tr><td>I would actively search for it if I heard about it in news media, social media, etc</td><td>3.26</td><td>2.81</td><td>2.34</td></tr><tr><td>I would use the product if it came with a newly bought computer or cell phone</td><td>4.38</td><td>3.66</td><td>2.87</td></tr><tr><td>INDEX</td><td>4.15</td><td>3.55</td><td>2.87</td></tr><tr><td>Proportion of respondents with an index of at least 4</td><td>62%</td><td>39%</td><td>27%</td></tr><tr><td>Alpha (Acceptance threshold = 0.7)</td><td>0.76</td><td>0.86</td><td>0.93</td></tr></tbody></table>

A repeated-measures ANOVA with Greenhouse-Geisser correction was used to test if the tendency displayed in Table 2 was statistically significant. Greenhouse-Geisser
correction was used since P = 0.000 for Mauchly's test of Sphericity. ANOVA tests for differences in mean values over two or more groups. The ANOVA showed a statistically significant difference (F = 668,945, P = 0.000). Post-hoc analysis with Bonferroni correction was used to test for pairwise differences and confirmed that WTA for contextual training was higher than the WTA for both eLearning and game-based training. The WTA for eLearning was higher than the WTA for game-based training. 95% Confidence intervals of the differences are reported in Table 3.

<table><caption>**Table 3.** Confidence intervals for the difference in WTA between cybersecurity training types.</caption><thead><tr><td>Pairwise comparison</td><td>Confidence interval</td></tr></thead><tbody><tr><td>Contextual – eLearning</td><td>0.535–0.672</td></tr><tr><td>Contextual – game-based</td><td>1.189–1.376</td></tr><tr><td>eLearning – game-based</td><td>0.590–0.767</td></tr></tbody></table>

WTP was measured by asking the participants if they would be willing to pay for the three types of cybersecurity training. The answer options and results are presented in Table 4. Note that only participants who reported being willing to pay were asked to submit their maximum price.

<table><caption>**Table 4.** Results for the WTP question. 10 SEK is ~1 EUR. * participants unwilling to pay were treated as 0.</caption><thead><tr><td>Statement</td><td>Contextual</td><td>eLearning</td><td>Game-based</td></tr></thead><tbody><tr><td>I would only use it if it was free</td><td>61.2%</td><td>67.8%</td><td>52.9%</td></tr><tr><td>I would not use it at all</td><td>8.9%</td><td>18.1%</td><td>38.0%</td></tr><tr><td>I would consider paying for it</td><td>29.9%</td><td>14.1%</td><td>9.1%</td></tr><tr><td>Mean maximum price (only participants willing to pay)</td><td>505 SEK</td><td>543 SEK</td><td>522 SEK</td></tr><tr><td>Mean maximum price (all participants) *</td><td>151 SEK</td><td>77 SEK</td><td>48 SEK</td></tr></tbody></table>

The general tendency shown in Table 4 is that WTP is highest for contextual training, followed by eLearning and Game-based last. The Friedman test confirmed that this tendency was statistically significant (P = 0.000).

The worry question asked the participant to reply to six statements about their worry about different cyberthreats by selecting how well they agreed with each statement on a scale from “1-do not agree at all” to “6-fully agree”. An index was computed by calculating each participant’s mean response value. The mean response values for the individual statements and the index are presented in Table 5. The Alpha for the scale was 0.89. It is also noticeable that the top concern was identify theft, while the least worrying statement was being conned for money.
<table><caption>**Table 5.** Data reflecting the participants' worry about cyberthreats</caption><thead><tr><td>Statement</td><td>Mean</td></tr></thead><tbody><tr><td>I worry about being conned for money on the Internet</td><td>3.05</td></tr><tr><td>I worry that my opinions can be registered without my knowledge</td><td>3.05</td></tr><tr><td>I worry that my behaviour is tracked without my knowledge and used to show ads</td><td>3.34</td></tr><tr><td>I worry about my phone or computer being hacked or getting malware</td><td>3.42</td></tr><tr><td>I worry about someone stealing my identity on the Internet</td><td>3.45</td></tr><tr><td>I worry about someone using my passwords</td><td>3.48</td></tr><tr><td>INDEX</td><td>3.30</td></tr></tbody></table>

The relationship between worry about cyberthreats, and WTA and WTP for the different types of cybersecurity training were analysed using Pearson's correlation coefficient. All coefficients are statistically significant and are presented in Table 6.

<table><caption>**Table 6.** Correlation coefficients</caption><thead><tr><td></td><td>Contextual WTA</td><td>Contextual WTP</td><td>eLearning WTA</td><td>eLearning WTP</td><td>Game-based WTA</td><td>Game-based WTP</td></tr></thead><tbody><tr><td>Contextual WTA</td><td>—</td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Contextual WTP</td><td>0.453</td><td>—</td><td></td><td></td><td></td><td></td></tr><tr><td>eLearning WTA</td><td>0.533</td><td>0.267</td><td>—</td><td></td><td></td><td></td></tr><tr><td>eLearning WTP</td><td>0.277</td><td>0.508</td><td>0.528</td><td>—</td><td></td><td></td></tr><tr><td>Game-based WTA</td><td>0.282</td><td>0.108</td><td>0.450</td><td>0.228</td><td>—</td><td></td></tr><tr><td>Game-based WTP</td><td>0.175</td><td>0.255</td><td>0.283</td><td>0.376</td><td>0.675</td><td>—</td></tr><tr><td>Worry</td><td>0.205</td><td>0.078</td><td>0.217</td><td>0.109</td><td>.150</td><td>0.101</td></tr></tbody></table>

A correlation coefficient is a number between 1 and -1. A positive number means a positive correlation, and a negative number means a negative correlation. A coefficient closer to zero signifies a weaker correlation. Correlations below 0.29 are considered very low, correlations between 0.30 and 0.49 are low and correlations between 0.50 and 0.69 are moderate [23]. Thus, while significant, the relationship between worry and WTA and WTP for the cybersecurity training types is weak. A moderate correlation between contextual training and eLearning is found, while the correlations between game-based and eLearning, and contextual and game-based are weak. It can also be seen that there
is a moderate correlation between WTA and WTP within the cybersecurity training methods.

# 4 Discussion

This section ends the paper with a discussion on the results in relation to the research questions, the contributions made by this research and an outline of limitations and future work.

## 4.1 Answering the Research Questions

The first research question was *To what extent are private users willing to adopt different types of cybersecurity training?* A Likert scale was used to compute an index value that measured the participants' willingness to adopt (WTA) contextual, eLearning and game-based cybersecurity training. Repeated measure ANOVA showed a significant difference in WTA between the cybersecurity training types. Post-hoc tests showed that contextual training had the highest WTA, with eLearning in second place and game-based third. Those results were emphasized by showing that the proportion of participants who had a positive WTA for contextual training was 62%. In comparison, the corresponding eLearning and game-based numbers were 39% and 27%. In response to the research question, two conclusions can be made. First, 70% of the participants demonstrate a positive WTA towards at least one cybersecurity training method. Second, contextual training has the highest WTA scores. The first implication is that contextual training is more likely to be adopted by a large userbase than eLearning or game-based initiatives. Second, a large proportion of the respondents have a WTA lower than 4, suggesting a low interest in cybersecurity training. That would suggest that, even with freely available training, reaching the entire population is difficult, and other measures to support secure behaviour are needed.

The second research question, *To what extent are private users willing to pay for different types of cybersecurity training?*, was addressed by asking the participants if and what they could consider paying for the different types of training. At a glance, the results confirmed the results for the WTA questions by showing that more participants are willing to pay for contextual training compared to eLearning or game-based training. Likewise, the lowest proportion of participants who would not consider free training was found for contextual training, followed by eLearning and game-based training. However, the mean amount that users that were willing to pay would spend for cybersecurity training was relatively equal between the training types. To conclude, the maximum price for the three training types is similar, but the number of participants willing to pay for training differs significantly between the training types. Thus, the overall willingness to pay (WTP) is highest for contextual training, followed by eLearning and game-based training last.

The last research question was *Does worrying about cyber threats impact private users' willingness to adopt or pay for cybersecurity training?* It was motivated by the assumption that users worried about cyberthreats are more motivated to protect against those threats and, therefore, more willing to adopt cybersecurity training. To this end, an index reflecting the participants' cybersecurity worries was computed and correlated
with the WTA and WTP for the cybersecurity training types. While significant, the correlation coefficients were low and suggest that worry about cybersecurity threats has a low impact on WTA and WTP for cybersecurity training. This surprising result calls for further investigation into the factors influencing willingness to adopt cybersecurity training. Further, the correlation analysis did reveal a moderate correlation between WTA and WTP within the different cybersecurity training types. As such, the data suggests that participants are willing to pay for cybersecurity training that they are positive about adopting.

## 4.2 Contributions

User perception of digital tools is a known factor that influences the adoption of such tools [24]. In the cybersecurity domain, user perception of cybersecurity training for organizations has been researched in several studies. This study, however, focuses on users' perception of cybersecurity training in the user's private capacity and is, to the best of our knowledge, the first of its kind. The first contribution of this research is that it shows what cybersecurity training types users are most willing to adopt and shows large differences between the included training types. About 40% of the respondents would not use game-based training even if it was free, while only 10% answered in that way for contextual training. As a result, this research suggests that user adoption is a concern that future research into game-based training needs to consider. A second and surprising contribution is that this research questions if worry about cybersecurity training types impacts users' willingness to adopt cybersecurity training. While we hypothesised that willingness to adopt cybersecurity training would be significantly influenced by the worry of cyberthreats, the gathered data did not support that hypothesis. A further contribution is the WTA scale, which future researchers can adopt as a comparative index of users' willingness to adopt cybersecurity training.

This research makes two contributions to the practice community. First, it demonstrates what types of training users are most likely to pay for, which could guide decisions to develop and sell cybersecurity training. Second, it demonstrates that most users are not ready to pay for cybersecurity training. This insight is important for national and international initiatives into cybersecurity. We argue that this suggests that national or international organizations must take the economic responsibility for supporting private users towards secure behaviour since the willingness to take that responsibility is low on the user side.

## 4.3 Limitations and Future Work

While this study aims to be reliable within its population, the extent to which the results are transferable to other populations remains unknown. Consequently, a given direction for future work is to replicate this research in other populations and compare the results.

A further limitation or question raised by this research is what factors influence WTA. This research shows little or no influence from worry about cybersecurity threats, which we found surprising. A suggested direction for future work would be continued data collection and analysis of this dataset to identify factors that greatly impact WTA for cybersecurity training. Understanding those factors is crucial for developing training
that users will want to use. A suggested approach would be to quantify the impact of different variables, including worry, using regression analysis. That is beyond the scope of this paper but a viable option for continued work with this or other datasets. It could also be useful to employ a qualitative approach to better understand how users reason concerning WTP and WTA.

## References

1. NIST: Framework for Improving Critical Infrastructure Cybersecurity. cited 20201230; Available from: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf (2018)

2. ISO/IEC: ISO/IEC 27001:2017 (2017)

3. Aldawood, H., Skinner, G.: Educating and raising awareness on cyber security social engineering: a literature review (2019)

4. Hu, S., Hsu, C., Zhou, Z.: Security education, training, and awareness programs: literature review. J. Comput. Inf. Syst. 1–13 (2021).

5. Chowdhury, N., Gkioulos, V.: Cyber security training for critical infrastructure protection: a literature review. Comput. Sci. Rev. 40, 100361 (2021)

6. Klimburg-Witjes, N., Wentland, A.: Hacking humans? social engineering and the construction of the “deficient user” in cybersecurity discourses. Sci. Technol. Human Values 46(6), 1316–1339 (2021)

7. Lain, D., Kostiainen, K., Capkun, S.: Phishing in organizations: findings from a large-scale and long-term study. arXiv preprint arXiv:2112.07498 (2021)

8. Al-Daeef, M.M., Basir, N., Saudi, M.M.: Security awareness training: a review. In: Proceedings of the World Congress on Engineering (2017)

9. Nagarajan, A., Allbeck, J.M., Sood, A., Janssen, T.L.: Exploring game design for cybersecurity training. In: 2012 IEEE International Conference on Cyber Technology in Automation, Control, and Intelligent Systems (CYBER). IEEE (2012)

10. Christopher, L., Choo, K.-K., Dehghantanha, A.: Honeypots for employee information security awareness and education training: a conceptual EASY training model. In: Contemporary Digital Forensic Investigations of Cloud and Mobile Applications, pp. 111–129. Elsevier (2017)

11. Kävrestad, J., Nohlberg, M.: Evaluation strategies for cybersecurity training methods: a literature review. In: Furnell, S., Clarke, N. (eds.) HAISA 2021. IAICT, vol. 613, pp. 102–112. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-81111-2_9

12. Alshaikh, M., Maynard, S.B., Ahmad, A., Chang, S.: An exploratory study of current information security training and awareness practices in organizations (2018)

13. He, W., Zhang, Z.: Enterprise cybersecurity training and awareness programs: recommendations for success. J. Organ. Comput. Electron. Commer. 29(4), 249–257 (2019)

14. Dahabiyeh, L.: Factors affecting organizational adoption and acceptance of computer-based security awareness training tools. Inf. Comput. Secur. (2021)

15. Amanowicz, M.: Towards building national cybersecurity awareness. Int. J. Electron. Telecommun. 66(2), 321–326 (2020)

16. Van Steen, T., Norris, E., Atha, K., Joinson, A.: What (if any) behaviour change techniques do government-led cybersecurity awareness campaigns use? J. Cybersecur. 6(1) (2020)

17. Joshi, A., Kale, S., Chandel, S., Pal, D.K.: Likert scale: explored and explained. Curr. J. Appl. Sci. Technol. 396–403 (2015)

18. Miller, R., Banerjee, N.K., Banerjee, S.: Within-system and cross-system behavior-based biometric authentication in virtual reality (2020)

19. Fowler Jr, F.J.: Survey research methods. Sage Publications (2013)
20. Henry, G.T.: Practical Sampling, vol. 21. Sage (1990)

21. Tavakol, M., Dennick, R.: Making sense of Cronbach's alpha. Int. J. Med. Educ. **2**, 53 (2011)

22. Park, E., Cho, M., Ki, C.-S.: Correct use of repeated measures analysis of variance. Korean J. Lab. Med. **29**(1), 1-9 (2009)

23. Asuero, A.G., Sayago, A., Gonzalez, A.: The correlation coefficient: an overview. Crit. Rev. Anal. Chem. **36**(1), 41-59 (2006)

24. Rahimi, B., Nadri, H., Afshar, H.L., Timpka, T.: A systematic review of the technology acceptance model in health informatics. Appl. Clin. Inform. **9**(3), 604 (2018)