# SAWIT--Security Awareness Improvement Tool in the Workplace
## 5 Evaluation  
The main aim of the SAWIT tool is to improve security awareness among employees. Because of that, it is necessary to measure the improvement of employees' behavior regarding the detection and protection of security threats in cyber space. According to [PERSON] et al., there is a strong, positive relationship between knowledge, attitude and behavior, or in other words, as the knowledge of safe information security behavior grows, this in turn impacts on better information security behavior [36]. Namely, the SAWIT tool should increase employees' knowledge, particularly about how to defend themselves against potential cyber-attacks in the workplace. To gain initial insight into how users perceive and experience SAWIT, a formative evaluation was conducted. [PERSON] and [PERSON] state that university students are especially relevant for intervention, because they will soon start working, and if they do not have sufficient knowledge about cyber security, this knowledge gap should be addressed in training schemes within organizations [37]. This was the motivational trigger to engage voluntary students in finding out for themselves how useful the SAWIT tool is in improving security awareness and to evaluate SAWIT. Formative evaluation was carried out with 22 volunteer students from the University of Belgrade (20 undergraduates and 2 postgraduates). Although SAWIT is not completed yet, and its functionality is being improved, the participants experimented with the current version in order to learn how it might assist them in their future work. The moderators demonstrated the use of the SAWIT tool to the participants. Having done so, the moderators then instructed the students to run the SAWIT tool, completing tasks which corresponded to the application scenarios described in Section 4. Finally, the participants completed questionnaires about SAWIT. In creating our survey, we consulted the guidelines for creating questionnaires about evaluation of usefulness and ease of use software's system and user interfaces [38; 39]. Beside this, we also adapted some questions from [17]. The questions in the questionnaire were related to the following criteria: relevance, organization of information, perceived usefulness and ease of use. The questions were designed on a 5-point Likert scale (the possible answers ranging from 1 to 5, from strongly disagree to strongly agree, or such like), but free-form qualitative judgments and comments were also encouraged. According to the majority of the participants, SAWIT is quite relevant for cyber security, is also useful for security principles (86% participants Strongly Agree or Agree (SAA)), has appropriate topic coverage from the security perspective (77% SAA), provides in-depth analysis of security problems (73% SAA), is a good basis for security awareness (82% SAA) and is beneficial for team-work (91% SAA), as it is shown in Table 1.  
The vast majority of the participants were very satisfied with the organization of information and stated that the information can be easily found (82% SAA), is structurally (82% SAA), logically (82% SAA) and intuitively organized (82% SAA) and post-assessment questions were covered in the material (77% SAA). On evaluating the usefulness of SAWIT, the participants said that the material is clearly presented (82% SAA), the vocabulary is adequate (77% SAA), the content is relevant for learning (86% SAA), collaboration with colleges is useful (91% SAA) and they are satisfied with the system (82% SAA). In analyzing ease of use, the participants said that SAWIT is easy to use (82% SAA), is user friendly (86% SAA) and one can easily recover after making a mistake (77% SAA). The participants also stated that SAWIT can be used without written instructions (77% SAA) and is not inconsistent (82% SAA). As the SAWIT is a prototype model for security awareness, one participant suggested that in the final and complete version, more units should be added, with different levels of privileges for the user.