# The Effect of Countermeasure Readability on Security Intentions
## 6 Discussion
### Implications and Limitations  
The results of this research provide empirical ground for the usage of readability metrics to improve countermeasure readability in cybersecurity assessment applications. Previous work has shown a strong significant relationship between intentions and actual behavior [50, 51]. Additionally, countermeasure readability indirectly positively predicts security intention. Hence, it is worthwhile to implement readability checks to improve security control texts before presenting them to users. These metrics are easily taken advantage of since well-documented open source packages are available [80, 81]. Table 5 provides example improvements based on readability metric scores. The first point of critique one may have is on the analysis of the readability metrics' effect on perceived readability (CR in this research). As was shown, the distribution of the measured variables is non-normal, by which the use of a \(t\)-test could be questioned. After all, \(t\)-tests assume normality. However, a paper by [PERSON] et al. [82] demonstrates that t-tests are valid with sufficiently large sample sizes. They state that \"sufficiently large\" is under 100. The sample size for comparing the countermeasures texts was 352, 172 for 'easy' measures and 180 for 'hard' ones. The use of an independent-sample t-test in this situation is therefore justified. On average, both 'easy' and 'hard' countermeasures were rated relatively high on readability. Synthesized with the strong relationship between CA and CR, this indicates that the subjects were familiar with security jargon terms and cybersecurity in general. Thisfits with the fact that part of the sample was taken from a bachelor's class on information security. This is a plausible cause for the strong negative skew reported in Section 5.1. Furthermore, this research does not conclude anything about the extent to which readability formulas indicate countermeasure readability (nor readability in general) or how they integrate with the proposed model. That is, readability metrics were not taken into the model, thus refusing to estimate any effect a text's readability score may have on any of the constructs in the model. Regarding the proposed model, 9 out of 15 hypotheses are not supported. This could indicate that the sample is not homogeneous. Furthermore, Section 4.2 points out that the sample likely contained a high percentage of bachelor students. [PERSON] and [PERSON] [83] note that \"generalizing from students to the general public can be problematic when personal and attitudinal variables are used\". Though the bootstrap procedure with 5000 iterations takes advantage of the central limit theorem [84], it does not counter poor population representativeness in the original sample. Another explanation of the low number of supported hypotheses is the operationalization of the concerning variables. That is, the use of a vignette caused some confusion for respondents. Some reported they would have answered differently if they were not asked to imagine themselves as a restaurant owner with several information systems.