# The Effect of Countermeasure Readability on Security Intentions
###### Abstract  
Human failure is a primary contributor to successful cyber attacks. For any cybersecurity initiative, it is therefore vital to motivate individuals to implement secure behavior. Research using protection motivation theory (PMT) has given insights into what motivates people to safeguard themselves in cyberspace. Recent PMT results have highlighted the central role of the coping appraisal in the cybersecurity context. In cybersecurity, we cope with threats using countermeasures. Research has shown that countermeasure awareness is a significant antecedent to all coping appraisal elements. Yet, although awareness plays a key role within the PMT framework, it is generally challenging to influence. A factor that is easy to influence is countermeasure readability. Earlier work has shown the impact of readability on understanding and that readability metrics make measuring and improving readability simple. Therefore, our research aims to clarify the relationship between countermeasure readability and security intentions. We propose an extended theoretical framework and investigate its implications using a survey. In line with related studies, results indicate that people are more likely to have favorable security intentions if they are aware of countermeasures and are confident in their ability to implement them. Crucially, the data show that countermeasure readability influences security intentions. Our results imply that cybersecurity professionals can utilize readability metrics to assess and improve the readability of countermeasure texts, providing an actionable avenue towards influencing security intentions. protection motivation theory; cybersecurity countermeasures; readability; structural equation modeling; theory of planned behavior +
Footnote †: journal: Cybersecurity and Privacy  
0000-0001-5000-0000-0000-0000-0000-0000-0000-0000-0000-0000-  
Application developers often look to motivate their users to steer them towards favorable security behavior (SB). This is a response to the common proposition that humans are the weakest link in the security chain [9]. To do this, theories and findings in the field of behavioral cybersecurity should be applied. Looking at the issue from both a protection motivation theory (PMT) and the theory of planned behavior (TPB) perspective, self-efficacy is often found to be a strong predictor of security behavior [10, 11]. Concisely, self-efficacy in the security context can be seen as \"the feeling of being able to implement the protection methods\" [12]. [PERSON] and [PERSON] [10] concluded that, within PMT, self-efficacy is the strongest antecedent of security behavior. Therefore, it is imperative to (textually) formulate proposed countermeasures in such a way that self-efficacy in users of cybersecurity assessment applications is stimulated optimally. Increasing readability could very well be a key to persuading users to implement these cybersecurity controls, as readability positively influences people's understanding of information security policies [13, 14]. Several widely used readability formulas can be applied to give feedback on the readability of countermeasures before being exposed to end-users. However, this approach currently lacks a scientific ground, as behavioral security research does not take into account the relationship between countermeasure readability and security intentions [15, 16, 17]. PMT provides a tried and tested framework that can be used to explain behavior in the security context [10]. This paper, therefore, aims to analyze and clarify the relationship between countermeasure readability and behavioral intention through the lens of PMT (extended by TPB) in the cybersecurity context. This work seeks to provide an answer to the following question: how does the readability of cybersecurity countermeasures influence security intentions? In answering this research question, we contribute an extension to the PMT framework.