## 6 Discussion  
The purpose of this study was to develop an instrument to assess users' awareness (here intended as a synonym of knowledge) of cybersecurity issues and to provide a proficiency score that could be eventually correlated with other measures (e.g., risky behaviors). Knowledge influences behavior, although it is not the only variable that determines it. Estimating knowledge is an important step in reducing user vulnerability by intervening at the organizational level. For example, [PERSON] and colleagues [23] developed a web-based Blockchain-enabled cybersecurity awareness program in which estimating the user knowledge was a key element. The user was tested on common cybersecurity questions and tasks, such as e-mail phishing and weak password policies, and then the program tested whether the user had a good knowledge base by conducting tests on advanced cybersecurity topics. Generally speaking, one would expect that knowledge plays a crucial role in predicting and mitigating vulnerability. Therefore, a standard measurement tool is highly desirable. To make sure that the measure was as standardized as possible, we started by reviewing the questionnaires already existing in the literature and found that many of them are composed of either a very large [18, 19] or a very small [3] set of items, making them either cumbersome for the user or superficial for the purpose of testing users' vulnerability. Most importantly, none of the cybersecurity surveys reviewed are considered  
Figure 3: CAIN scores by risk levels. \begin{table}
\begin{tabular}{c c c c c c c} \hline  & **Proportion** & **Logit** & **Difficulty** & **se** & **z** & **\(\chi\)2** & **Pr ( \textgreater{}\(\chi\)2)** \\ \hline
44 & 0.964 & 3.285 & \(-\)3.679 & 0.336 & \(-\)10.955 & 8.498 & 0.377 \\
45 & 0.827 & 1.563 & \(-\)1.804 & 0.180 & \(-\)10.011 & 12.522 & 0.227 \\
46 & 0.942 & 2.792 & \(-\)3.158 & 0.274 & \(-\)11.537 & 8.256 & 0.451 \\ \hline \end{tabular}
\end{table} 
Table 3: _Cont._broad/comprehensive cybersecurity knowledge tests. For example, the CS-S is mainly oriented to obtain information about users' behaviors, and includes only a few knowledge items. Our aim, instead, was to develop a questionnaire specifically oriented to measure users' cybersecurity awareness, composed of a fair number of items covering as many aspects as possible, and based on a comprehensive knowledge base rather than a specific theoretical approach. Based on the analysis of ISO/IEC 27032, the standard guideline in the field of cybersecurity, a pool of 46 items was selected and great attention was devoted to wording, by trying to use terminology that would be understood by users with different cybersecurity knowledge levels. Data analysis demonstrated that participants attained fairly high CAIN scores and generated a distribution of scores that was skewed and narrow. The high percentage of correct responses may indicate that college students have fairly in-depth knowledge regarding aspects of cybersecurity. Our particular population of students also underwent specific U.S. Department of Defense cybersecurity training annually because they are accessing government systems. Additionally, in some instances high scores could also result from real-life situations that students personally encountered: for example, for items #2 and #45, the percentage of correct answers was numerically higher in the medium-risk group. This could be because those who were issued a medium-risk report may have been contacted by IT to take action on their devices, through remote IT control or quarantining their devices, thereby affording medium-risk users first-hand knowledge about such practices. In terms of the relation of CAIN scores to risky behaviors, although the omnibus comparison of the three risk level groups (no risk, low risk, and medium risk) did not reach statistical significance, a significant difference between the medium-risk group and the other two was found.