## 5 Data Analysis and Results
### CAIN Scores
Internal consistency (reliability) of the scale was assessed through the Kuder-Richardson's coefficient (KR20), which is a special case for [PERSON]'s alpha when items are dichotomous (i.e., have only two response levels, shown here as TRUE or FALSE). The index is equivalent to [PERSON]'s alpha and provides values ranging from 0 to 1. The closer the KR20 coefficient is to 1.0 the greater the internal consistency of the items in the scale. In this very case, the KR20 coefficient was 0.78, indicating a fairly high reliability. Item-total statistics indicated that none of the items was crucial (if eliminated) for dramatically increasing reliability (see Table 2). However, eliminating item #33, that we reported as ambiguous, would increase reliability to 0.80, and to 0.81 if item #40 was also eliminated. \begin{table}
\begin{tabular}{l c c} \hline
**Item** & **Correct Response** & **Correct Responses** \\ \hline
28. When a user is not aware of the risks, it is better to ask someone trusted before acting online. & TRUE & 96\% \\ \hline
29. Online stores have no specific rules regarding security management. & FALSE & 79\% \\ \hline
30. Some online payment mechanisms are not reliable. & TRUE & 95\% \\ \hline
31. A blog owner is not responsible for materials uploaded by other users. & FALSE & 59\% \\ \hline
32. An organization does not need an authorization to release sensitive information of its employees on any website. & FALSE & 78\% \\ \hline
33. Cookies are a mechanism to steal sensitive information. & FALSE & 48\% \\ \hline
34. Software updating is not relevant for cybersecurity. & FALSE & 91\% \\ \hline
35. Antivirus software works even if temporarily disabled. & FALSE & 75\% \\ \hline
36. Unsolicited opened window can transmit a virus. & TRUE & 92\% \\ \hline
37. Malicious pieces of code (scripts) hidden in some websites can infect & TRUE & 97\% \\ a device. & & \\ \hline
38. Browsers have tools for protecting against cyber-attacks. & TRUE & 92\% \\ \hline
39. Current operating systems have embedded firewalls. & TRUE & 92\% \\ \hline
40. Firewalls slow down the performance of devices. & TRUE & 49\% \\ \hline
41. A fake account can be created to contact a user with the aim to steal their sensitive information. & TRUE & 96\% \\ \hline
42. Emails requesting username and password are legitimate. & FALSE & 88\% \\ \hline
43. A freebies offer can be a way to steal personal information. & TRUE & 93\% \\ \hline
44. A two-factor authentication (e.g., password + sms code, authenticator app) & TRUE & 96\% \\ is a security tool. & & \\ \hline
45. A device involved in suspicious activity should be quarantined & TRUE & 83\% \\ (i.e., isolated for preventing infections of other devices). & TRUE & 94\% \\ \hline
46. If a cyber-attack happens today, the consequences may be visible & TRUE & 94\% \\ weeks away. & & \\ \hline \end{tabular}
\end{table} 
Table 1: _Cont._The distribution of the CAIN scores was asymmetrical (skewness = \(-\)1.89) and narrow (kurtosis = 3.49) (Figure 1). Therefore, scores were transformed using the arcsin square root method for successive analyses. This type of transformation is typically used when dealing with proportions/percentages, and corrects distribution issues (see Figure 1a,b). Percent of correct responses were instead plotted for readability.