From Fear to Control: Developing a Three-Factor Scale for Cybersecurity Anxiety (CybAS)

Paper Title

From Fear to Control: Developing a Three-Factor Scale for Cybersecurity Anxiety (CybAS)

Publication Info

• Topic area: Development and validation of a psychometric scale for measuring cybersecurity anxiety.
• Keywords: Cybersecurity anxiety, psychometric scale, HCI, mental models, user behavior, cybersecurity threats, emotional barriers, anxiety-aware design, scale validation, usability.

Background and Problem

• Problem / challenge: Existing scales in cybersecurity and privacy research measure behaviors, attitudes, or resilience but fail to directly assess the emotional responses of anxiety, worry, and perceived lack of control in cybersecurity contexts.
• Significance: Cybersecurity anxiety impacts user behavior, compliance, and engagement with security technologies, signaling a misalignment between user mental models and system designs.
• Motivation and related work: Prior work has focused on related constructs like privacy concerns, computer anxiety, and resilience, but no validated instrument specifically measures cybersecurity anxiety. This gap limits the ability to design interventions addressing emotional barriers in cybersecurity.

Solution

• Proposed approach: The Cybersecurity Anxiety Scale (CybAS), a 15-item psychometric instrument with three factors: Present (current concerns), Future (anticipated threats), and Control (perceived control over outcomes).
• Novelty:
  1. Introduction of cybersecurity anxiety as a critical HCI construct to diagnose user-system misalignments.
  2. Development and validation of CybAS, operationalizing cybersecurity anxiety into three distinct factors.
  3. A vision for designing anxiety-aware security systems and interventions.
• Procedure and key techniques:
  • Literature review to define cybersecurity anxiety and identify related constructs.
  • Iterative item generation and refinement through surveys and statistical analyses.
  • Validation of the scale using exploratory and confirmatory factor analyses, reliability tests, and correlations with related scales.

Results

• Concrete findings:
  • CybAS is a 15-item scale with three factors: Present (7 items, Cronbach’s α = .92), Future (4 items, α = .77), and Control (4 items, α = .76).
  • Overall scale reliability: Cronbach’s α = .90, McDonald’s ω = .90.
  • Mean CybAS score: 3.09 (SD ±1.0) on a 5-point Likert scale.
• Advantage over baselines:
  • CybAS captures domain-specific cybersecurity anxiety, distinguishing it from generalized clinical anxiety (e.g., GAD-7) and related constructs like paranoia or resilience.
  • Strong correlations with related scales (e.g., Cyber-Paranoia and Fear Scale, r = .505) validate its construct specificity.
• Experiments / evaluation:
  • Three survey rounds with U.S. participants (N = 301, 310, 275).
  • Validation through exploratory and confirmatory factor analyses, reliability tests, and correlations with seven related scales.
  • Demographic diversity included gender balance and political spectrum representation but was limited by overrepresentation of younger, white, and educated participants.
• Limitations and future work:
  • Limited demographic and geographic diversity; future studies should include broader populations.
  • Need for longitudinal studies to assess test-retest reliability and diagnostic utility.
  • Exploration of interventions to mitigate cybersecurity anxiety and further correlations with privacy-related scales.

Summary

The Cybersecurity Anxiety Scale (CybAS) is a validated 15-item psychometric tool designed to measure cybersecurity anxiety across three factors: Present, Future, and Control. It addresses a critical gap in HCI research by capturing the emotional dimensions of cybersecurity, enabling the design of anxiety-aware systems and interventions. The scale demonstrates strong reliability and validity, distinguishing cybersecurity anxiety as a domain-specific construct. While further demographic and longitudinal validation is needed, CybAS provides a foundation for understanding and mitigating the psychological barriers users face in adopting secure behaviors.