  We present SA-13, the 13-item Security Attitude inventory. We develop and
validate this assessment of cybersecurity attitudes by conducting an
exploratory factor analysis, confirmatory factor analysis, and other tests with
data from a U.S. Census-weighted Qualtrics panel (N=209). Beyond a core six
indicators of Engagement with Security Measures (SA-Engagement, three items)
and Attentiveness to Security Measures (SA-Attentiveness, three items), our
SA-13 inventory adds indicators of Resistance to Security Measures
(SA-Resistance, four items) and Concernedness with Improving Compliance
(SA-Concernedness, three items). SA-13 and the subscales exhibit desirable
psychometric qualities; and higher scores on SA-13 and on the SA-Engagement and
SA-Attentiveness subscales are associated with higher scores for security
behavior intention and for self-reported recent security behaviors. SA-13 and
the subscales are useful for researchers and security awareness teams who need
a lightweight survey measure of user security attitudes. The composite score of
the 13 indicators provides a compact measurement of cybersecurity decisional
balance.
