"A five-year-old could understand it" versus "This is way too confusing": Exploring Non-expert Understandings and Perceptions of Cybersecurity Definitions

Experts struggle with explaining cybersecurity in a language and tone appropriate for non-expert audiences. This communication gap may make it difficult for a broad and diverse audience to fully engage in cybersecurity. Fundamental forms of communication, such as definitions, can be for a means for experts to communicate cybersecurity concepts to non-experts. To explore how non-experts perceive cybersecurity definitions and identify potential areas of misunderstanding and misconception, we performed a semi-structured interview study with 30 non-experts of different generations (ages) and education levels. Our findings reveal that non-experts may have incomplete mental models of cybersecurity, misinterpret terms and concepts commonly used in definitions, and express strong preferences for how cybersecurity is defined. While our study focuses on definitions, our results have broader implications for how cybersecurity should be communicated to a diverse range of individuals.