Institutional legibility is how easily people can understand what an institution says, decides, and expects them to do. A legible institution uses plain language, consistent processes, and clear explanations so users can turn instructions into action without guessing. In public administration and other large organizations, legibility is part of operational quality: if people cannot understand a notice, policy, or warning, the institution may be formally correct but practically ineffective.
In cyber security, institutional legibility matters because attackers exploit confusion, while defenders depend on comprehension. Phishing messages often imitate official language to seem believable, and incident-response notices fail when they are too vague, technical, or fragmented. Clear communication helps users recognize fraud, follow password resets or MFA prompts, and report suspicious activity quickly. Good security communication is therefore not just messaging; it is a control that reduces error, builds trust, and improves compliance during incidents.