Does security attitude really predict susceptibility to persuasion tactics in social engineering attempts?

Purpose: This study aims to investigate whether an individual’s security attitude (SA) predicts susceptibility to persuasion in social engineering (SE) attempts. Design/methodology/approach: This paper examined susceptibility to Cialdini’s six principles of persuasion in SE contexts. Three hundred twenty-three participants from the United Kingdom and 329 from Arab Gulf Cooperation Council (GCC) countries were surveyed. Participants were presented with 12 scenarios involving a request to download an app from a member of a social media group, six persuasive scenarios and six neutral counterparts. The six-item security attitude scale (SA-6) measured participants’ attitudes towards security practices. Findings: Some positive correlations were found between SA and vulnerability to specific persuasion principles. Regression analyses indicated that SA was a significant predictor of vulnerability. Notably, higher SA was associated with slightly increased vulnerability in all significant models. Practical implications: These findings highlight the need for effective strategies to resist SE attacks involving immunity to persuasion tactics. Individuals with higher SAs may be overconfident and underestimating risks. Originality/value: The effect of persuasion was uniquely distilled and measured by the difference between the impact of the persuasion scenario and its neutral version, representing a method novelty. Furthermore, it includes a sample from the Arab GCC, an often-neglected population in research. The paper is the first to compare SA, related to security knowledge-seeking and following security recommendations, with psychological immunity to persuasion in a security context.