Personality traits as predictors of vulnerability to persuasion in social engineering amongst risk-aware targets

Many cybersecurity advancements involve personalizing security measures. These measures often leverage individual differences to create tailored solutions, such as custom cybersecurity training programs. This study examines persuasion in social engineering (SE) attacks, one of the most prevalent forms of cyberattacks today, and their connection to human factors, using a vignette-based approach. We investigate how personality traits can predict susceptibility to persuasion in potential SE scenarios. Cialdini’s six principles of persuasion are frequently found in SE attacks and serve as our conceptual framework. Data was collected through an online study involving 329 participants from the Arab Gulf Cooperation Council (GCC) countries and 322 from the United Kingdom (UK). Participants’ personality traits were evaluated using a validated 10-item scale based on the Big-5 model. They were presented with 12 scenarios: six that included one of the persuasion principles and six where the corresponding principle was neutralized. Participants were then asked about their level of trust in the potential social engineer and their likelihood of complying with the online request. We analyzed the data using regression to assess the effect of personality traits on susceptibility. The findings indicate that personality traits are weak predictors of susceptibility to persuasion in SE scenarios across both samples, suggesting that they may not be critical factors to consider when developing customized solutions. Additionally, we found no significant differences in vulnerability between the Arab and UK samples. We discuss the potential reasons behind these findings and suggest other factors to consider when designing adaptive cybersecurity solutions.