# Evaluating the Risks of Human Factors Associated with Social Media Cybersecurity Threats

Fai Ben Salamah, Marco A. Palomino, Maria Papadaki, Matthew J. Craven, Steven Furnell

► To cite this version:

Fai Ben Salamah, Marco A. Palomino, Maria Papadaki, Matthew J. Craven, Steven Furnell. Evaluating the Risks of Human Factors Associated with Social Media Cybersecurity Threats. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.349-363, 10.1007/978-3-031-38530-8_28. hal-05462094

HAL Id: hal-05462094

https://inria.hal.science/hal-05462094v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Evaluating the Risks of Human Factors Associated with Social Media Cybersecurity Threats

Fai Ben Salalah<fnref n="1" />(✉) ID, Marco A. Palomino<fnref n="1" />(✉) ID, Maria Papadaki<fnref n="2" /> ID,
Matthew J. Craven<fnref n="1" /> ID, and Steven Furnell<fnref n="3" /> ID

**Abstract.** Human behaviors and attitudes play a significant role in cybersecurity. However, studies to quantify the impact of such behaviors and attitudes are scarce, and they are not always considered when developing mitigation strategies. To compensate for this, we have looked into a large sample of employees with different levels of expertise and backgrounds across a variety of industrial sectors and organizations. We have found that age and job role constitute the main human factors associated with social media cybersecurity risks. We can confirm that the youngest employees are the most risk prone within an organization, and the employees working in the business and financial sectors are the ones who face the highest amount of cybersecurity risk. In addition, our investigation shows that employees with less than two years of working experience, and those who are at least of age 55, need more cybersecurity training, due to their lack of awareness on the subject. Our work has led us to formulate a risk equation which can assist policymakers and training providers in defining countermeasures against risks and prioritize the training for those who need it the most.

**Keywords:** Cybersecurity · social media · human factors · risk management

## 1 Introduction

Social media is based on the notion of community and relationships. The very nature of social media expects users to trust in each other and interact. Unfortunately, uncontrolled trust and thoughtless interaction may lead to vulnerabilities, which are often exploited by hackers [1]. Even if an organization does not use social media, it is exposed to risks because their employees are exposed [2], and hackers will continue to exploit human vulnerabilities and using the information employees share on social media to commit their crimes [3].

As time passes by, and technology progresses, hackers are likely to employ more and more advanced techniques and make their attacks harder to manage and prevent [4]. Fool-proof protection is unlikely to be available any time soon [5].

<footnote n="1">¹ University of Plymouth, Plymouth PL4 8AA, UK</footnote>

<footnote>{fai.bensalamah, marco.palomino}@plymouth.ac.uk</footnote>

<footnote n="2">² University of Derby, Derby DE22 1GB, UK</footnote>

<footnote n="3">³ University of Nottingham, Nottingham NG8 1BB, UK</footnote>
Awareness of cybersecurity threats seems quite low, particularly when it comes to social media. Many people appear to have little idea about what and how much information they can share without taking unacceptable cyber risks [6, 7]. We define *cyber risk* as any risk of financial loss, disruption, or damage to the reputation of a person or organization from failure associated with information technology systems. Given that the increase in security breaches has partly occurred due to poor cybersecurity awareness [8], we intend to raise such an awareness as one of the topmost priorities of organizational management. This has also been proposed by Ghazvini and Shukur [9]. Indeed, the *European Network and Information Security Agency* (ENISA) [1] suggests analyzing gaps and vulnerabilities to foster awareness. Thus, a strategic plan needs to be in place to ensure protection against cyber threats, and the success or failure of the entire process should be evaluated.

Risk management encourages the implementation of countermeasures to mitigate risks that adversely affect security requirements [10]. Periodic risk management is indispensable [11]. To this effect, the *National Institute of Standards and Technology* (NIST) has introduced a cybersecurity risk assessment framework to help develop secure software and hardware [12]. However, such a framework ignores some of the human factors that often cause security lapses [12].

Considering the effects of human factors while developing mitigation strategies to prevent cybersecurity risks is an infrequent practice [13]. Emphasis needs to be on human factors that play a role in security incidents. The importance of this paper lies precisely in identifying the human factors that are responsible for aggravating cyber risks while using social media. This paper also proposes an equation to quantify risk, so that organizations can determine how hazardous their operations are and establish an adequate course of action for resolving cybersecurity issues. Our risk equation is partially based upon work by [14] and estimates how much different human factors impact negatively on social media risks.

The remainder of this paper is organized as follows: Sect. 2 summarizes previous studies that link human factors with cybersecurity risks and compares and contrasts the approach that former researchers have followed. Section 3 presents the methodology used in our study. Section 4 describes our results and presents our risk assessment equation to help policymakers to assess the risk associated with their employees and online activities. Finally, we draw our conclusions in Sect. 5.

## 2 Related Work

There are several studies looking at how an individual's age may have cybersecurity implications [15, 16]. Furnell and Vasileiou have argued that security training must vary according to the age of the trainees, because different age groups have varying preferences and understanding of cybersecurity [17]. However, Furnell and Vasileiou did not study the problem specifically within the context of organizations with a presence and operations on social media, which is what we intend to do.

Blackwood-Brown indicated that older people are more vulnerable to cyberattacks [18], whereas Hadlington found out that younger people are more vulnerable to phishing attacks [19]. We have not limited our analysis to phishing attacks, and we correlated different age ranges to other issues that are part of social media.
A person's background and prior work experience play a vital role when addressing risks too, as stated by Hatzivasilis et al. [20]—for example, those with an IT background are typically interested in knowing how cyberattacks are executed. Thus, we have gathered information from different employees in various organizations working in different sectors and having diverse backgrounds. Our findings encourage the utilization of training approaches geared towards the background and expertise of different employees, which is what Pedley et al. has suggested to do [21].

Job roles are a vital factor associated with cybersecurity training [22]. Nifakos et al. [23] argue that healthcare professionals—such as doctors, nurses, and medical support staff—need more cybersecurity training because they pose higher risks to their organizations when interacting with social media platforms, providing hackers with ideal opportunities to extract sensitive information. While we agree with Nifakos et al., we are also interested in learning about other sectors of the industry—for example, the military and financial sectors. Thus, we have endeavored to collect information from employees working on a wide range of organizations performing many different roles.

Human attitudes that include behaviors, values, and preferences are critical to identify vulnerabilities exploited by cyberattacks [24]. Hadlington has shown that people who ignore security-related warnings have higher chances of becoming victims of cybercrime [19]. To further understand this, we have distributed an online survey, which features specific sections about attitudes and behaviors. In turn, the findings derived from these sections will allow us to assist policymakers to prioritize training for those who need it the most.

## 3 Methods

Our work focuses on human factors that have been found to be linked with the ever-increasing cyberthreats on social media platforms. While the study of human factors examines how people behave physically and psychologically in connection to various situations, activities, and assets [25], we have estimated the extent of human factors on cyberthreats. We have used a descriptive survey design to discover associations between selected human factors and cyberthreats, as suggested by Dulock [26]. We have administered our survey using Google Forms [27].

Our survey targeted Kuwaiti employees who work in Kuwait, use social media, are above 18 years old, and work in a variety of sectors. Our questions took a broad view of the participants and identified their experiences on social media. Due to the sensitive nature of our work, we undertook the ethical review process required by the University of Plymouth, which is where we were based while conducting our investigation. The ethical review was recorded through the Plymouth Ethics Online System (PEOS) [28], and the approval was granted on 5 September 2020. Prior to distributing our survey, a pilot test was carried out among ten people to analyze the survey's feasibility. Abiding by the University of Plymouth's ethical approval policy, the survey was conducted in complete anonymity. The survey was carried out in the English language.

The conditions of Kuwait helped us to gain a deep understanding of some of the cybersecurity issues that are present worldwide. Kuwait is one of the top five Arab countries in the use of social media [29]. It is also ranked number eight in email malware attacks, and number six in frequency of spam attacks [30]. Thus, concentrating on
Kuwait's case can provide us with invaluable insight into cybersecurity issues that are present in Arab countries and worldwide too.

The survey was carried out in the English language and consisted of 14 questions separated into two sections:

* Section 1: An introduction to our work, the time required to complete the survey, the right to withdraw, and questions to confirm the eligibility of the participants.

* Section 2: Questions focused on demographics, attitudes, and behaviors.

Our control variables included age, education, academic qualifications, job role, and years of working experience. Behaviors and attitudes in social media are crucial. According to ENISA, behaviors are the conscious risk-taking activities undertaken by employees that directly or indirectly affect the security culture [31]. Attitudes, on the other hand, are the employees' reactions and emotions experienced in response to organizational security [31].

As per the Central Statistical Bureau, there were 401,057 employees in Kuwait's public sector in 2018 [32]. Then, we calculated our sample's confidence interval based on this figure, and the resulting z values were from 2.76 to 2.92, which is a 99% confidence interval [33]. The recommended sample size was 542 participants. However, we went beyond that and reached 641 participants.

# 4 Results

We sent our Google Forms survey to management contacts from a variety of Kuwaiti organizations. We asked such contacts to forward the survey to employees who fulfilled the research criteria and could be potentially willing to participate. In turn, those employees forwarded the survey to other employees and so on. In total, 641 employees returned their answers. We used the chi-square test [34] to examine the relationship between categorical variables. The confidence intervals were set to 95% and 99%. Hence, p-values greater than 0.01 and smaller than 0.05 were statistically significant.

Younger employees were found to be less informed than their older colleagues. Employees older than 55 were not very knowledgeable either. In fact, our results show that employees whose ages are between 18–36 and those who are older than 55 pose the highest risks for cybersecurity-related incidents. We also attempted to investigate the relationship between age and behavior towards suspicious emails. In this instance, the chi-square test results indicate that employees in the age group 18–25 are exposed to the greatest risks, as they were willing to click on the View Policy button shown in Fig. 1. Those over 55 need more training, as they displayed their lack of awareness when confronted with cybersecurity incidents.

The chi-square test also reveals that employees from different age groups struggle with different issues when they come across phishing, email spam, and hacking. While the youngest employees (18–25) struggle more with phishing and hacking, email spam poses the greatest challenge to employees in the age group 36–45. Employees who are older than 45 struggle more with phishing. Table 1 provides full details.

Depending upon job roles, security awareness varies—see Table 2. IT employees have more awareness of cybersecurity and classified a phishing email as a security
We're Excited To Announce New
Benefits

Dear,

We're excited to announce that we are offering a few new employee benefits at no cost to you. Please click below to review and acknowledge that you accept these benefits.

Sincerely,
HR Director

View Policy

Our mailing address is:

<figure><img src="image_3.png" /><figcaption>Fig. 1. Phishing email</figcaption></figure>

incident, whereas those in education chose to contact the HR Department for further clarification. Employees in administrative roles are more vulnerable to phishing attacks.

As far as the association between job roles and online attitudes is concerned, the chi-square test reveals that employees working on business and finance do not use anti-virus software often, whereas people working on IT use anti-virus software more than anyone else—see Table 3. While it is essential to use anti-virus software, it is equally essential to update such software regularly. The chi-square test reveals that employees working on IT almost always update their anti-virus software, whereas those in education, as well as those working on business and finance, rarely update software.

Checking the authenticity of the links in email messages is crucial before clicking on them or entering sensitive data. Our results reveal that people working on business and finance rarely check the authenticity of links. In contrast, people from IT are the most careful about ensuring authenticity. The chi-square test shows that employees with less than two years of experience are in great risk, as they were eager to click on a link in a phishing email. At the same time, employees with more than 25 years of experience seem to need more training, because most of them prefer to ignore phishing emails.

It was important for our investigation to explore if there were any relationships between people with different job roles and areas in which they struggle while dealing with social media. We found that people operating in administrative roles struggle the most with privacy and confidentiality.
<table><caption>**Table 1.** Age group and cybersecurity awareness.</caption><thead><tr><th colspan="11">I use a combination of letters... When choosing a password<br/>(χ² = 55.207, df = 20, p-value < 0.01)</th></tr><tr><th></th><th colspan="2">18-25</th><th colspan="2">26-35</th><th colspan="2">36-45</th><th colspan="2">46-55</th><th colspan="2">&gt;55</th></tr><tr><th></th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><th>At times</th><td>0</td><td>5.4</td><td>46</td><td>32.8</td><td>21</td><td>32.8</td><td>14</td><td>13.5</td><td>12</td><td>7.8</td></tr><tr><th>Always</th><td>19</td><td>16.1</td><td>85</td><td>98.5</td><td>113</td><td>98.5</td><td>40</td><td>40.5</td><td>22</td><td>23.5</td></tr></tbody></table><table><thead><tr><th colspan="11">I use antivirus software to protect my devices<br/>(χ² = 55.259, df = 20, p-value < 0.01)</th></tr><tr><th></th><th colspan="2">18-25</th><th colspan="2">26-35</th><th colspan="2">36-45</th><th colspan="2">46-55</th><th colspan="2">&gt;55</th></tr><tr><th></th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><th>Never</th><td>14</td><td>4.4</td><td>30</td><td>27.2</td><td>22</td><td>26.8</td><td>3</td><td>11.0</td><td>7</td><td>6.4</td></tr><tr><th>Always</th><td>6</td><td>0.3</td><td>53</td><td>63.7</td><td>66</td><td>62.9</td><td>38</td><td>25.9</td><td>15</td><td>15</td></tr></tbody></table><table><thead><tr><th colspan="11">I regularly check for antivirus updates<br/>(χ² = 66.235, df = 20, p-value < 0.01)</th></tr><tr><th></th><th colspan="2">18-25</th><th colspan="2">26-35</th><th colspan="2">36-45</th><th colspan="2">46-55</th><th colspan="2">&gt;55</th></tr><tr><th></th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><th>Never</th><td>16</td><td>4.7</td><td>33</td><td>29.3</td><td>21</td><td>29</td><td>4</td><td>11.9</td><td>8</td><td>6.9</td></tr><tr><th>Always</th><td>3</td><td>8.8</td><td>46</td><td>54.4</td><td>55</td><td>51.9</td><td>36</td><td>22.1</td><td>12</td><td>12.8</td></tr></tbody></table><table><thead><tr><th colspan="11">I always check the spelling of the URLs...<br/>(χ² = 51.654, df = 20, p-value < 0.01)</th></tr><tr><th></th><th colspan="2">18-25</th><th colspan="2">26-35</th><th colspan="2">36-45</th><th colspan="2">46-55</th><th colspan="2">&gt;55</th></tr><tr><th></th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><th>Never</th><td>12</td><td>3.2</td><td>18</td><td>20</td><td>16</td><td>19.8</td><td>7</td><td>8.1</td><td>3</td><td>4.7</td></tr><tr><th>Often</th><td>9</td><td>10.5</td><td>66</td><td>64.8</td><td>61</td><td>63.9</td><td>29</td><td>26.3</td><td>16</td><td>15.3</td></tr></tbody></table><table><thead><tr><th colspan="11">What do you if you receive this email?<br/>(χ² = 28.496, df = 15, p-value < 0.05)</th></tr><tr><th></th><th colspan="2">18-25</th><th colspan="2">26-35</th><th colspan="2">36-45</th><th colspan="2">46-55</th><th colspan="2">&gt;55</th></tr><tr><th></th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><th>Click on it</th><td>7</td><td>2</td><td>10</td><td>12.2</td><td>12</td><td>12</td><td>2</td><td>4.9</td><td>3</td><td>2.9</td></tr><tr><th>Ignore it</th><td>25</td><td>26.6</td><td>167</td><td>164.6</td><td>159</td><td>162.4</td><td>65</td><td>66.8</td><td>43</td><td>38.8</td></tr><tr><th>Report it</th><td>3</td><td>6</td><td>35</td><td>37.2</td><td>40</td><td>36.7</td><td>23</td><td>15.1</td><td>3</td><td>8.8</td></tr><tr><th>Contact HR</th><td>2</td><td>2.4</td><td>17</td><td>15</td><td>15</td><td>14.8</td><td>3</td><td>6.1</td><td>5</td><td>3.5</td></tr></tbody></table><table><thead><tr><th colspan="11">Which cybersecurity areas do you struggle with the most?<br/>(χ² = 39.289, df = 15, p-value < 0.01)</th></tr><tr><th></th><th colspan="2">18-25</th><th colspan="2">26-35</th><th colspan="2">36-45</th><th colspan="2">46-55</th><th colspan="2">&gt;55</th></tr><tr><th></th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><th>Click on it</th><td>7</td><td>2</td><td>10</td><td>12.2</td><td>12</td><td>12</td><td>2</td><td>4.9</td><td>3</td><td>2.9</td></tr><tr><th>Ignore it</th><td>25</td><td>26.6</td><td>167</td><td>164.6</td><td>159</td><td>162.4</td><td>65</td><td>66.8</td><td>43</td><td>38.8</td></tr><tr><th>Report it</th><td>3</td><td>6</td><td>35</td><td>37.2</td><td>40</td><td>36.7</td><td>23</td><td>15.1</td><td>3</td><td>8.8</td></tr><tr><th>Contact HR</th><td>2</td><td>2.4</td><td>17</td><td>15</td><td>15</td><td>14.8</td><td>3</td><td>6.1</td><td>5</td><td>3.5</td></tr></tbody></table>

(continued)
<table><caption>**Table 1.** (continued)</caption><thead><tr><th rowspan="2"></th><th colspan="2">18-25</th><th colspan="2">26-35</th><th colspan="2">36-45</th><th colspan="2">46-55</th><th colspan="2">&gt;55</th></tr><tr><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><td>Phishing</td><td>7</td><td>4.3</td><td>26</td><td>26.8</td><td>18</td><td>26.5</td><td>15</td><td>10.9</td><td>9</td><td>6.3</td></tr><tr><td>Spam</td><td>1</td><td>2.6</td><td>10</td><td>16.1</td><td>23</td><td>15.9</td><td>7</td><td>6.5</td><td>3</td><td>3.8</td></tr><tr><td>Hacking</td><td>11</td><td>4.9</td><td>25</td><td>30.1</td><td>29</td><td>29.7</td><td>13</td><td>12.2</td><td>6</td><td>7.1</td></tr></tbody></table>

<table><caption>**Table 2.** Job role and phishing.</caption><caption>What do you do if you receive this email?<br/>(χ² = 36.644, df = 24, p-value < 0.05)</caption><thead><tr><th rowspan="2"></th><th colspan="2">Education</th><th colspan="2">IT</th><th colspan="2">Healthcare</th><th colspan="2">Leadership</th><th colspan="2">Business</th><th colspan="2">Arts</th><th colspan="2">Admin</th><th colspan="2">Military</th></tr><tr><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><td>Click on it</td><td>10</td><td>8.1</td><td>3</td><td>4</td><td>1</td><td>1</td><td>6</td><td>7.1</td><td>3</td><td>4.4</td><td>0</td><td>1.3</td><td>9</td><td>4.5</td><td>0</td><td>0.9</td></tr><tr><td>Ignore it</td><td>111</td><td>110</td><td>45</td><td>53.9</td><td>11</td><td>12.9</td><td>89</td><td>95.6</td><td>22</td><td>18.0</td><td>62</td><td>61.1</td><td>43</td><td>37.5</td><td>14</td><td>11.5</td></tr><tr><td>Report it</td><td>19</td><td>24.9</td><td>22</td><td>12.2</td><td>6</td><td>2.9</td><td>28</td><td>21.6</td><td>11</td><td>13.5</td><td>3</td><td>4.1</td><td>9</td><td>13.8</td><td>5</td><td>8.5</td></tr><tr><td>Contact HR</td><td>13</td><td>10.0</td><td>5</td><td>4.9</td><td>0</td><td>1.2</td><td>10</td><td>8.7</td><td>6</td><td>5.4</td><td>0</td><td>1.6</td><td>5</td><td>5.6</td><td>2</td><td>3.4</td></tr></tbody></table>

<table><caption>**Table 3.** Job role and behaviors.</caption><caption>I use antivirus software to protect my devices<br/>(χ² = 62.167, df = 32, p-value < 0.01)</caption><thead><tr><th rowspan="2"></th><th colspan="2">Education</th><th colspan="2">IT</th><th colspan="2">Healthcare</th><th colspan="2">Leadership</th><th colspan="2">Business</th><th colspan="2">Arts</th><th colspan="2">Admin</th><th colspan="2">Military</th></tr><tr><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><td>Never</td><td>19</td><td>18.2</td><td>3</td><td>8.9</td><td>2</td><td>2.1</td><td>15</td><td>15.8</td><td>18</td><td>9.9</td><td>0</td><td>3</td><td>9</td><td>10.1</td><td>6</td><td>6.2</td></tr><tr><td>Always</td><td>45</td><td>42.6</td><td>32</td><td>20.9</td><td>3</td><td>5</td><td>38</td><td>37</td><td>18</td><td>23.1</td><td>2</td><td>7</td><td>22</td><td>23.6</td><td>12</td><td>14.5</td></tr></tbody></table><table><caption>I regularly check the antivirus software update on my computer/laptop<br/>(χ² = 70.973, df = 32, p-value < 0.001)</caption><thead><tr><th rowspan="2"></th><th colspan="2">Education</th><th colspan="2">IT</th><th colspan="2">Healthcare</th><th colspan="2">Leadership</th><th colspan="2">Business</th><th colspan="2">Arts</th><th colspan="2">Admin</th><th colspan="2">Military</th></tr><tr><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><td>Never</td><td>27</td><td>19.6</td><td>3</td><td>9.6</td><td>2</td><td>2.3</td><td>16</td><td>17</td><td>17</td><td>10.6</td><td>0</td><td>3.2</td><td>10</td><td>10.9</td><td>4</td><td>6.7</td></tr><tr><td>Always</td><td>31</td><td>36.3</td><td>30</td><td>17.8</td><td>3</td><td>4.3</td><td>32</td><td>31.6</td><td>14</td><td>19.7</td><td>1</td><td>5.9</td><td>20</td><td>20.2</td><td>13</td><td>12.4</td></tr></tbody></table><table><caption>I always check the spelling of the URLs link before clicking or entering sensitive data<br/>(χ² = 51.749, df = 32, p-value < 0.05)</caption><thead><tr><th rowspan="2"></th><th colspan="2">Education</th><th colspan="2">IT</th><th colspan="2">Healthcare</th><th colspan="2">Leadership</th><th colspan="2">Business</th><th colspan="2">Arts</th><th colspan="2">Admin</th><th colspan="2">Military</th></tr><tr><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><td>Never</td><td>16</td><td>13.4</td><td>2</td><td>6.6</td><td>3</td><td>1.6</td><td>11</td><td>11.6</td><td>13</td><td>7.3</td><td>1</td><td>2.2</td><td>6</td><td>7.4</td><td>2</td><td>4.6</td></tr><tr><td>Always</td><td>44</td><td>39.2</td><td>33</td><td>19.2</td><td>3</td><td>4.6</td><td>29</td><td>34.1</td><td>13</td><td>21.3</td><td>6</td><td>6.4</td><td>19</td><td>21.8</td><td>11</td><td>13.3</td></tr></tbody></table>

According to the chi-square test, those who work in the educational, learning and training sector struggle the most to protect their passwords and safeguard themselves
from phishing-related issues—see Table 4. At the same time, employees working on healthcare support and IT struggle largely with spam messages and emails. Those working in military establishments were the most challenged by hackers, followed by those who work in arts, entertainment, and sports.

<table><caption>**Table 4.** Job roles and struggling areas.</caption><caption>Where do you struggle the most?<br/>(χ² = 127.477, df = 64, p-value < 0.001)</caption><thead><tr><th rowspan="2"></th><th colspan="2">Education</th><th colspan="2">IT</th><th colspan="2">Healthcare</th><th colspan="2">Leadership</th><th colspan="2">Business</th><th colspan="2">Arts</th><th colspan="2">Admin</th><th colspan="2">Military</th></tr><tr><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th></tr></thead><tbody><tr><th>Privacy</th><td>59</td><td>59.8</td><td>21</td><td>29.3</td><td>8</td><td>7</td><td>49</td><td>52</td><td>34</td><td>32.4</td><td>15</td><td>9.8</td><td>43</td><td>33.2</td><td>13</td><td>20.3</td></tr><tr><th>Password</th><td>20</td><td>13.4</td><td>0</td><td>6.6</td><td>2</td><td>1.6</td><td>12</td><td>11.6</td><td>4</td><td>7.3</td><td>1</td><td>2.2</td><td>8</td><td>7.4</td><td>7</td><td>4.6</td></tr><tr><th>Phishing</th><td>19</td><td>13.4</td><td>7</td><td>6.6</td><td>2</td><td>1.6</td><td>8</td><td>11.6</td><td>7</td><td>7.3</td><td>0</td><td>2.2</td><td>10</td><td>7.4</td><td>3</td><td>4.6</td></tr><tr><th>Spam</th><td>12</td><td>10.8</td><td>8</td><td>5.3</td><td>4</td><td>1.3</td><td>11</td><td>9.4</td><td>5</td><td>5.8</td><td>0</td><td>1.8</td><td>5</td><td>6.0</td><td>0</td><td>3.7</td></tr><tr><th>Hacking</th><td>13</td><td>12.2</td><td>0</td><td>6</td><td>2</td><td>1.4</td><td>12</td><td>10.6</td><td>7</td><td>6.6</td><td>5</td><td>2.0</td><td>3</td><td>6.8</td><td>8</td><td>4.1</td></tr></tbody></table>

The chi-square test reveals three points of correlation between the employees' academic qualifications and their cybersecurity awareness. Phishing was less understood

<table><caption>**Table 5.** Academic qualifications and cybersecurity awareness</caption><caption>I use a combination of letters... When choosing a password<br/>(χ² = 48.458, df = 20, p-value < 0.001)</caption><thead><tr><th rowspan="2"></th><th colspan="2">Below Sec.</th><th colspan="2">Secondary</th><th colspan="2">College</th><th colspan="2">Bachelor's</th><th colspan="2">Postgrad</th></tr><tr><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th></tr></thead><tbody><tr><th>Rarely</th><td>1</td><td>0.5</td><td>3</td><td>0.9</td><td>8</td><td>4.1</td><td>29</td><td>28</td><td>2</td><td>10.3</td></tr><tr><th>Often</th><td>0</td><td>2.2</td><td>3</td><td>4.1</td><td>19</td><td>19.1</td><td>124</td><td>130</td><td>58</td><td>47.8</td></tr></tbody></table><table><caption>Which of the following best describe 'phishing'?<br/>(χ² = 40.684, df = 20, p-value < 0.001)</caption><thead><tr><th rowspan="2"></th><th colspan="2">Below Sec.</th><th colspan="2">Secondary</th><th colspan="2">College</th><th colspan="2">Bachelor's</th><th colspan="2">Postgraduate</th></tr><tr><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th></tr></thead><tbody><tr><th>A type of attack</th><td>2</td><td>0.9</td><td>3</td><td>1.6</td><td>9</td><td>7.5</td><td>52</td><td>51</td><td>13</td><td>18.8</td></tr><tr><th>Gathering data</th><td>1</td><td>3.9</td><td>5</td><td>7.3</td><td>23</td><td>33.8</td><td>232</td><td>229</td><td>98</td><td>84.4</td></tr><tr><th>Get followers</th><td>0</td><td>0.3</td><td>0</td><td>0.5</td><td>7</td><td>2.4</td><td>14</td><td>16.6</td><td>5</td><td>6.1</td></tr><tr><th>Managing ships</th><td>0</td><td>0</td><td>0</td><td>0</td><td>1</td><td>0.1</td><td>0</td><td>0.6</td><td>0</td><td>0.2</td></tr><tr><th>I do not know</th><td>4</td><td>1.9</td><td>5</td><td>3.5</td><td>20</td><td>16.2</td><td>110</td><td>110.3</td><td>34</td><td>40.5</td></tr></tbody></table><table><caption>Which of the following do you consider a more secure link?<br/>(χ² = 24.217, df = 5, p-value < 0.001)</caption><thead><tr><th rowspan="2"></th><th colspan="2">Below Sec.</th><th colspan="2">Secondary</th><th colspan="2">College</th><th colspan="2">Bachelor's</th><th colspan="2">Postgraduate</th></tr><tr><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th></tr></thead><tbody><tr><th>HTTP</th><td>4</td><td>2</td><td>6</td><td>3.6</td><td>30</td><td>16.8</td><td>107</td><td>114.1</td><td>32</td><td>42</td></tr><tr><th>HTTPS</th><td>3</td><td>5</td><td>7</td><td>9.4</td><td>30</td><td>43.2</td><td>301</td><td>293.9</td><td>118</td><td>108.8</td></tr></tbody></table>
by employees with secondary or college education. Also, they ignored password secu- rity policies and were unable to identify legitimate websites. In short, the higher the employees' educational qualifications are, the lower the risk they pose—see Table 5.

The chi-square test shows that employees with less than two years of experience are in great risk, as they were eager to click on a link in a phishing email—see Table 6. Employees with more than 25 years of experience seem to need more training, because most of them prefer to ignore phishing emails. Employees with 10–20 years of expe- rience struggle mostly with the protection of their privacy. Employees with 2–5 years of experience struggle mostly with spam. Phishing poses a challenge to those with less than 2 years of experience—see Table 6.

<table><caption>**Table 6.** Years of experience and cybersecurity awareness</caption><caption>What do you if you received this email?<br/>(χ² = 34.406, df = 21, p-value < 0.05)</caption><thead><tr><th rowspan="2"></th><th colspan="2">&lt;2</th><th colspan="2">2-5</th><th colspan="2">5-10</th><th colspan="2">10-15</th><th colspan="2">15-20</th><th colspan="2">20-25</th><th colspan="2">&gt;25</th></tr><tr><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th></tr></thead><tbody><tr><td>Click on it</td><td>4</td><td>1.2</td><td>7</td><td>5.1</td><td>5</td><td>6.3</td><td>9</td><td>6.2</td><td>6</td><td>6.3</td><td>3</td><td>4.2</td><td>3</td><td>3.7</td></tr><tr><td>Ignore it</td><td>13</td><td>16.5</td><td>67</td><td>69</td><td>91</td><td>85.5</td><td>82</td><td>83.4</td><td>83</td><td>85.5</td><td>50</td><td>56.8</td><td>57</td><td>50.3</td></tr><tr><td>Report it</td><td>3</td><td>3.7</td><td>15</td><td>15.6</td><td>17</td><td>19.3</td><td>18</td><td>18.8</td><td>28</td><td>19.3</td><td>18</td><td>12.8</td><td>5</td><td>11.4</td></tr><tr><td>Contact HR</td><td>3</td><td>1.5</td><td>7</td><td>6.3</td><td>6</td><td>7.8</td><td>7</td><td>7.6</td><td>6</td><td>7.8</td><td>8</td><td>5.2</td><td>5</td><td>4.6</td></tr></tbody></table><table><caption>Where do you struggle the most?<br/>(χ² = 104.958, df = 56, p-value < 0.01)</caption><thead><tr><th rowspan="2"></th><th colspan="2">&lt;2</th><th colspan="2">2-5</th><th colspan="2">5-10</th><th colspan="2">10-15</th><th colspan="2">15-20</th><th colspan="2">20-25</th><th colspan="2">&gt;25</th></tr><tr><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp</th></tr></thead><tbody><tr><td>Privacy</td><td>6</td><td>9.0</td><td>27</td><td>37.5</td><td>45</td><td>46.5</td><td>51</td><td>45.3</td><td>55</td><td>46.5</td><td>29</td><td>30.9</td><td>27</td><td>27.3</td></tr><tr><td>Password</td><td>1</td><td>2.0</td><td>10</td><td>8.4</td><td>7</td><td>10.4</td><td>18</td><td>10.2</td><td>12</td><td>10.4</td><td>4</td><td>6.9</td><td>4</td><td>6.1</td></tr><tr><td>Phishing</td><td>7</td><td>2</td><td>10</td><td>8.4</td><td>14</td><td>10.4</td><td>11</td><td>10.2</td><td>4</td><td>10.4</td><td>5</td><td>6.9</td><td>3</td><td>6.1</td></tr><tr><td>Spam</td><td>0</td><td>1.6</td><td>17</td><td>6.8</td><td>5</td><td>8.4</td><td>3</td><td>8.2</td><td>4</td><td>8.4</td><td>4</td><td>5.6</td><td>10</td><td>4.9</td></tr><tr><td>Hacking</td><td>2</td><td>1.8</td><td>3</td><td>7.7</td><td>8</td><td>9.5</td><td>8</td><td>9.2</td><td>13</td><td>9.5</td><td>8</td><td>6.3</td><td>7</td><td>5.6</td></tr></tbody></table>

According to the chi-square test, the time spent on social media and the understanding of cybersecurity concepts have a positive correlation—see Table 7 below. For instance, employees who spend between two and three hours per day on social media are more familiar with the concept of phishing than those who spend less than two hours per day. A positive correlation was also discovered between the time spent by employees on social media and their understanding of a secure link. Those who spend less than 30 min, and those who exceeded 3 h a day on social media, are less knowledgeable than others.
<table><caption>**Table 7.** Time spent on social media and cybersecurity awareness.</caption><caption>Which of the following options best describes 'phishing'?<br/>(χ² = 38.866, df = 16, p-value < 0.01)</caption><thead><tr><th rowspan="2"></th><th colspan="2">&lt;30 min</th><th colspan="2">30-60 min</th><th colspan="2">1-2 h</th><th colspan="2">2-3 h</th><th colspan="2">&gt;3 h</th></tr><tr><th>Count</th><th>Exp</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><th>A type of attack</th><td>8</td><td>3.3</td><td>6</td><td>7.6</td><td>22</td><td>20.9</td><td>26</td><td>21.5</td><td>18</td><td>26.8</td></tr><tr><th>Gathering data</th><td>12</td><td>14.6</td><td>37</td><td>34.3</td><td>87</td><td>93.9</td><td>102</td><td>96.8</td><td>122</td><td>120.4</td></tr><tr><th>Get followers</th><td>0</td><td>1.1</td><td>8</td><td>2.5</td><td>6</td><td>6.8</td><td>1</td><td>7</td><td>11</td><td>8.7</td></tr><tr><th>Managing ships</th><td>0</td><td>0</td><td>0</td><td>0.1</td><td>1</td><td>0.3</td><td>0</td><td>0.3</td><td>0</td><td>0.3</td></tr><tr><th>I do not know</th><td>6</td><td>7</td><td>10</td><td>16.5</td><td>51</td><td>45.1</td><td>43</td><td>46.5</td><td>63</td><td>57.8</td></tr></tbody></table>

Which of the following is considered a more secure link?

(χ² = 38.866, df = 16, p-value < 0.01)

<table><thead><tr><th rowspan="2"></th><th colspan="2">&lt;30 min</th><th colspan="2">30-60 min</th><th colspan="2">1-2 h</th><th colspan="2">2-3 h</th><th colspan="2">&gt;3 h</th></tr><tr><th>Count</th><th>Exp</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th><th>Count</th><th>Exp.</th></tr></thead><tbody><tr><th>HTTP</th><td>12</td><td>7.3</td><td>10</td><td>17.1</td><td>45</td><td>46.7</td><td>42</td><td>48.1</td><td>70</td><td>59.9</td></tr><tr><th>HTTPS</th><td>14</td><td>18.7</td><td>51</td><td>43.9</td><td>122</td><td>120.3</td><td>130</td><td>123.9</td><td>144</td><td>154.1</td></tr></tbody></table>

Through our findings, we can confirm that age and job role are the two most significant factors associated with risk on social media. Younger employees are less informed than their older peers, and employees whose age is over 55 need more training than employees in other age groups.

Business and finance employees tend to require more training, because they are the most attacked on social media—which is an issue also found by Pedley *et al.* [21]—followed by those who work on administrative positions and the educational sector. Factors such as work experience and time spent on social media are found to be correlated with cybersecurity awareness. However, those with more than 25 years of experience, and those with little experience, need more training than others. People spending between 2 and 3 h a day on social media are more familiar with cybersecurity than those who spend less than 30 min a day or exceed 3 h a day on social media.

Our findings confirm that “age” and “job role” are the two most significant factors associated with risk on social media. Younger employees are less informed than their older peers, and employees whose age is over 55 require more training. Similarly, staff involved in business and finance require more training, because they are the most attacked on social media—which is an issue also found by Pedley *et al.* [21]—followed by those who work on administrative positions and the educational sector. Factors such as work
experience and time spent on social media are found to be correlated with cybersecurity awareness.

## 4.1 Social Media Risk Assessment

Three methods are commonly used to evaluate cybersecurity in an organization: risk assessment, vulnerability assessment, and penetration testing [10]. We have pursued the first method, and we have identified resources, threats, and weaknesses to estimate risk. Based on Chapple et al. [10], the total risk is the amount of risk an organization would face if no safeguards were implemented. The traditional formula for total risk involves threats and vulnerabilities as shown below:

$$ \text{Risk} = \text{Threat} \times \text{Vulnerability}. $$

To be precise, risk can be understood as the possibility that a threat exploits a vulnerability to harm assets—a risk rises as a threat becomes more likely to occur. To reduce risks to an acceptable level, organizations should identify elements that could harm assets, and then implement strategies to prevent any harms to such assets.

Given that employees are commonly considered the weakest link within an organization [10], we will consider them as our assets. Therefore, the harm posed by employees' attitudes and behaviors on social media constitute the vulnerabilities. To quantify the risk, we propose to establish how much each human factor contributes to an increase of the total risk. We suggest considering the percentages stated in Table 8. However, these percentages are only estimates based on the data we have gathered. Policymakers and trainers can be advised by this estimation but can also amend the percentages based on their own experience and the conditions of the organizations they work for.

<table><caption>**Table 8.** Suggested factors percentages for risk assessment.</caption><thead><tr><td>Sub-factors</td><td>Weight</td></tr></thead><tbody><tr><td>Job Role (JR)</td><td>40%</td></tr><tr><td>Age (A)</td><td>30%</td></tr><tr><td>Education Status (ES)</td><td>10%</td></tr><tr><td>Years of Experience (YE)</td><td>10%</td></tr><tr><td>Time Spent (TS)</td><td>10%</td></tr></tbody></table>

We propose using an equation to help policymakers, those developing training materials, and cybersecurity trainers to estimate the level of risk that a particular employee poses while using social media. Our risk weighting equation is stated below—see Eq. 1—and considers the percentages listed in Table 8. We expect this equation to help stakeholders to create applicable social media cybersecurity training and prioritize the training for individuals who are at 'high risk'.

$$ \text{Risk} = (\text{JR} \times 0.4) + (\text{A} \times 0.3) + (\text{ES} \times 0.1) + (\text{YE} \times 0.1) + (\text{TS} \times 0.1) \quad (1) $$
Job role is the most significant factor related to cybersecurity training preferences, perceptions, and needs [14]. Hence, we assign a higher weight to the job role in Table 8 than to any other factor. That is also the reason why employees whose job role is to manage the organization's social media accounts need to be trained extensively.

The output derived from Eq. 1 indicates three different risk scenarios: *low*, *moderate*, and *high risk*. A value of at most 0.35 indicates low risk; a value greater than 0.35 and smaller than 0.65 indicates medium risk; and a value greater than 0.65 indicates high risk. These values are meant to estimate the risk associated with the employees in the organization while they are using social media. We expect this to help prioritize training. Table 9 shows all the risks associated with human factors considered in our study.

<table><caption>**Table 9.** Risk parameters</caption><thead><tr><th>Risk (s)</th><th>Impact</th><th>Probability</th></tr></thead><tbody><tr><td>Job Role(s): 40%</td><td></td><td></td></tr><tr><td>Education and training</td><td>0.4</td><td>0.3</td></tr><tr><td>Computer and technology</td><td>0.4</td><td>0.0</td></tr><tr><td>Healthcare</td><td>0.4</td><td>0.2</td></tr><tr><td>Leadership and management</td><td>0.4</td><td>0.1</td></tr><tr><td>Business and financial</td><td>0.4</td><td>0.4</td></tr><tr><td>Art, sport, entertainment</td><td>0.4</td><td>0.1</td></tr><tr><td>Office and administrative</td><td>0.4</td><td>0.4</td></tr><tr><td>Military</td><td>0.4</td><td>0.2</td></tr><tr><td>Age: 30%</td><td></td><td></td></tr><tr><td>18-25</td><td>0.3</td><td>0.3</td></tr><tr><td>26-35</td><td>0.3</td><td>0.3</td></tr><tr><td>36-45</td><td>0.3</td><td>0.1</td></tr><tr><td>46-55</td><td>0.3</td><td>0.1</td></tr><tr><td>&gt;55</td><td>0.3</td><td>0.3</td></tr><tr><td>Education Status: 10%</td><td></td><td></td></tr><tr><td>&lt;Secondary</td><td>0.1</td><td>0.1</td></tr><tr><td>Secondary</td><td>0.1</td><td>0.1</td></tr><tr><td>Courses, but no degree</td><td>0.1</td><td>0.1</td></tr><tr><td>Bachelor</td><td>0.1</td><td>0.0</td></tr></tbody></table>

(continued)
<table><caption>**Table 9.** (continued)</caption><thead><tr><th>Risk (s)</th><th>Impact</th><th>Probability</th></tr></thead><tbody><tr><td>Postgraduate</td><td>0.1</td><td>0.0</td></tr><tr><td>Years of Experience: 10%</td><td></td><td></td></tr><tr><td>&lt;2 years of experience</td><td>0.1</td><td>0.1</td></tr><tr><td>2-5 years of experience</td><td>0.1</td><td>0.05</td></tr><tr><td>5-10 years of experience</td><td>0.1</td><td>0.05</td></tr><tr><td>10-15 years of experience</td><td>0.1</td><td>0.05</td></tr><tr><td>15-20 years of experience</td><td>0.1</td><td>0.05</td></tr><tr><td>20-25 years of experience</td><td>0.1</td><td>0.00</td></tr><tr><td>&gt;25 years of experience</td><td>0.1</td><td>0.1</td></tr><tr><td>Time Spent on Social Media: 10%</td><td></td><td></td></tr><tr><td>&lt;30 min</td><td>0.1</td><td>0.1</td></tr><tr><td>30-60 min</td><td>0.1</td><td>0.00</td></tr><tr><td>1-2 h</td><td>0.1</td><td>0.00</td></tr><tr><td>2-3 h</td><td>0.1</td><td>0.00</td></tr><tr><td>&gt;3 h</td><td>0.1</td><td>0.1</td></tr></tbody></table>

## 5 Conclusions

The objective of social media is to enable communication and the exchange of ideas. However, employees tend to be unaware of how cybercriminals utilize their information to undertake illicit activities.

Our work supports organizations in building an environment without breaching employees' privacy or imposing restrictions on social media usage that may be illegal. We have identified human factors responsible for the ever-increasing cybersecurity risks. Whilst other researchers have concentrated on hacking and external threats, our work shows that the most crucial factors associated with social media threats within organizations are job roles and the age of the employees. Other human factors, such as educational level, work experience, and the time people spend on social media must also be considered when designing countermeasures.

Employees handling the social media accounts of organizations fall within a different category and the risks associated with them cannot be compared with others. They need special training to maintain the organization's security and deal with cybersecurity incidents. While employees need to be trained based on their job roles, those handling business and financial operations must be prioritized, as they are the riskiest employees, followed by those on administrative roles, and those who handle training and education.

The experience of the employees and their age are other important parameters. The lower the experience, the higher the risk—new employees face higher risks while interacting with social media and they must be given priority.
As employees grow older, they are likely to demonstrate more maturity towards cybersecurity policies. However, as our study reveals, people over 55 need to be prioritized for training. Employees without a bachelor's degree need to be prioritized for training too. Employees spending less time and exceeding three hours daily on social media are likely to be less aware of cybersecurity issues. Thus, they need more training.

Our findings have led us to define an equation to calculate the amount of risk that an organization may face when their employees interact through social media. Policy-makers and training providers can make use of this equation to assess risks for different groups of employees. We recommend examining the risk equation proposed here in other organizations based in other parts of the world. Different settings may highlight other risk elements that need to be taken into account.

## References

1. European Network and Information Security Agency (ENISA). Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity (2019). https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspects-of-cybersecurity

2. Green, J.S.: Cyber Security: An Introduction for Non-Technical Managers. Routledge, London (2016)

3. Herath, T.B., et al.: Cybersecurity practices for social media users: a systematic literature review. J. Cybersecur. Priv. 2(1), 1–18 (2022)

4. European Network and Information Security Agency (ENISA). Cyber Europ 2010 – Evaluation Report (2010). https://www.enisa.europa.eu/publications/ce2010report/at_download/fulIReport

5. Alshaikh, M., Naseer, H., Ahmad, A., Maynard, S.B.: Toward sustainable behaviour change: an approach for cyber security education training and awareness. In: Proceedings of the 27th European Conference on Information Systems, pp. 1–14 (2019)

6. Zhang, Z., Gupta, B.B.: Social media security and trustworthiness: overview and new direction. Futur. Gener. Comput. Syst. 86, 914–925 (2018)

7. Thakur, K., Hayajneh, T., Tseng, J.: Cyber security in social media: challenges and the way forward. IT Prof. 21, 41–49 (2019)

8. Alshaikh, M., Maynard, S.B., Ahmad, A., Chang, S.: An exploratory study of current information security training and awareness practices in organizations. In: Proceedings of the 51st Hawaii International Conference on System Sciences, pp. 5085–5094 (2018)

9. Ghazvini, A., Shukur, Z.: Awareness training transfer and information security content development for healthcare industry. Int. J. Adv. Comput. Sci. Appl. 7 (2016)

10. Chapple, M., Stewart, J.M., Gibson, D.: Certified Information System Security Professional (CISSP), 9th edn., p. 1248. SYBEX (2021)

11. Rajamäki, J., Nevmerzhitskaya, J., Virág, C.: cybersecurity education and training in hospitals: proactive resilience educational 354 framework (prosilience EF). In: Proceedings of the 2018 IEEE Global Engineering Education Conference (EDUCON), pp. 2042–2046. IEEE (2018)

12. Nurse, J.R., Creese, S., De Roure, D.: Security risk assessment in internet of things systems. IT prof. 19, 20–26 (2017)

13. King, Z.M., Henshel, D.S., Flora, L., Cains, M.G., Hoffman, B., Sample, C.: Characterizing and measuring maliciousness for cybersecurity risk assessment. Front. Psychol. 9, 39 (2018)

14. Ben Salamah, F., Palomino, M.A., Papadaki, M., Furnell, S.: The importance of the job role in social media cybersecurity training. In: Proceedings of the IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp. 454–462 (2022). https://doi.org/10.1109/EuroSPW55150.2022.00054
15. Cain, A.A., Edwards, M.E., Still, J.D.: An exploratory study of cyber hygiene behaviors and knowledge. J. Inf. Secur. Appl. **42**, 36–45 (2018)

16. Parker, H.J., Flowerday, S.V.: Contributing factors to increased susceptibility to social media phishing attacks. South Afr. J. Inf. Manage. **22**, 1–10 (2020)

17. Furnell, S., Vasileiou, I.: Security education and awareness: just let them burn? Netw. Secur. **2017**, 5–9 (2017)

18. Blackwood-Brown, C., Levy, Y., D'Arcy, J.: Cybersecurity awareness and skills of senior citizens: a motivation perspective. J. Comput. Inf. Syst. **61**, 195–206 (2021)

19. Hadlington, L.: Employees attitudes towards cyber security and risky online behaviours: an empirical assessment in the United Kingdom. Int. J. Cyber Criminol. **12**, 262–274 (2018)

20. Hatzivasilis, G., et al.: Modern aspects of cyber-security training and continuous adaptation of programmes to trainees. Appl. Sci. **10**, 5702 (2020)

21. Pedley, D., et al.: Cyber Security Skills in the UK Labour Market 2020 (2020). https://www.gov.uk/government/publications/cyber-security-skills-in-the-uk-labour-market-2020

22. Toth, P., Klein, P.: A role-based model for federal information technology/cyber security training. NIST Spec. Publ. **388**(800), 1–152 (2013)

23. Nifakos, S., et al.: Influence of human factors on cyber security within healthcare organisations: a systematic review. Sensors **21**, 5119 (2021)

24. Van Schaik, P., et al.: Security and privacy in online social networking: risk perceptions and precautionary behaviour. Comput. Hum. Behav. **78**, 283–297 (2018)

25. Jeong, J., Mihelcic, J., Oliver, G., Rudolph, C.: Towards an improved understanding of human factors in cybersecurity. In: Proceedings of the 5th International Conference on Collaboration and Internet Computing (CIC), pp. 338–345 (2019). https://doi.org/10.1109/CIC48465.2019.00047

26. Dulock, H.L.: Research design: descriptive research. J. Pediatr. Oncol. Nurs. **10**, 154–157 (1993)

27. Castro, S.: Google forms quizzes and substitution, augmentation, modification, and redefinition (SAMR) model integration. Issues Trends Educ. Technol. **6**(2) (2018)

28. University of Plymouth. Plymouth Ethics Online System (PEOS) (2022). https://www.plymouth.ac.uk/research/plymouth-ethics-online-system

29. Alansari, M.M., Aljazzaf, Z.M., Sarfraz, M.: On cyber crimes and cyber security. In: Developments in Information Security and Cybernetic Wars, pp. 1–41. IGI Global (2019)

30. Cleary, G., Corpin, M., Cox, O.: Symantec internet security threat report. Technical report 23, Symantec Corporation, Mountain View, CA (2018). https://docs.broadcom.com/doc/istr-23-executive-summary-en

31. European Union Agency for Cybersecurity. Stocktaking of Information Security Training Needs in Critical Sectors (2017). https://www.enisa.europa.eu/news/enisa-news/

32. Kuwait Central Statistical Bureau. Population Estimates (2021). https://www.csb.gov.kw/Pages/Statistics?ID=18&ParentCatID=2

33. Calculator.net. Confidence Interval Calculator (2022). https://www.calculator.net/confidence-interval-calculator.html

34. McHugh, M.L.: The chi-square test of independence. Biochem. Med. **23**, 143–149 (2013)