## 3 Challenges of Trying to Keep a Step Ahead
### Considerations with Social Engineering Training and Awareness Programs
#### 3.1.6 Personal  
Personality traits are the inherent characteristics of an individual that may pose a threat to training and awareness programs' effectiveness against socially engineered attacks. Social engineers selectively choose their method of attack based on the personality of the targeted employee [48]. Hackers use different psychological methods to specifically recognize the behavioral vulnerabilities of victims. The study by [PERSON] et al. [49] indicates that hackers may even use the technique of moral obligatory guilt to ensure that people act upon the bait. Additionally, the differences in personality of staff even influence the form of reaction that an employee may have to the attempt of social engineering exploits [50]. Reference [51] highlights neuroticism, which is the affinity to experience intimidating emotions easily, such as anxiety, anger, vulnerability, or depression, as being highly correlated to chances of responding to phishing emails. Further, employees who are extroverts and seek excitement are also assertive and may give out information easily. Lastly, openness as a personality trait means that employees are ready to try new things, leaving personal information and digital footprints for hackers to work their way through into their organizations [26; 28; 52]. The trusting nature of human beings can also be a huge challenge to awareness programs against social engineering threats. Physical and data security of individuals and organizations needs to be taken more seriously by individuals in an organization [48; 49; 50]. Because of the amount of trust individuals have in their organizations' IT infrastructures, employees do not consider security as a threat. Organizations need to include training materials to cover the trust gaps that individuals usually have by nature [51]. The trust challenge of staff can be prevented through effective and comprehensive information security training and awareness programs. However, in some cases, organizations provide limited resources to train their staff to cover the minimum harms that can be caused by social engineering attacks [50]. The concept of not needing more security training has become a major factor that challenges effective safety against social engineering threats. As a result, there is a lack of awareness among professionals to cover the trust gap that can be minimized by more awareness campaigns. This gap can create a great opportunity for social engineers to target them easily. Another factor that poses a challenge for training and awareness programs against social engineering is the lack of interest found in personnel in general. Individuals often lack personal motivation to be trained on a regular basis to protect themselves and their organizations [52]. The concept of security awareness has most often fallen on deaf ears despite the common occurrence of individuals being attacked for information and data relating to their personal and professional roles. This lack of interest has also been reflected in literature such as [PERSON] [53], who shows that user education relating to security awareness is pointless, as individuals do not show enough interest. [PERSON] also highlights that this lack of interest can be seen as end-users do not think security is their concern. Rather, employees think that security personnel should be in charge and responsible for taking care of any security threat that their organization might face. As a result, lack of interest of individuals relating to social engineering threats becomes a very important factor that challenges effective training and awareness of staff [54]. Different personal capabilities of understanding the types of malicious intent of social engineering attacks creates another big challenge in awareness programs [55]. In the past, the approaches of social engineering techniques were more straightforward than they are today. They used to be poorly veiled, which provided individuals understanding of the nature of such attacks.