Improved Human-Centric Cyber security Framework for Protecting Home users from Social Engineering Attacks

Abstract

Social engineering attacks remain a major cybersecurity threat, especially among home users who do not have the well-developed security policies typically found in organizations. Despite the fact that current countermeasures are primarily focused on technical defences, there is increasing evidence that the strategies are no longer adequate in the light of attacks that rely on human cognition, emotion, and behaviour. The problem addressed in this study is the inefficiency of existing cybersecurity measures in preventing social engineering attacks against home users, necessitating the development of an improved cybersecurity approach to address gaps identified in the literature. The qualitative research design was chosen and semi-structured interviews with cybersecurity professionals were carried out using the purposive sampling method. Thematic analysis was used to identify existing threats, anticipated future risks, and mitigation strategies. Results indicate that phishing, vishing, and smishing are the most prevalent attack vectors affecting home users, and their sophistication has been increasing due to personalisation, artificial intelligence, and impersonation techniques. Experts argued that technical solutions alone are insufficient; continuous user awareness, behavioural adaptation, and contextual understanding are therefore imperative to improve resilience. The research develops a more human-centred cybersecurity framework that integrates cognitive, behavioural, psychological, and contextual variables with applicable technological controls. The framework does this by positioning home users as stakeholders in the fight against cybersecurity offences and by establishing a culture of adaptive cybersecurity, which provides a less inherently unsustainable means of addressing evolving social engineering challenges. Although the framework remains conceptual and has not yet been empirically validated in a home setting, it provides a systematic basis for further research and for the practice of home-user cybersecurity. It is suggested that future research be conducted to empirically validate the framework in large populations and in new threat situations.