Predicting individual differences to cyber attacks: Knowledge, arousal, emotional and trust responses

Abstract

Cyber attacks are increasingly commonplace and cause significant disruption, and therefore, have been a focus of much research. The objective of this research was to understand the factors that might lead users to fail to recognize red flags and succumb to cyber events. We investigated users’ knowledge of cyber attacks, their propensity to trust technology, arousal, emotional valence, and situational trust in response to different types and severity of cyber attacks. Our findings suggest that high-risk attacks elicited more arousal and more negative emotional valence than low-risk attacks. The attack-type manipulation revealed that phishing scenarios yielded distinctive patterns, including weaker affective responses than ransomware and other malware. The authors further examined arousal, emotional valence, and situational trust patterns among the subset of high- knowledge participants who successfully identified all the attacks and compared these responses with those of less knowledgeable peers. Our findings suggest that the more knowledgeable the user, the higher was their general propensity to trust technology, the more sensitive were their emotional responses to the manipulation of risk, and the lower their situational trust when faced with cyber attack scenarios.

Victim’s Negative Emotion Processes In Cybersecurity Breach Situations: A Testimony of Anger and Fear-Related Emotion Processes

“…In this study, we took an explorative stance to probe the scope of the experiences that ensue from cybersecurity breach situations of connected technology, including IoT devices, smartphones, computers, and communication technology (social networks, email). Although largely exploratory, we used a theory-driven approach, by structuring the open questions and analyzing the responses using categories from emotion theories (Connor-Smith & Flachsbart, 2007;Fontaine et al, 2013;Scherer, 2001) While previous studies explored only one component of emotion experiences towards cyber-security breach situations, namely subjective feelings such as anger or emotion dimension such as emotional arousal (Canetti et al, 2017;Oulasvirta et al, 2012;Pyke et al, 2021;Symantec, 2011), we went further by also exploring appraisals, bodily reactions, expressions and action tendencies. This approach allowed us to explore all facets of emotion experiences in cybersecurity breach situations.…”

“…A leading security company reported such short-term consequences to lead to anger, annoyance, the feeling of being cheated, upset, frustration, and other negative emotions (Symantec, 2010). Recently published scientific research investigating affective reactions to hypothetical cyber-attack scenarios reported that high negative emotional valence and arousal are found for attacks (Pyke et al, 2021). Also, it has been argued that more severe consequences of cybersecurity breaches can even lead to suicide (Baraniuk, 2015).…”

Prediction of moment‐by‐moment heart rate and skin conductance changes in the context of varying emotional arousal

“…Acknowledging that there is a difference in the number of data points evaluated for each of these analyses. However, these approaches are still on par with recent studies addressing similar questions (Compton et al, 2022; Pyke et al, 2021; Sun et al, 2022). In addition, conducting these experiments in different ways is important to understand the variability of these ANS responses across different participants/groups.…”

Are You a Soft Target for Cyber Attack? Drivers of Susceptibility to Social Engineering-Based Cyber Attack (SECA): A Case Study of Mobile Messaging Application

“…Moreover, trust in technology is also identified as important variable which might contribute to one's susceptibility to cyber attack. The study of Pyke et al [32] showed that propensity to trust is linked to the severity of cyber attacks. The current study aimed at differentiating between trust to the provider of technology (in this case, a social media provider) and trust to the member of the network (H 6 and H 7 ).…”