The DOI matches its Crossref record; 118 of the 122 references it cites were found in a registry or an index, and 4 are not checked yet.
Human Cognition Through the Lens of Social Engineering Cyberattacks
Open accessAbstract
Social engineering cyberattacks are a major threat because they often prelude sophisticated and devastating cyberattacks. Social engineering cyberattacks are a kind of psychological attack that exploits weaknesses in human cognitive functions. Adequate defense against social engineering cyberattacks requires a deeper understanding of what aspects of human cognition are exploited by these cyberattacks, why humans are susceptible to these cyberattacks, and how we can minimize or at least mitigate their damage. These questions have received some amount of attention but the state-of-the-art understanding is superficial and scattered in the literature. In this paper, we review human cognition through the lens of social engineering cyberattacks. Then, we propose an extended framework of human cognitive functions to accommodate social engineering cyberattacks. We cast existing studies on various aspects of social engineering cyberattacks into the extended framework, while drawing a number of insights that represent the current understanding and shed light on future research directions. The extended framework might inspire future research endeavor towards a new sub-field that can be called {\em Cybersecurity Cognitive Psychology}, which tailors or adapts principles of Cognitive Psychology to the cybersecurity domain while embracing new notions and concepts that are unique to the cybersecurity domain.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“A fundamentally important mitigation strategy against social engineering attacks is to strengthen human users through education (Montañez et al., 2020).”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Montañez et al., 2020
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Tversky, A., & Kahneman, D. (1974) · Science · doi:10.1126/science.185.4157.1124 · Cited by 28,810 · cited 1×
“The first is by relatively automatic processes that are fast but may not be the optimal choice in some instances (termed “heuristics” and “biases”) [Tversky and Kahneman, 1974, Gigerenzer, 2008].”
BackgroundJudgment under Uncertainty: Heuristics and Biases
Tversky, A., & Kahneman, D. (1975) · Utility, Probability, and Human Decision Making · doi:10.1007/978-94-010-1834-0_8 · Cited by 22,650
Telling more than we can know: Verbal reports on mental processes.
Nisbett, R. E., & Wilson, T. D. (1977) · Psychological Review · doi:10.1037/0033-295x.84.3.231 · Cited by 11,317 · cited 1×
“It is known that most of the brain’s information processing is sealed-off from conscious awareness [Nisbett and Wilson, 1977], some permanently while other information could be consciously appreciated, but may not be conscious at a given moment.”
BackgroundKruger, J., & Dunning, D. (1999) · Journal of Personality and Social Psychology · doi:10.1037/0022-3514.77.6.1121 · Cited by 7,731
Effects of stress throughout the lifespan on the brain, behaviour and cognition
Lupien, S. J., McEwen, B. S., Gunnar, M. R., & Heim, C. (2009) · Nature Reviews Neuroscience · doi:10.1038/nrn2639 · Cited by 6,256
Dual-Processing Accounts of Reasoning, Judgment, and Social Cognition
Evans, J. S. B. T. (2008) · Annual Review of Psychology · doi:10.1146/annurev.psych.59.103006.093629 · Cited by 5,137
Cultures and organizations: software of the mind
(1992) · Choice Reviews Online · doi:10.5860/choice.29-4203 · Cited by 3,703
The Synaptic Organization of the Brain
(2004) · Oxford University Press eBooks · doi:10.1093/acprof:oso/9780195159561.001.1 · Cited by 3,574
Henry, M. A. (1995) · The Journal of the American Dental Association · doi:10.14219/jada.archive.1995.0108 · Cited by 3,454
Stress signalling pathways that impair prefrontal cortex structure and function
Arnsten, A. F. T. (2009) · Nature Reviews Neuroscience · doi:10.1038/nrn2648 · Cited by 3,299
Flagged first, then by citations
Research works printed but not linked: 9
- Anderson, 2008, Security Engineering: A Guide to Building Dependable Distributed Systems, 2nd Edn
- Cho, 2019, STRAM: Measuring the trustworthiness of computer-based systems, 51
- Damon, 2006, Handbook of Child Psychology, Cognition, Perception, and Language
- Hutchins, 2011, Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains, Lead. Issues Inform. Warfare Secur. Res, 1, 80
- Jakobsson, 2007, The human factor in phishing, Privacy Secur. Cons. Inform, 7, 1
- Kahneman, 2011, Thinking, Fast and Slow
- McBride, 2012, Exploring the role of individual employee characteristics and personality on employee compliance with cybersecurity policies, RTI Int. Instit. Homeland Secur. Solut, 5, 1
- Pinker, 2009, How the Mind Works (1997/2009)
- Stajano, 2009, Understanding Scam Victims: Seven Principles for Systems Security
Cited by
Sorted by citations
Items 101–107 of 107
Miao, W., Zhu, H., Gong, J., Chen, Y., Feng, Y., Hu, L., & Shen, H. (2026) · Journal of Broadcasting & Electronic Media · doi:10.1080/08838151.2026.2725007
Roghanizad, M., Choi, E., Mashatan, A., & Turetken, O. (2026) · Behaviour and Information Technology · doi:10.1080/0144929x.2026.2714169
Persuasion triggers in smishing messages: A content analysis
Abraham, R., Sreeja, C. S., & Rajan, S. K. (2026) · Journal of Human Behavior in the Social Environment · doi:10.1080/10911359.2026.2734528
Norton, C., Ruhwanya, Z., & Ophoff, J. (2026) · Information and Computer Security · doi:10.1108/ics-02-2026-0050
Reffgen, C. (2026) · Edition <kes> · doi:10.1007/978-3-658-52559-0_8
Reffgen, C. (2026) · Edition <kes> · doi:10.1007/978-3-658-52559-0_12
Metadata
- Authors
- Montañez, R., Golob, E., & Xu, S.
- Affiliations
- The University of Texas at San Antonio (US)
- Corresponding author
- Xu, Shouhuai
- Venue
- Frontiers in Psychology
- Publisher
- Frontiers Media SA
- Published
- 2020-09-30
- Volume
- 11
- Pages
- 1755-1755
- ISSN
- 1664-1078 (ISSN-L)
- PMC
- PMC7554349
- OpenAlex
- W3091679231
- Cited by
- 106
- References
- 119
- Citations by year
- 2026: 21 · 2025: 26 · 2024: 23 · 2023: 17 · 2022: 9 · 2021: 8 · 2020: 2
- FWCI
- 1.31
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Frontiers in Psychology (publishedVersion, cc-by)
- PubMed Central (publishedVersion, cc-by)
- PubMed (publishedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- National Science Foundation (1736209, 1814825)
- Army Research Office (W911NF-17, W911NF-17-1-0566, W911NF)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Keywords
- human cognition, cognitive psychology, cybersecurity, human factors in cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
