Vulnerability to Social Engineering Across Digital User Generations: A Dual-Theory Approach

Cybersecurity studies lack data on the relative vulnerability of user generations of information and communication technologies (ICTs) to social engineering, i.e., to ill-intentioned ICT-mediated actions aimed at stealing one’s private information by means of deception strategies. To fill this gap, we draw on three frameworks about vulnerability to social engineering and develop a process model inspired by the routine activity theory and the source-path-goal metaphor. We also developed a psychometric instrument to measure vulnerability, with which we collected data from 306 ICT users ranging from 16 to 85 years of age to analyze whether social engineers take advantage of inequalities among ICT user generations. Contrary to established knowledge, older adults did not manifest statistically significant greater vulnerability than younger ones to ICT-mediated social engineering attacks. The reasons are arguably related to five enablers of personal security awareness, as follows: (i) the intensive use of ICTs by people of all ages in contemporary society, (ii) older adults’ greater wisdom, crystallized intelligence, and mindfulness, (iii) greater abstract reasoning and foresight developed through professional life, (iv) formal education, and (v) massively available information about social engineering.