Cybersecurity Awareness and Social Engineering Vulnerabilities Among Public Sector Employees in Saudi Arabia: An Empirical Assessment

As cyber threats increasingly target human vulnerabilities, understanding behavioural and organisational factors is vital for strengthening resilience. This study investigates cybersecurity awareness and social engineering vulnerabilities among public sector employees in Saudi Arabia, a context characterised by rapid digital transformation and heightened exposure to cyber threats. Despite significant national investment in cybersecurity, human-centred vulnerabilities remain a dominant cause of security breaches. Drawing on Protection Motivation Theory (PMT) and the Theory of Planned Behaviour (TPB), the study examines behavioural determinants of secure practices and evaluates the influence of organisational culture, policies, and training. A quantitative, positivist research design was employed, using a structured online survey distributed to public sector employees. Data were analysed using descriptive statistics, correlation analysis, t-tests, and regression modelling. Findings indicate that cybersecurity training, organisational policy clarity, and supportive organisational culture significantly enhance cybersecurity awareness, while notable gaps persist in recognising and responding to social engineering attacks such as phishing, pretexting, and baiting. The study provides empirical evidence on human-factor vulnerabilities within a critical national sector and highlights the need for continuous, context-specific training and policy reinforcement. Recommendations include adaptive awareness programmes, integration of simulated attack exercises, and alignment of organisational practices with established frameworks such as NIST SATE and HAIS-Q. The results support the development of resilient cybersecurity ecosystems within public institutions and advance an engineering-oriented understanding of socio-technical security risks.