Anti-Social Engineering Security Awareness Training: A Qualitative Analysis

It has become standard practice in organizational settings to require members to participate in security awareness training, including education on various deception-based strategies, commonly called “social engineering” attacks. Despite recent inroads, scholars and practitioners still struggle to create truly effective training programs. Through an analysis of semi-structured qualitative interviews conducted with IT administrators, security auditors, and nonprofessional social engineers (n = 54), this study assesses the qualities of effective social engineering security awareness programs from a boots-on-the-ground perspective. Effective programs were described as implemented frequently, using a diverse array of strategies, and conducted in an engaging and coherent manner. They also recommend that program content cover descriptions of cybersecurity threats, the logic of organizational security policies, proper response protocols to adverse security events, the consequences of failure to adhere to policy, techniques for detecting or avoiding social engineering deceptions, and engaging in mindful decision-making. Implications for policy, practice, and future research are considered.