Beyond Cognitive Bias And Digital Literacy

The talk questions the common explanation that people fall for social engineering because they lack knowledge, digital literacy or sound judgment. Drawing on public health experience, the speaker notes that what people know and how they behave are different things. A review of 11 systematic reviews on social engineering found only two that examined psychological predictors. Knowledge and awareness had the most consistent support, while evidence for cognitive factors was mixed or contradictory.

The speaker then turns to trauma, distinguishing simple PTSD from complex trauma that results from prolonged, human-caused harm such as childhood abuse. She explains how early attachment relationships build an internal model that calibrates trust and threat before reasoning develops. A systematic review by the speaker and a student found that childhood abuse is consistently linked to online harm, both as victimization and as participation. The speaker proposes that altered trust, threat sensitivity, dissociation and learned obedience to authority could shape susceptibility to catfishing, targeted phishing and relationship-based lures. She stresses this remains a hypothesis that has not been tested directly.

For practitioners, the takeaway is that more research is needed before these links can guide controls. The speaker suggests that industry education should pair digital literacy with mental health literacy, and that design solutions should account for users with such experiences. She recommends working with designers on these questions.