Human Culture Security Assessment (HCSA): An Ethnographic Framework for Assessing Organizational Cultural Vulnerability to Social Engineering

Abstract

The study of cybersecurity has traditionally been dominated by a technical perspective. Yet the human factor remains one of its great unresolved challenges. The emergence of artificial intelligence makes this challenge increasingly urgent. AI lowers the cost of producing highly personalized and scalable social-engineering attacks, expanding the capacity to manipulate people through trust, authority, urgency, familiarity, and other social mechanisms. The sector has traditionally responded through awareness, training, and individual responsibility. But individuals do not act in isolation. Their decisions and behaviors are shaped by the organizational cultures in which they work: by routines, incentives, hierarchies, assumptions, relationships, and shared understandings of risk. Addressing the human dimension of cybersecurity therefore requires moving beyond the individual and asking a broader question: how does organizational culture shape vulnerability to social engineering? This paper proposes the Human Culture Security Assessment (HCSA), a qualitative and ethnographic framework for assessing organizational cultural vulnerability to social engineering. The framework combines six cultural dimensions with five forms of adversarial pressure and introduces the concepts of dominant pressure and the pressure chain. It brings together declarative, observational, and adversarial evidence to examine the relationship between what organizations say about their security culture, how that culture is enacted in practice, and how it responds under pressure. HCSA is intended to provide a new analytical perspective for studying the cultural dimension of cybersecurity, identifying patterns of vulnerability, and establishing a foundation for future empirical research and the development of assessment tools. Version 2.0 presents the framework as a theoretically grounded research proposal, pending empirical validation, and as the starting point for a broader doctoral research program.