Human Factors in Cybersecurity

Active learning works for this topic because human-centered cybersecurity is about behavior, not just knowledge. Students need to practice recognizing manipulation tactics and making decisions under realistic pressure to internalize why human factors matter.

• 9th Grade
• Computer Science
• 4 activities
• 20 min–40 min

Learning Objectives

1. Analyze common social engineering techniques, identifying the psychological principles exploited in each.
2. Evaluate the effectiveness of various human-centric cybersecurity training methods.
3. Design a cybersecurity awareness campaign for a specific audience, incorporating at least three different attack vectors.
4. Explain why human error is often the primary cause of security breaches, citing at least two specific examples.
5. Compare and contrast technical security measures with human-based defenses against cyber threats.

Role Play

⏱ 25 min·Pairs

Role-Play: Social Engineering Scenarios

Students work in pairs. One plays an attacker using a pretexting script, such as 'Hi, I'm from IT -- I need your password to fix your account.' The other plays the target, practicing how to verify the caller's identity and decline the request safely. Groups debrief on which techniques felt most convincing.

Prepare & details

Explain how human factors contribute more to security breaches than technical failures.

Facilitation Tip: During Role-Play: Social Engineering Scenarios, assign specific roles so students experience the emotional triggers attackers use, such as urgency or flattery, in a low-stakes environment.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 40 min·Small Groups

Collaborative Design: Security Awareness Campaign

Groups design a three-part security awareness program for their school: a poster, a five-minute activity, and a quick-reference card. They present their programs and the class votes on which is most likely to actually change behavior and why.

Prepare & details

Analyze common social engineering techniques used in cyberattacks.

Facilitation Tip: When facilitating Collaborative Design: Security Awareness Campaign, rotate student teams through different campaign elements so they see how messaging changes for different audiences.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Case Study Analysis

⏱ 30 min·Small Groups

Case Study Analysis: Inside the Human Breach

Groups analyze the 2011 RSA SecurID breach, in which an employee opened a phishing email titled '2011 Recruitment Plan.' They identify every human decision point where the attack could have been stopped and propose process changes for each.

Prepare & details

Design a training program to improve human cybersecurity awareness.

Facilitation Tip: In Case Study Analysis: Inside the Human Breach, have students annotate the timeline of events with psychological triggers they identify in the breach narrative.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Think-Pair-Share

⏱ 20 min·Pairs

Think-Pair-Share: Why Do People Fall For It?

Students individually list three cognitive biases that social engineers exploit, such as urgency, authority, or familiarity. Pairs combine their lists and find examples of each in real phishing messages. The class builds a master list of psychological levers attackers use.

Prepare & details

Explain how human factors contribute more to security breaches than technical failures.

Facilitation Tip: Use Think-Pair-Share: Why Do People Fall For It? to first isolate individual assumptions, then build consensus in small groups before whole-class discussion.

Setup: Standard classroom seating; students turn to a neighbor

Materials: Discussion prompt (projected or printed), Optional: recording sheet for pairs

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

Teaching This Topic

Experienced teachers approach this topic by normalizing mistakes and reframing ‘human error’ as a predictable outcome of cognitive shortcuts. Avoid shaming students for falling for fake scenarios; instead, use those moments to teach resilience. Research shows that scenario-based practice reduces real-world vulnerability more than lectures alone. Keep the tone practical and solution-focused.

What to Expect

Successful learning looks like students applying critical thinking to real-world scenarios, designing clear security messages for peers, and articulating why humans are the weakest link in cybersecurity. They should move from passive awareness to active defense.

Watch Out for These Misconceptions

Common Misconception

During Role-Play: Social Engineering Scenarios, watch for students assuming only careless or uneducated people fall for phishing. Redirect by having them debrief after each role-play, highlighting how even IT professionals get tricked by well-crafted spear-phishing emails.

What to Teach Instead

During Role-Play: Social Engineering Scenarios, use the debrief to point out that attackers exploit universal human traits like urgency and authority, which affect everyone. Share real-world examples of security researchers being phished to normalize vulnerability.

Common Misconception

During Collaborative Design: Security Awareness Campaign, watch for students believing better software will eliminate the human problem. Redirect by asking them to research high-profile breaches caused by human error and present findings to the class.

What to Teach Instead

During Collaborative Design: Security Awareness Campaign, have students include a slide in their campaign about why software alone cannot fix human psychology. Use case studies like the 2016 Democratic National Committee breach to illustrate this point.

Assessment Ideas

Exit Ticket

After Role-Play: Social Engineering Scenarios, provide students with three short scenarios describing potential cyber threats. Ask them to identify the type of social engineering attack in each scenario and explain one specific action they would take to avoid falling victim.

Quick Check

During Collaborative Design: Security Awareness Campaign, present students with a simulated phishing email. Ask them to highlight at least three red flags that indicate the email is malicious and explain why each is a warning sign.

Discussion Prompt

After Think-Pair-Share: Why Do People Fall For It?, facilitate a class discussion using the prompt: 'Imagine you receive a phone call from someone claiming to be from your internet provider, stating your service will be disconnected unless you immediately provide your account password. How would you respond, and why is this a common social engineering tactic?'

Extensions & Scaffolding

• Challenge students who finish early to design a two-minute ‘security tip’ video targeting a specific cognitive bias like authority or scarcity.
• Scaffolding: For students who struggle, provide a word bank of social engineering tactics and sentence starters to structure their role-play responses.
• Deeper exploration: Invite a cybersecurity professional to share a lived example of a breach caused by human error, then have students map the attack chain to psychological triggers.

Key Vocabulary

Phishing	A type of social engineering attack where attackers impersonate legitimate entities via email, text, or other communication to trick individuals into revealing sensitive information or downloading malware.
Social Engineering	The psychological manipulation of people into performing actions or divulging confidential information, rather than hacking into systems.
Vishing	Voice phishing, a social engineering attack conducted over the phone, often impersonating trusted organizations or individuals to extract information.
Pretexting	A social engineering technique where an attacker creates a fabricated scenario or pretext to gain trust and elicit information or access from a victim.
Baiting	A social engineering tactic that lures victims into a trap by offering something enticing, such as a free download or a physical object like a malware-infected USB drive.