Julian Pablo

CYSE 201S

Professor Trinity Woodbury

Due Date: October 6, 2026

Article Review #2

Intro

            The article I examined is named “Hacking Humans? Social Engineering and the Construction of the “Deficient User” in Cybersecurity Discourses.” This goes over how organizations shift a majority of the flaws and blame to specific individuals/workers rather than the system or collective company.

Principles

            The article is able to maintain skepticism against the common belief of a company user named the weakest link or deficient user; the main argument tries not shift all the blame on the “weak link” but rather try focus on the collective flaws and improvement of the companies. Objectivity is also maintained by having diverse sources from multiple conferences like Black Hat and Vienna Cyber Security Week. Parsimony is also essential to how the author argues people oversimplify causes of social engineering attack to just the weakest link instead of other possible vulnerabilities like weak technical/software defenses.

Question/Hypothesis

            The question the articles tries to answer is how the focus of individual versus collective security by cybersecurity experts redefine roles and responsibilities at the digitalized workplace. The articles hypothesis/argument is that organizations identify people as the weakest link in order to shift the blame of security breaches like social engineering onto individuals rather than corporate responsibility.

Research Method

            The methods used was a mix of fieldwork and interviews across three difference conference such as Black Hat, Defcon, and Vienna Cybersecurity Week. This allowed diverse perspectives of different cyber professionals like journalists, hackers, IT, ect.

Data Collected

            The data collected was qualitative data mainly about commentaries on the human factors and affects of social engineering. This data was put into vivo and axel coding software in order to find common trend/storylines to synthesize.

Concepts

            The main concept the article runs on human factors and how an organization people and technology design relate. However, this article leans towards the negative side of overfocusing on the blame of the people rather than having attention on the technical side. This would relate to the social cultural school of psychology as well because the focused blame on individuals come from the environment/companies labeling of the weakest link.

            This article can also relate to victimology due to the treatment of victims. One of the key components of victimology is making the victims feel safe/secure, but companies instead slap a label onto the victims and shift the blame of cyber breaches fully on them. The power dynamic of corporate shifting this blame to lower individuals perfectly represent the social paradigm of conflict theory.

Marginalized Groups Problems

            The marginalized group this article focuses on are the lower-class workers within the company space. The first problem it address is the power dynamic between them and the corporate level. The lower class are the ones that are fully at fault for cyber breaches and social engineering attacks without having any say on the security policies as well.

            The other problem is the amount of pressure and humiliation people with less security knowledge end up getting. The idea of Cyber Risk Index makes it easy for companies to turn away “risky” people at the expense of embarrassing the people who may have less general experience with cybersecurity., but in the end they’re stuck with the title of weakest link.

Societal Impact

            Overall, the article does a great way of making people rethink giving people labels such as the weakest link. While it’s true there will always be one, putting that label ends up ostracizing these people from the rest of workplace.

            The other impact is trying to look at improvements from a whole perspective rather than individual blaming. People have been recognized as a core component in cybersecurity with integration of social science research. However, that shouldn’t take away from the improvement of all the core technical and group components of cybersecurity.

Reference

Klimburg-Witjes, N., & Wentland, A. (2021). Hacking humans? Social Engineering and the construction of the “deficient user” in cybersecurity discourses. Science, Technology, & Human Values, 46(6), 1316–1339. https://doi.org/10.1177/0162243921992844