From Prey to Protect: Exploring Social Engineering Through Games and Simulation. Trust, Awareness, and Phishing Defense

Context: Social engineering attacks exploit human vulnerabilities rather than technical weaknesses, manipulating individuals to divulge confidential information or grant unauthorized access. As these attacks grow more sophisticated, there is an urgent need to understand their propagation and devise effective countermeasures. Objectives: This study aims to investigate the dynamics of social engineering attack propagation using agent-based modeling and simulation. Furthermore, it seeks to apply this understanding to design, develop, and evaluate human-centered, game-based learning tools that promote cybersecurity awareness and trust. Methods: A multifaceted approach was adopted. The i* model was utilized to analyze relationships and interactions in attack scenarios. Next, the NetLogo platform simulated attacker and victim agents within virtual environments, exploring attack intensity and population resilience. Insights from these simulations informed the conceptualization and development of interactive educational activities (both card-based and digital). The effectiveness of these tools was assessed through observation, discussions, brainstorming, and survey analyses. Results: Simulations revealed that high-intensity attacks can overwhelm even well-informed populations, causing significant declines in system health. In contrast, populations with higher baseline knowledge demonstrated resilience against low-intensity attacks. Preliminary assessments of the game-based learning tools showed positive impacts on participant understanding and engagement. Additional evaluations are needed to confirm their generalizability. Conclusion: The findings emphasize the need for integrative strategies combining cybersecurity education, privacy awareness, and public health approaches. The adaptable simulation model offers a robust framework for exploring the societal impact of social engineering attacks. The proposed game-based activities serve as valuable tools for fostering trust and educating individuals on the prevention of such attacks.