Cybersecurity resilience is widely understood to rest on the integration of people, processes, and technology. However, existing cybersecurity research and practice have largely prioritized technological controls and procedural safeguards, often underestimating the human factor, which consistently represents the most exploited point of attack. This study addresses this gap by developing a comprehensive and quantifiable model for assessing human-induced cybersecurity risks. The paper introduces the Cybersecurity Human Vulnerabilities Exposure Index (CSHVEI), a novel framework designed to measure and operationalize human-related cyber exposure within Microfinance Institutions (MFIs) in Nairobi County, Kenya. Building on a critical review of existing cybersecurity exposure models and standards, including ISO/IEC 27001 and the NIST Cybersecurity Framework, the study identifies key limitations in capturing human-centric vulnerabilities. To address these shortcomings, the CSHVEI categorizes human-induced risks into three core domains: human error, ignorance, and negligence. Using a mixed-methods approach, the study integrates an integrative literature review with empirical survey data to derive, validate, and weight the index components. Statistical analyses confirm the significant contribution of all three vulnerability domains to overall cybersecurity exposure, with negligence emerging as the strongest predictor. The model is further operationalized through a prototype system that demonstrates practical application, enabling organizations to compute exposure scores, visualize risk levels, and generate targeted mitigation recommendations. The findings demonstrate that human behavior is a dominant determinant of cybersecurity exposure in MFIs, often overriding the presence of technical controls. By translating human vulnerabilities into measurable exposure metrics, the CSHVEI provides organizations and policymakers with an evidence-based tool to assess, compare, and manage human-centric cybersecurity risks, thereby strengthening organizational resilience and informed decision-making.
References
[1]
Too, W.K. and Kibet, A. (2025) The Defensive Cyber Security Readiness Model for Higher Education. InternationalJournalofInnovativeScienceandResearchTechnology, 10, 1763-1771. https://doi.org/10.38124/ijisrt/25mar1158
[2]
Hughes-Lartey, K., Li, M., Botchey, F.E. and Qin, Z. (2021) Human Factor, a Critical Weak Point in the Information Security of an Organization’s Internet of Things. Heliyon, 7, e06522. https://doi.org/10.1016/j.heliyon.2021.e06522
[3]
Liu, X., Ahmad, S.F., Anser, M.K., Ke, J., Irshad, M., Ul-Haq, J., et al. (2022) Cyber Security Threats: A Never-Ending Challenge for E-Commerce. FrontiersinPsychology, 13, Article ID: 927398. https://doi.org/10.3389/fpsyg.2022.927398
[4]
Ertan, A., Floyd, K., Pernik, P. and Stevens, T. (2021) Cyber Threats and NATO 2030: Horizon Scanning and Analysis. CCDCOE.
[5]
Kibet, A. (2025) Enhancing Transparency and Security in Means Testing for Education Financing: A Blockchain-Based Approach. 2025 IST-AfricaConference (IST-Africa), Nairobi, 28-30 May 2025, 1-14. https://doi.org/10.23919/ist-africa67297.2025.11060559
[6]
Kaur, J. and Ramkumar, K.R. (2022) The Recent Trends in Cyber Security: A Review. JournalofKingSaudUniversity-ComputerandInformationSciences, 34, 5766-5781. https://doi.org/10.1016/j.jksuci.2021.01.018
[7]
Waweru, E., Karume, S.M. and Kibet, A. (2025) A Review of Human Vulnerabilities in Cyber Security: Challenges and Solutions for Microfinance Institutions. JournalofInformationSecurity, 16, 114-130. https://doi.org/10.4236/jis.2025.161006
[8]
Hadrian (2023) Assessing from the Outside in. Hadrian.
[9]
Grassegger, T. and Nedbal, D. (2021) The Role of Employees’ Information Security Awareness on the Intention to Resist Social Engineering. ProcediaComputerScience, 181, 59-66. https://doi.org/10.1016/j.procs.2021.01.103
[10]
Kibet, A. (2026) A Design Science Study of Blockchain-Based Governance and Incentive Architectures for Ride-Sharing Platforms. OpenJournalofAppliedSciences, 16, 300-319. https://doi.org/10.4236/ojapps.2026.161019
[11]
Kibet, A., Thiga, M.M. and Karume, S.M. (2019) Towards a Blockchain Based Smart Contracts Model Design for Housing Market Applications. InternationalJournalofAdvancedResearchinComputerEngineering&Technology (IJARCET), 8, 327-334.
[12]
Kibet, A. and Karume, S.M. (2018) A Synopsis of Blockchain Technology. InternationalJournalofAdvancedResearchinComputerEngineering&Technology (IJARCET), 7, 789-795.
[13]
Dai, K., Kawaki, I.L. and Sakti, L.D. (2023) Mitigation of Cyber Security Risk Threats during the COVID-19 Pandemic. InternationalJournalofCyberandITServiceManagement, 3, 107-119. https://doi.org/10.34306/ijcitsm.v3i2.135
[14]
Kibet, A. (2019) Designing a Blockchain Based Smart Contract Model: A Case of Real Estate Industry. InternationalJournalofAdvancedResearchinComputerEngineering&Technology (IJARCET), 8.
[15]
Nobles, C. (2022) Stress, Burnout, and Security Fatigue in Cybersecurity: A Human Factors Problem. HOLISTICA—JournalofBusinessandPublicAdministration, 13, 49-72. https://doi.org/10.2478/hjbpa-2022-0003
[16]
Nifakos, S., Chandramouli, K., Nikolaou, C.K., et al. (2021) Influence of Human Factors on Cyber Security within Healthcare Organisations: A Systematic Review. Sensors, 21, 5119. https://doi.org/10.3390/s21155119
[17]
Hadlington, L. (2020) The “Human Factor” in Cybersecurity. In: Information Resources Management Association, Ed., Research Anthology on Artificial Intelligence Applications in Security, IGI Global, 1960-1977. https://doi.org/10.4018/978-1-7998-7705-9.ch087
[18]
Communications Authority of Kenya (CA) (2025) Cybersecurity Report. Communications Authority of Kenya (CA).
[19]
Wang, Z., Zhu, H. and Sun, L. (2021) Social Engineering in Cybersecurity: Effect Mechanisms, Human Vulnerabilities and Attack Methods. IEEEAccess, 9, 11895-11910. https://doi.org/10.1109/access.2021.3051633
[20]
Georgiadou, A., Mouzakitis, S. and Askounis, D. (2022) Detecting Insider Threat via a Cyber-Security Culture Framework. JournalofComputerInformationSystems, 62, 706-716. https://doi.org/10.1080/08874417.2021.1903367
[21]
Suryotrisongko, H. and Musashi, Y. (2019) Review of Cybersecurity Research Topics, Taxonomy and Challenges: Interdisciplinary Perspective. 2019 IEEE 12thConferenceonService-OrientedComputingandApplications (SOCA), Kaohsiung, 18-21 November 2019, 162-167. https://doi.org/10.1109/soca.2019.00031
[22]
Onwubiko, C. and Ouazzane, K. (2022) Multidimensional Cybersecurity Framework for Strategic Foresight. InternationalJournalonCyberSituationalAwareness, 6, 46-77. https://doi.org/10.22619/ijcsa.2021.100137
[23]
Dash, B. and Ansari, M.F. (2022) An Effective Cybersecurity Awareness Training Model: First Defense of an Organizational Security Strategy. InternationalResearchJournalofEngineeringandTechnology (IRJET), 9, 1-6.
[24]
Zimmermann, V. and Renaud, K. (2019) Moving from a ‘Human-as-Problem” to a ‘Human-as-Solution” Cybersecurity Mindset. InternationalJournalofHuman-ComputerStudies, 131, 169-187. https://doi.org/10.1016/j.ijhcs.2019.05.005
[25]
Sundar, S.S. and Kim, J. (2019) Machine Heuristic: When We Trust Computers More than Humans with Our Personal Information. Proceedingsofthe 2019 CHIConferenceonHumanFactorsinComputingSystems, Scotland, 4-9 May 2019, 1-9. https://doi.org/10.1145/3290605.3300768
[26]
Mazzarolo, G. and Jurcut, A.D. (2019) Insider threats in Cyber Security: The Enemy within the Gates. Cornell University.
[27]
Greitzer, F.L. (2019) Insider Threats: It’s the Human, Stupid! Proceedings of the Northwest Cybersecurity Symposium, Richland, 8-10 April 2019, 1-8. https://doi.org/10.1145/3332448.3332458
[28]
Lee, I. (2022) Analysis of Insider Threats in the Healthcare Industry: A Text Mining Approach. Information, 13, Article 404. https://doi.org/10.3390/info13090404
[29]
Ahsan, M., Nygard, K.E., Gomes, R., Chowdhury, M.M., Rifat, N. and Connolly, J.F. (2022) Cybersecurity Threats and Their Mitigation Approaches Using Machine Learning—A Review. JournalofCybersecurityandPrivacy, 2, 527-555. https://doi.org/10.3390/jcp2030027
[30]
Alghamdi, M.I. (2021) History, Present 2021 and Future of Cyber Attacks. JournalofCybersecurityandInformationManagement, 8, 71-83. https://doi.org/10.54216/jcim.080204
[31]
Ulven, J.B. and Wangen, G. (2021) A Systematic Review of Cybersecurity Risks in Higher Education. Future Internet, 13, Article 39. https://doi.org/10.3390/fi13020039
[32]
Prabhu, S. and Thompson, N. (2022) A Primer on Insider Threats in Cybersecurity. Information Security Journal: A Global Perspective, 31, 602-611. https://doi.org/10.1080/19393555.2021.1971802
[33]
Solove, D.J. and Hartzog, W. (2022) Breached! Why Data Security Law Fails and How to Improve It. Oxford University Press.
[34]
Papatsaroucha, D., Nikoloudakis, Y., Kefaloukos, I., Pallis, E. and Markakis, E.K. (2021) A Survey on Human and Personality Vulnerability Assessment in Cybersecurity: Challenges, Approaches, and Open Issues. arXiv:2106.09986.
