Speaker
Description
As digital ecosystems become increasingly interconnected, cyber-risk assessment is no longer solely a technical matter. It now encompasses human factors, social dynamics, and individual perceptions that shape user behaviour and influence decision-making in the context of cyber social security. The diffusion of cyber-physical systems has intensified human–digital interactions, exposing users to emerging threats such as misinformation, information overload, and social engineering. These developments challenge traditional models of risk perception and call for approaches that explicitly account for subjective uncertainty and decision-making under ambiguity.
This contribution introduces a methodological framework for assessing perceived cyber-risk, focusing on how users prioritise vulnerabilities in complex and uncertain digital environments. Leveraging non-parametric techniques, we explore the construction of composite indicators that capture uncertainty in prioritisation processes and examine their impact on qualitative grading responses. To address ambiguity and partial knowledge—including unknown vulnerabilities (e.g., zero-days)—we propose a prediction accuracy measure tailored for incomplete information settings, a condition common in real-world cyber threat perception.
The framework is evaluated using both simulated and real-world datasets that reflect cybersecurity scenarios where contextual variables and user judgments play a critical role. Results highlight how different models and accuracy metrics perform under varying threat assessment strategies, offering insights into the cognitive and behavioural dimensions of cyber-risk perception. By providing interpretable and flexible tools to support decision-making under uncertainty, this study paves the way for future analyses on the processes underlying individuals and organisations assessment and response to cyber-threats in digital environments.
