🤖 AI Summary
This study addresses a critical gap in existing vulnerability standards—such as CVE—which focus exclusively on technical flaws while neglecting systematic classification and mitigation of human behavioral and psychological vulnerabilities, including those exploited through social engineering and deception. To bridge this gap, the paper proposes the first structured, machine-readable standardization framework for human-centric vulnerabilities. Grounded in behavioral science theories—including dual-process theory, prospect theory, and models of social influence—the framework systematically identifies and categorizes cognitive, affective, and trust-based mechanisms leveraged by attackers. It introduces a Human Vulnerability Identifier (HVID), an HVSS severity scoring system, and an HVP patching mechanism, thereby establishing a scalable and actionable infrastructure. This foundation enables automated defense strategies and security assessments, effectively filling the long-standing void in human-factor security standardization.
📝 Abstract
The cybersecurity community has invested over two decades in building standardized frameworks, the Common Vulnerabilities and Exposures (CVE) system, the Common Vulnerability Scoring System (CVSS), and the Common Weakness Enumeration (CWE) to identify, classify, and remediate threats to digital infrastructure. However, an emerging body of research reveals that a vast majority of successful cyberattacks exploit not software flaws, but human behavioral and psychological vulnerabilities. Social engineering, fraud, and scam attacks, which manipulate human cognition, emotion, and trust, do not have an equivalent standardized framework. Meanwhile, behavioral science and psychology research has established robust theoretical foundations, such as dual-process theory, prospect theory, social influence frameworks, and visceral state models, which explain precisely why and how these attacks succeed. This paper introduces the Human Vulnerabilities & Exploits (HVE) Framework, a structured approach for identifying, classifying, and mitigating the behavioral and psychological vulnerabilities exploited in scams, social engineering, and other human-centric fraud and attacks, analogous in concept to how CVE helps classify software vulnerabilities: it provides a shared, machine-readable taxonomy with structured identifiers, multi-dimensional severity scoring via the Human Vulnerability Severity Score (HVSS), and actionable remediation guidance through Human Vulnerability Patches (HVPs). This introduction synthesizes the relevant literature across cybersecurity standardization, behavioral science, and fraud defense to establish the theoretical and practical foundations for the HVE framework, whose architecture and technical specifications are detailed in subsequent sections.