  These days, cyber-criminals target humans rather than machines since they try
to accomplish their malicious intentions by exploiting the weaknesses of end
users. Thus, human vulnerabilities pose a serious threat to the security and
integrity of computer systems and data. The human tendency to trust and help
others, as well as personal, social, and cultural characteristics, are
indicative of the level of susceptibility that one may exhibit towards certain
attack types and deception strategies. This work aims to investigate the
factors that affect human susceptibility by studying the existing literature
related to this subject. The objective is also to explore and describe state of
the art human vulnerability assessment models, current prevention, and
mitigation approaches regarding user susceptibility, as well as educational and
awareness raising training strategies. Following the review of the literature,
several conclusions are reached. Among them, Human Vulnerability Assessment has
been included in various frameworks aiming to assess the cyber security
capacity of organizations, but it concerns a one time assessment rather than a
continuous practice. Moreover, human maliciousness is still neglected from
current Human Vulnerability Assessment frameworks; thus, insider threat actors
evade identification, which may lead to an increased cyber security risk.
Finally, this work proposes a user susceptibility profile according to the
factors stemming from our research.
