Developing a G-AI powered assistant to simulate social engineering attacks for awareness training
Orojo, Omolola (2026)
2026
All rights reserved. This publication is copyrighted. You may download, display and print it for Your own personal use. Commercial use is prohibited.
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:amk-2026052717743
https://urn.fi/URN:NBN:fi:amk-2026052717743
Tiivistelmä
The goal of this thesis was to increase cybersecurity awareness through useful training methods. The creation and assessment of a generative AI-powered assistant for social engineering awareness training is the main topic of this study. The research's primary goal was to create a system that could produce safe and realistic simulated attack situations. This was now used to evaluate how well it improved users' awareness, recognition, and reaction to social engineering threats.
The study's theoretical approach is predicated on the idea that social engineering is a type of psychological manipulation that takes advantage of human behavior rather than technological flaws. Phishing, pretexting and baiting are important ideas. All this was used along with persuasive themes like authority, urgency and trust. In addition, the study employed artificial intelligence's dual function in cybersecurity, including the application of generative models for awareness training and simulation. The approach incorporates ethical aspects such as controlled simulation and data privacy.
A modular architecture was used to create a prototype system as part of a design-oriented approach. The system incorporates a generative language model, a prompt generating component, a backend application and a user interface. Pre-test and post-test assessments were completed by a group of volunteers in a small-scale experimental evaluation. The system logs and questionnaires were used to gather data. This data was then analyzed using qualitative interpretation and descriptive statistics.
The findings show that the system was able to produce a variety of realistic social engineering scenarios while following ethical standards. Following the training, participants showed more appropriate behavioral responses and an enhanced capacity to identify questionable texts. Although there were still some conceptual understanding gaps, confidence levels were also positively impacted. In general, the results indicate that interactive and experience-based cybersecurity awareness training can be successfully supported by generative artificial intelligence. The thesis concludes that while more development is advised to improve learning results and scalability, such systems have practical potential for improving human-centered security.
The study's theoretical approach is predicated on the idea that social engineering is a type of psychological manipulation that takes advantage of human behavior rather than technological flaws. Phishing, pretexting and baiting are important ideas. All this was used along with persuasive themes like authority, urgency and trust. In addition, the study employed artificial intelligence's dual function in cybersecurity, including the application of generative models for awareness training and simulation. The approach incorporates ethical aspects such as controlled simulation and data privacy.
A modular architecture was used to create a prototype system as part of a design-oriented approach. The system incorporates a generative language model, a prompt generating component, a backend application and a user interface. Pre-test and post-test assessments were completed by a group of volunteers in a small-scale experimental evaluation. The system logs and questionnaires were used to gather data. This data was then analyzed using qualitative interpretation and descriptive statistics.
The findings show that the system was able to produce a variety of realistic social engineering scenarios while following ethical standards. Following the training, participants showed more appropriate behavioral responses and an enhanced capacity to identify questionable texts. Although there were still some conceptual understanding gaps, confidence levels were also positively impacted. In general, the results indicate that interactive and experience-based cybersecurity awareness training can be successfully supported by generative artificial intelligence. The thesis concludes that while more development is advised to improve learning results and scalability, such systems have practical potential for improving human-centered security.