Sociotechnical Cybersecurity and Privacy (SCP)

Kami Vaniea
Sep 2, 2026 23 min read Conference

Live blog of the Conference on Sociotechnical Cybersecurity and Privacy (SCP2026) which is a new conference this year created by merging EuroUSEC and STAST. The conference is being hosted at the lovely Belval University in Belval, Luxembourg.

Live blogging disclosure: As always, this is a live blog which is written live and very likely has errors. The below statements represent my interpretation of talks, not necessarily what the speaker directly said.

Security and digital infrastruture is no longer just a tool, it is part of the fabric of society. So the decision was made to merge the European Symposium on Usable Security (EuroUSEC) and Workshop on Socio-Technical Aspects in Security (STAST) events. The social media tag is #scplu2026 for those trying to follow remotely.

This year there were 75 full submissions, 23 accepted to the final program (31% acceptance rate).

Outline: Day 1

Day 2

Keynote: Usable, Human-centered , Socioio-technical security: What is the difference?

Presenter: Prof. M. Angela Sasse

Historical we sometimes take the technical and socio-technical aspects separately. Some of the technical aspects are hitting a wall in terms of progress, there is an opportunity to do strong collaboration to help move the field forward by bringing together these perspectives.

A brief history of the field: The message of the two papers below was that even technial people could not cope with security technology. Even in the best case, highly skilled people could not use security technology accurately.

This was then followed by a masters student project which started with a company asking “why can these stupid users not remember their passwords?”. Despite the foundational research, the company spent 5 years debating if single sign-on was worth it and “how come we cannot just train people more?”

The field has massively advanced. We now have publications in all 4 major security conferences. There has been an impressive increase in work in the filed.

But if we look at just passwords, we are still struggling with issues like changing passwords regularly and expecting people to have infinite and always accurate memory. Which is just simply not the case. Or that assumption that a training will just make it all get better.

A good example is Microsoft asking users if the user wants to enable macros when everyone knows that users are not experts and could barely explain what a macro is. Now, finally, Microsoft is not allowing non-signed macros to run. Finally we are protecting users by default.

User-centered authentication has been an ongoing issue .Work wiht highly disabled people makes it clear that no one approach will work for all. Users really need the ability to choose how to authenticate and providers need to be using FIDO2 correctly.

Most phishing would not happen if we had true mutual authentication where customers authenticate to profiders AND providers authenticate to consumers. Why are users being asked to authenticate off of a QR code? Doing that trains customers to give credentials to a website that has not been authenticated.

Simulated phishing does not work.

Any company that depends on users never clicking something they should not click on, is doing a bad job with security. There is much better ways to protect systems then depending on users. It also causes employees to feel less great about themselves. Highly performing employees are ones that feel safe and confident.

Work with decision makers shows that they are prioritizing just having something done, and they do not care if it actually works. Factory workers, for example, are being given training they do not need because they do not even use computers because security training should be done. But it does not even match other traingings they get like safety training where someone comes and helps the worker make sure they are doing the trained task correct.

Cyber Security and the Leviathan by Da Silva

Security uses a very mascalin language which puts off people from being able to question the processes or ask questions. Lots of security-related jobs have high stress and is causing mental health issues. There is less learning and automation on the defense side.

The technial people are now talking about “resilience” where there is a re-framing onto topics like recovery not just defense.

Fragile Computing 2024 by Laura Koksch

Communication is vital between defenders. A whole defense can be derailed from misunderstandings or the defenders being unable to communicate.

Session: Cognitive Biases and Decision-Making in Security

“Something else to worry about”: An Exploratory Study of Deliberate Ignorance Towards Online Security

Presenter: Jan Magnus Nold

Sometimes people do not want to know about security risks because it makes them feel overwhelmed. This research asks if people even want to know about security.

Deliberate ignorance Including emotion regulation which is avoiding things like fear. Cognitive sustainability which is rationing mental resources.

Survey research on Prolific. Showed people 10 scenario, mix of new and from prior work. Asked people if they wanted to know the infromation from the scenario. 912 participants that passed attention checks.

Even with information readily available, 9-28% people did not want to know the information. People who declined to know security advice had no negative stress effects (self-reported).

Found:

  • worry,
  • futility
  • Utility
  • pre-knowledge - I have already read enough about passords, cannot do anything anyway.

Outcomes:

  • Highlight efficacy, not the threat
  • I already knows, blocks corrections
  • Don’t fight the primaryh task

Q&A

  • Question about being optimistic. “But what if there really is 200,000 euros”
    • We cannot stop people from taking risks that they want to take.

Cybersecurity Decision-Making: Ensnared by the Bias Trap

Presenter: Luca Vigano on behalf of Karl Van der Schyff

Bias in cyersecurity has not been studied enough. Bias is also related to human misjudgement, which is related to confidence and “I know better”. But bias is not just about the misjudgement. So what biases are the most relevent.

Observe orient decide act (OODA loop) was used.

Pulled out the following biases as impactful:

  • Framing effect and anchoring - human tendancy to focus on the first piece of informaiton and then judge other information based on it.
  • Availability heuristic - decsions about the likelihood of an event based on how easily a relevent event comes to mind
  • Optimism bias -
  • Conformation bias

Most decisions are tactical but not strategy. Most people focus on short term actions that are specific to the current case. Compared to strategy where longer-term cosndierations are made.

“Bias Trap” - persistent gap between the regobniton of cognitive biases and the development of effective mitigation strategies.

Discussion:

  • Biased human judgements cascade from strategic governmence to tactical behvior
  • Few examined higher level decsion making
  • Scope for studies on confirmation bias and anchoring

Q&A

  • Tunneling big problem because people get overloaded. But if people do not have time they tend to lean on tactics and focus on their current and their next task.
    • Reference to this article?? [https://neurolaunch.com/cognitive-tunneling/](Cognitive Tunneling: How Tunnel Vision Affects Decision-Making and Performance)

Studying Personality and Attacker Behavior in a Deceptive Multi-Stage Capture-the-Flag Environment

Presenter: Khalid Alasiri, Arazona State University

Cyber defense is very reactive, the attacker aleays moves first. Tools produce more alerts than any sane person could process.

Proactive defense is based on the idea of automating the initial interaction with the attacker. Because attackers are different, it would be better if we could change the defense depending on the type of attacker.

Attackers have different personalities. There has been prior research looked at traits like how emotional different types of attackers are in their behavior. But… a defender only has logs.

Can we profile attackers from logs, can we predict personality traits from log data?

Personaility traits:

  • Persistence - repeated attempts at same path
  • Resilience - fail to a new strategy, not fail to stop
  • Risk-taking - Earlier, for more risk taking
  • Consicintiousness
  • Negative emotionailty

Lab style study where participants 2 hours trying to break into a contrived system. The system was designed to have a path that would never work but looks easy.

Beyond the Binder: Investigating the Potential of Diagram-based Incident Response Plans in Critical Infrastructure

Presenter: Vahiny Gnanasekaran, NTNU

How do we convey incident response plans to different groups. Looked into using diagrams. For example BPMN diagrams and UML sequence diagrams. The goal is to highlight the tasks and also who is doing them.

Two part study: a focus group from experts and then a learning experiment with students.

Plans are too complex to use during an incident. But they can be used in a post-incident reflection.

Students enjoyed using the diagrams because they helped highlight the complexity and what is needed to help interact.

Session: Human Factors in Authentication and Verification

Verifying the Fraud: German Users’ Proficiency in (Not) Identifying Online Banking Manipulations

Presenter: Franziska Bumiller

Imagine an attacker that has some control over the computer/website, but not the transaction-verifying device (phone). How can a user detect this? Looking at IBAN manipulation attack.

Research Questions (terse version):

  • What do users claim to check with transactions?
  • What reasons do user sreport for (not) checking their transaction data
  • What about things like age and attitude
  • Can an intervention work that was planned by the researchers

Did an online study (n=481) and a lab study (n=60).

In the survey: what do users claim to check and what is their reasoning? Security (undefined) mentioned lots. Many people are checking for typos. Also many are not checking at all and instead relying on typing it in correctly to start with.

Online banking still done widely by PC or laptop (74%). Most prevelent verificatoin method at the time appTAN. 81% still receive invoices in paper form (91% digitally). Research considers the paper invoices as ground truth.

For lab study gave 3 different UI designs. Participants had to do two bannking transfers. Then did a debrief. Most participants (82%) did not notice the manipulation. A couple versions of the UI were tried but with minimal impact, possibly due to the low manipulation identification rates. People did very little verification (about 8 seconds spent) if at all.

Those with less familiarity with the verification method were the ones that identified manipulations. People tend to do self-attribution arround errors (self-blame).

Formal Modeling and Analysis of Human Memory Lapses in Security Ceremonies

Presenter: Ioana Sandu

Formalize memory lappses. X-Men tool (this one?) has been used to analyze human forgetting. This project looks at security ceremonies and in terms of mutations.

A security ceremony is a set of steps that need to be done in order to achieve a security goal. For example: signing and encrypting an email. It is vital to sign, then encrypt, and then send the message. Sending first would cause complete loss of security.

Human mistakes during a security ceremony.

  • Skip - skip a step, or give up on the ceremony entirely
  • Add - adding new steps that may not be necessary or could undermine
  • Replace
  • Neglect - omit a check, forgetting the private key
  • Disorder

This is a formaization paper, it looks at how to model different types of mutations/mistakes a human might make. They critically ask if the ceremony can be recovered. It also looks at tactics a user might take and if those might lead to worse outcomes like replacing a fogotten password with a current in-use password leading to password re-use.

Code for the X-Men 2.0 tool

Kami View: I think there is some interesting potential for semi-automatically analyzing formalized security ceremonies to provide a more formal definition of human error. May also be interesting to help groups like crypto protocol creators structurally reason about known points of common human error.

The (Un)suitability of Passwords and Password Managers in Virtual Reality

Presenter: Yorick Last, Paderborn University

Virtual Reality (VR) use is expending, including into more sensitive contexts like health. There are many ways to do authentication in VR including passwords which are one of the more common. VR makes passwords a bit more challenging and users do not like entering them and tend to make short passwords to make it easier to enter. One option is password managers, but these have not been considered in VR.

This paper looks at:

  • What are user experiences with VR auth?
  • How suitable are current password managers for VR?

Surveyed 126 active VR users asking about how they currently do auth including password managers.

Authentication in VR tends to happen at setup or during purchase. These were not considered usable, but were reasonably well rated.

Most password managers used were not designed for VR. There are also issues with password managers being unable to auto fill. Accessability was also not great, as must require memorizing full length secrets.

PGP and S/MIME in the Age of Multi-Device Email Usage: “Admittedly, an outrageously confusing system.”

Presenter: Katharina Schiller from Hof University of Applied Sciences

Email encryption and adoption of S/MIME is still really low.

Some research questions:

  • How usable is email encryption
  • Multiple device useage
  • Email signature impact on the percieved security of the email.

Survey (n=184) followed by a scenario-based lab study of 34 participants who were also interviewed. Lab study used Apple Mail, Outlook, and Thunderbird.

Observations, that honesly mimic earlier findings:

  • Poor feedback. If using S/MIME a TLS security was downloaded instead, there was no feedback about it being wrong.
  • AI instructions were often used
  • Tools like outlook caused users to mix up crypto signatures with digital signatures. Also MPE tech vs proper encryption
  • Multi-device setup was the most complex for users.
    • All users had challenges exploring private key - possibly intentional by the applications to limit error and loosing the key.
    • Users who wanted to email his private key to the phone. I already have encryption setup on my desktop.

Tried sending 4 variations of signed, encrypted, and unsigned emails to the participants to see if they could understand the UI.

Session: Security and Privacy for Diverse and Vulnerable Users

The System Will Choose Security Over Humanity Every Time": Understanding Security and Privacy for U.S. Incarcerated Users

Presenter: Yael Eige, University of Washington

1.9 million people are incarcerated today, 79 million people in the US have a criminal record and one in three US citizens have a family member who has been incarcerated.

There is a good bit of technology used in prisons. Ranging from cut down Android devices to allow for communication with families and lawyers.

The word “security” occurs often in marketing for technology used for prisons. But this security doesn’t really extend to the incarcerated people who are being serveiled, this includes communication with lawyers and communication with non-incarcerated loved ones who are communicating with an incarcerated person.

User study with 17 people, 12 were former incarcerated person and 5 were family of current incarcerated.

Incentivization is poor with securty software provider making money by blocking content.

Understanding the Perception of Transliterated Offensive Social Media Posts Among Banglish and Hinglish Users

Presenter: Dhiman Goswami

In social media there is a rise in translieration - where non-English words are written in the English character set by using phonics. These can also be a mix of English and other languages.

Kami commnt: Sounds like similar to cross-coding. Where users swap languages as a simple access control to prevent groups like parents from knowing the contents because they do not speak English.

Transliteration makes it harder to automatically detect abusive or other unacceptable language.

Research questions:

  • Perceived Offensiveness
  • User Response - how is such content ignored or reported?
  • Demographic Effect - impact of demographics on response.

Survey-based study with 310 participants included Hindi-English, Bangla-English Speakers, and Trilingual Speakers.

Transliteration does not soften the offensiveness. Transliteration is recognized without issue, but is under-reported.

Q: is the issue with ignoring the transliterated post caused by percieved efficacy - they do not think the social media would do anything

“Please Listen to Us and Respect”: Understanding Privacy Perspectives and Experiences of FemHealth App Users Through a Qualitative Analysis of User Reviews

Presenter: Ina Kaleva on behalf of Chenkai Ma

FemHealth apps help users measure things like menstrual cycles, and pregnancy. These apps need highly intimate information in order to function correctly. This information became far more concerning in the US after the overthrowing of Roe vs Wade.

How do user reviews of these apps talk about:

  • How are privacy boundaries expressed
  • Discuss and manage privacy rules
  • Types of privacy turbulence that are discussed.

One issue is that sharing does not necessarily stop at the third party it is sold it, they may sell it one further. Privacy turbulence emerged from users’ interactions with apps and political situation. Many uninstalled the apps and discontinued usage.

Recommend that femHealth should have fine-grain controls that allowed boundary management. For example, store data only locally.

Session: Organizational Security Governance and Practices

Validating CRIB as a Board-Level Cyber Risk Governance Maturity Framework

Presenter: Robert Bose

The costs of security has increased for organization boards. Recently security had to be included in yearly reports. There are now more incentives, but not necessarily tools to help do the approach.

Cyber Risk Integration for Boards (CRIB).

This approach is intended to create a “framework for measuring the maturity of board-level governence practices.”

Default but Fragmented: How Security Practitioners Use Social Media for Cyber Threat Intelligence

Presenter: Shota Fujii, Hitachi

Social media is useful in cybersecurity. For example learn about an attack and then check if it is happening at the local organization too. There have been many changes to social media lately, particularly after Twitter was sold.

How do practitioners decide where to search, what to trust, what to keep, and how to share it?

  • What is the role of social media
  • How do practitioners decide on social media platforms
  • Challenges and unmet needs

Conducted semi-structured interviews (n=7), survey (n=104), and integrated findings.

Roles of social media:

  • Situational awareness
  • investigation and response
  • Malware & threat-actor analysis
  • Capability development

The practitioners do not just rely on social media. They try and evaluate the information they get by comparing with official documentation, VirusTotal, and other sources.

Kami Thought: Reminds me of our work on admin information gathering around patch management where we tracked how the online community pieced together information about a problematic patch.

Does My Code Leak Secrets? Developers’ View on Security Testing Tool Reports in Timing Side-Channel Analysis

Presented by: Michael Kloos

Software developers are expected to create secure code, but how do they know it is secure? Well, they use tools. So what tools are they using, and are these effective.

Lab study where they were asked to analyze warning reports from a tool. 42 developers. Used 7 tools, some of which are developed for side-channel analysis.

Broadly, the tools do a poor job of even making it clear if an issue was found or not. The best performing one in my opinion is not that usable, it mostly just clearly states at the start that an issue was found.

Developers were asked to draw a better interface. These were coded and then a tool template was designed based on the findings.

Investigating Shadow IT Use and Adoption in Educational Institutions and their Privacy Implications

Presenter: Khalid Alasiri on behalf of Easton Kelso, Arizona State University

Shadow ID: “Use of unauthorized use of any digital service or device that is not formally approved and supported by the IT department.” Also includes the use of personal accounts for professional activities.

The USA has the FERPA law for privacy for students. There is also COPPA which is about children.

May 2026 Canvas Breach happened partially due to Free-for-teachers accounts. But nothing is truely free.

Aim of the study is to investigate why educators use personal technology that is not approved by IT and how admins deal with it.

Educators are picking familiar tools that they know. Their focus is more on student engagement than on security and privacy. Few knew what the policy was for their organization anyway.

Session: Privacy in Everyday Apps and Platforms

Privacy in the Generative AI Context: Exploring Users’ Privacy Perceptions and Professional Use Intentions

Presenter: Aneka Williams, UCF

Survey of 813 US workers from a range of professional seniority to understand threat appraisal.

Past use is one of the largest predictors of continued use intentions.

Kami showed up a bit late…

What Dating Apps Show About Us: A Sociotechnical Measurement Study of Security and Privacy Weaknesses in Android Dating Applications

Presenter: Laraib Asif and Ayush Daga, George Mason University

Dating apps have lots of sensitive data including things like location, photos, identity, and messages. There are many possible threats to such data being lost such as stalking and harassment.

Used automatic static analysis to look at dating apps on the play store (Android). Started with 300 candidate apps but removed based on being a dating app, APK availability, finally analyzed 127 dating apps.

Apps were put through static analysis pipeline. MobSF analysis was done. Lots of use of “sensitive/elevated declarations”. Including things like fine grain location.

Looked at exported information which is done via static analysis. So these are potential. Many were doing data backup.

Those apps with less trackers also declaired less sensitive permissions.

There’s a (pot)hole in your privacy policy: Privacy Concerns in Canadian Problem-Reporting Websites

Presenter: Indrani Ray, University of Waterloo

Non-emergency issues for cities can be reported to non-emergency phone numbers (311) or via website (311 website). Reserach looked at privacy in the 311 websites of 13 cities in Canada.

Research looks at privacy from three perspectives:

  • User Interface - what potentially identifiable information is required or requested
  • Privacy Policy - The privacy policy of the service or the whole city
    • Not all cities had privacy policies at all
  • Network traffic of the website - HAR file record of interaction with the website.

All cities contacted known trackers, the most common was Google services. Trackers were not often named. But very few listed those trackers in their privacy policy. Many of the cities have one overall policy which necessitates having a vague high-level policy.

Preventing Privacy Dark Patterns: A Pre-Release Review Framework

Presentatoin: Mahe Chen, University of Toronto

Dark patterns urge users to engage in a certain way that may not be in the best interest of the user.

Kami thought very similar to my paper on DarkDialogs: Automated detection of 10 dark patterns on cookie dialogs

Reserach looked at:

  • Defaults
  • Effort
  • Salience
  • Comprehension

This research focuses on the product team’ the ability to detect dark patterns in an evidence-friendly way.

Framework:

  • Default-state audit
  • Pathparity audit
  • First-layer disclosure audit

Goal is to put a process in place to make sure to audit a UI for dark patterns in a clear way. The auditor should provide results things like approve, block, request changes, and escalate.

Evaluated the framework by having some students try to use it. Author looked at 20 cases themselves and had a second coder do the same.

Keynote: Simulating Personality-Driven News Judgement with Large Language Models

Presenter: Marinella Petrocchi, Institute of Informatics and Telematics, National Research Council of Italy (ITT-CNR), Pisa

Dr Petrocchi has worked historically on “fake” content online like fake reviews and now LLMs.

Papers:

Suscepitibility of disinformation: how likely that people will be able to differentiate between real and fake content, such as fake news.

We used to do research where we showed participants some news and then asked participants if they thought it was true and how confident.

But now, we can maybe use LLMs simulate humans. We can collect data from both humans and AI and compare their responses.

Why simulate vs conducting a real survey? There are studies we might want to do that are not ethical to do on people. Such as making them read nothing but known fake news for a month to see how it impacts their thinking. Similar for exposure to lots of propoganda, such as political, to see how it changes their views. But doing such experiments with LLM is ok and does not cause ethical problems.

The issue is that LLMs are designed to flatten some elements of normal human behavior.

Planned study, in progress: Can a single personality-conditioned LLM reproduce human news judgements?

Big five traits is one of the most popular approachs to measuring personality. These can be used to measure how people will interact with the world.

Human participants complete the big five survey. An LLM agent is then created based on the same personality traits. This is done by telling the LLM to imagine they are a person who embodies the trais and that they should behave in alignment with the charactoristics. Then both the human and the LLM complete the same tasks.

“Can large language models, when endowed with the big-five personality profiles, simulate human news discernment - judge” in alignment with a human.

More than one model was tested in this way, including GPT-3.5 and GPT-4o.

LLMs echo humans well sometimes and sometimes not:

  • Replicated well by the LLM:
    • Agreeableness, conscientiouness, Open mindedness
  • Diverged:
    • Extraversion, and Negative Emotionality

Since a single LLM cannot represent a human well, does trying multiple models at once work better? Well … the work here is ongoing. Ealry results suggests that using multiple LLMs consistently outperforms using only one LLM.

Others are also looking into the topic:

Other works try asking the LLM to not only answer yes/no but also to write out a reasoning. They find that when an LLM is conditioned to a political view the more complex reason writing task, the LLM is skilled at writing out a reasoning.

Papers:

This paper found that the LLM does not really consider the social network of the person being simulated. Humans may believe something, but they may not share because they are shy or they don’t want to share with the network. Humans may also share because they are skeptical about the news article.

There is quite a bit of research still to be done in the space. At the moment LLMs do not reliably simulate humans in all aspects. Work is needed to well map out what aspects are simulated well and which ones are simulated better so that simulated data can be used by researchers reliably.

Q&A

Lots of discussion in the room of how truly predictive psychology models are in practice. Also issues of the replication crisis in psychology. It is unclear if the Big 5 would be expected to be predictive of disinformation given how general the big 5 personalities are.

Kami’s thoughts: This is reminding me of Judith Donath’s SHB presentation on how misinformation is possibly being spread as a fashion statement. Humans share inaccurate information for a huge number of reasons that are not necessarily caused by them being fooled by the information.

Session: From Awareness to Behavior Change in Security

Applying Behaviour Change Knowledge to Foster Secure Employee Behaviour: An Exploratory Study with Security and Security Awareness Practitioners

Presenter: Rebecca Panskus

The security behavior change curve is designed for organizations to establish secure behavior with their employees.

Curve Stages:

  1. feasibility of Secure Behaviour
  2. Security Awareness
  3. Information about risks and motivation to change
  4. Understanding correct & incorrect behaviour
  5. Agreement through Co-Design
  6. Self-efficacy through successful trial & Error
  7. Implementation through Environmental Redesign
  8. Embedding into Everyday Work
  9. Secure Behaviour is habit
  • If emplyees are not following security after this point, then sainctions maybe can be used. But users should be supported in correctly doing security correctly first.

Curve described here

Workshop where participants were asked to use the curve to do ideation. Participants were taken through each stage.

More challenging stages:

  • Stage 3: information abou trisks and motivation change
    • Tendency to start using technical language
  • Stage 6: Self-efficacy through successful trial & Error
    • Focus here is on avoiding fear of failure among employees
    • But most suggested simulated attacks. But research has shown that these are counterproductive partially because they can undermine confidence and employee happiness
  • Stages 8 and 9
    • Harder for participants to differentiate between short and long term rewards.

Participants tend to go towards established or well known approaches like simulated attacks.

Kami Vaniea
Kami Vaniea
Associate Professor of Usable Privacy and Security

I research how people interact with cyber security and privacy technology.