Technical Summary: MORPHEUS – A Multidimensional Framework for Modeling, Measuring, and Mitigating Human Factors in Cybersecurity

1. Problem Statement

Despite significant technical advancements in cybersecurity controls, the human factor remains the most exploited vulnerability, with empirical evidence indicating that nearly 88% of breaches stem from human error. Current research and frameworks addressing human factors suffer from three primary limitations:

• Fragmentation: Existing models often treat vulnerabilities as isolated, static traits rather than dynamic, interconnected systems.
• Narrow Scope: Many frameworks are either too specific (e.g., focused solely on password management or insider threats) or too broad (e.g., high-level organizational checklists like NIST) to capture the fluid, situation-specific nature of human behavior.
• Lack of Standardized Measurement: There is a deficiency in standardized methodologies for measuring and integrating human factors across various cyberthreats, hindering the development of actionable, targeted interventions.

The authors argue that a unified paradigm is required to comprehensively categorize human weaknesses, map their complex interactions, and provide validated instruments for empirical assessment to construct resilient, human-centric defenses.

2. Methodology

To develop the MORPHEUS framework, the authors employed a rigorous, dual-phase multi-methodological approach:

Phase 1: Systematic Scoping Review

• Objective: To identify the foundational taxonomy of human factors influencing susceptibility to major cyberthreats.
• Scope: Six primary threats were selected based on industry reports (Verizon DBIR, Clusit, ENISA): Phishing, SMishing, Spear-phishing, Malware downloads, Password management, and System misconfigurations.
• Process: A search was conducted on Google Scholar using a specific string combining "human factors," "psychological traits," or "human aspects" with specific threat vectors.
• Selection: From an initial pool of 6,000 candidates, 88 unique peer-reviewed publications were retained after applying strict inclusion criteria (peer-reviewed, full papers, Q3+ journals/C+ conferences, English language) and cross-referencing with prior systematic reviews to avoid redundancy.
• Outcome: This phase identified 50 distinct human factors.

Phase 2: AI-Assisted Systematic Screening

• Objective: To map pairwise interactions among the 50 factors and identify validated measurement instruments, tasks deemed too combinatorial for manual review alone.
• Process: The authors utilized Large Language Models (Perplexity.ai and OpenAI Deep Research) for semantic retrieval, followed by a strict Human-in-the-Loop (HITL) validation protocol.
  • Retrieval: Prompts were iteratively refined to extract direct quotes and methodological context.
  • Validation: A double-blind, independent review by two researchers filtered for hallucinations (9.2% rate), bibliographic quality, and semantic relevance.
  • Augmentation: Backward and forward snowballing was applied to the AI-retrieved corpus to mitigate algorithmic bias.
• Outcome: This phase yielded 302 unique empirical interactions between factors and 99 validated psychometric measurement instruments.

3. The MORPHEUS Framework

MORPHEUS is structured as a holistic, multidimensional framework visualized as a concentric architecture. It integrates two foundational psychological models: the Cognition–Affect–Behavior (CAB) model and Attribution Theory.

3.1 The Causal Pathway Architecture

The framework organizes the 50 human factors into a hierarchical causal system comprising three layers:

1. Layer 1: Modulators (Distal Antecedents): These set the baseline conditions for the user.
   • Internal Modulators: Personality traits (e.g., Neuroticism, Conscientiousness) and Demographics (Age, Gender, Education).
   • External Modulators: Social and Organizational contexts (e.g., Norms, Lack of resources, Security posture).
2. Layer 2: Direct Factors (Proximal Processing Engine): Aligned with the CAB model, this layer captures the user's transient state at the moment of decision.
   • Cognitive: Perception, Attention, Elaboration (e.g., Bias, Cognitive fatigue, Security self-efficacy).
   • Affective: Emotional states (e.g., Fear, Stress, Anxiousness).
   • Behavioral: Tendencies and habits (e.g., Impulsivity, Complacency, Recurrence).
3. Layer 3: Outcome: The final susceptibility to specific cyberthreats, precipitated by the interplay of modulators and direct factors, often triggered by Adversarial Triggers (e.g., time pressure, deceptive UIs).

3.2 Key Distinctions

• Human Factors vs. Adversarial Triggers: The framework explicitly demarcates internal human variables from external malicious stimuli (e.g., persuasion principles, emotional drivers used by attackers).
• Motivation: Conceptualized not as a single factor but as an emergent property arising from the dynamic interplay of cognitive beliefs, affective states, and social modulators.

4. Key Results and Findings

4.1 Quantitative Validation of the Architecture

The authors analyzed the directional flow of the 302 mapped interactions to validate the theoretical top-down structure:

• 82.8% (250 interactions) were "Architecture-Compliant," flowing hierarchically from Modulators to Direct Factors (32.1%), circulating within the CAB core (28.5%), or occurring within Modulators (22.2%).
• 17.2% (52 interactions) represented "Recursive Feedback" (e.g., behavioral habits altering organizational norms), confirming the dynamic nature of the system.

4.2 The Twelve Key Interaction Mechanisms

The complex network of interactions was distilled into 12 recurring mechanisms that explain vulnerability pathways:

• Group A (Architectural Cascades): Mechanisms where distal modulators drive proximal states. Examples include:
  • Distal Modulation of Cognitive Resources: Personality traits (e.g., Neuroticism) deplete cognitive resources, leading to fatigue.
  • The "Double-Edged Sword" of Desirable Traits: Traits like Conscientiousness can induce cognitive tunneling, increasing susceptibility to social engineering.
  • The Resource-Constraint Cascade: Lack of organizational resources triggers stress and reduces self-efficacy.
• Group B (Internal Feedback Loops): Self-reinforcing spirals within the CAB core. Examples include:
  • The Cognitive-Affective Bottleneck: Stress depletes executive function, which in turn impairs affective regulation.
  • The Habitual Autopilot Loop: Recurrence suppresses cognitive reflectiveness, leading to automatic, biased responses.

4.3 Measurement Inventory

The framework provides a comprehensive catalog of 99 validated instruments categorized by data dimension:

• First-person: Self-reported scales (e.g., Big Five Inventory, Perceived Stress Scale).
• Second-person: Behavioral observations and simulations (e.g., Phishing simulations, Cognitive Reflection Test).
• Third-person: Biometric and physiological indicators (e.g., EEG, Eye-tracking, GSR).

5. Operational Application

The paper demonstrates the framework's utility through Analytical Walkthroughs and Operational Scenarios:

• Risk Diagnosis: In a clinical setting, the framework helped diagnose repeated spear-phishing not as "user ignorance" but as a systemic failure where high stress and shame (Modulators/Direct Factors) degraded vigilance. The intervention shifted from training to UI changes and blameless reporting channels.
• Targeted Interventions: For university staff, the framework identified a high-risk cluster characterized by high impulsivity and low reflectiveness. Instead of generic training, the organization deployed "cognitive friction" (micro-delays) specifically for this group to disrupt automatic heuristic processing.

6. Significance and Claims

The authors position MORPHEUS as a significant advancement over existing literature by:

1. Providing a Holistic Synthesis: It moves beyond fragmented, threat-specific models to offer a universal architectural scaffolding that integrates cognitive, affective, behavioral, and social dimensions.
2. Establishing Causal Dynamics: By mapping 302 empirical interactions, it shifts the paradigm from static taxonomies to a dynamic system that models how environmental constraints degrade internal psychological states.
3. Bridging Theory and Practice: The inclusion of 99 validated measurement tools addresses the critical gap between conceptual frameworks and actionable, evidence-based interventions.
4. Operational Utility: The framework enables practitioners to move from generic "awareness" campaigns to targeted, systemic interventions that address the root causes of human-based risks.

Limitations Acknowledged:
The authors note that the framework is a theoretical synthesis based on aggregated studies and has not yet undergone longitudinal ecological validation in a real-world enterprise setting. They also highlight the heterogeneity of the interaction data (probabilistic associations rather than deterministic laws) and the ethical considerations regarding psychometric profiling. Future work is proposed to extend the framework to include external adversarial triggers and to validate the identified feedback loops empirically.