Technical Summary: The Human Vulnerabilities & Exploits (HVE) Framework

1. Problem Statement

The cybersecurity industry has established robust, standardized frameworks for managing technical vulnerabilities, including the Common Vulnerabilities and Exposures (CVE) system, the Common Vulnerability Scoring System (CVSS), and the Common Weakness Enumeration (CWE). However, a critical operational gap exists regarding the "human element." Research indicates that between 84% and 98% of successful cyberattacks exploit psychological and behavioral vulnerabilities rather than purely technical flaws.

Currently, the defense against social engineering, fraud, and scams lacks a standardized, machine-readable taxonomy. Existing responses, such as security awareness training, are often reactive, lack a shared vocabulary for specific manipulation patterns, and fail to address the "hot" emotional states induced by active scams, where knowledge acquired in a "cold" state fails to transfer to behavior. Furthermore, existing fraud taxonomies (e.g., Federal Reserve ScamClassifier) typically classify the cover story (the "what") but fail to model the underlying psychological mechanisms (the "how") or provide severity scoring and real-time intervention guidance.

2. Methodology and Framework Architecture

The Human Vulnerabilities & Exploits (HVE) Framework is proposed as a structured, machine-readable standard analogous to CVE, designed to catalog, score, and mitigate human-centric attacks. The framework is grounded in behavioral science literature, specifically dual-process theory (System 1 vs. System 2 thinking), prospect theory, and visceral state models (e.g., Loewenstein's hot–cold empathy gap).

2.1 Core Registries

The framework consists of four interconnected registries:

1. HVE (Human Vulnerabilities & Exploits): A registry of attack patterns. Each record describes a specific manipulation scenario using a 3-Layer DNA model:

   • Manipulation Family: The shared trust model exploited (e.g., Authority, Romance, Investment). The framework defines a controlled vocabulary of 21 families.
   • Social Engineering Tactics (SET): The psychological levers used to suppress analytical reasoning (e.g., Authority, Urgency, Fear, Scarcity), derived from frameworks like Cialdini's principles of influence.
   • Persona Archetype: The identity impersonated by the attacker (e.g., Authority Figure, Familiar Person, Professional/Expert).
   • Additional Fields: Exposure Channel (Phone, Email, etc.), Grooming Depth (Flash, Multi-step, Long-con), and Indicators & Evidence.

2. HWE (Human Weakness Enumeration): A registry of victim susceptibility profiles. Analogous to CWE, it classifies contextual or predisposing factors (e.g., Social Isolation, Age-related cognitive decline, Financial distress) that make a victim susceptible to specific attacks. These are categorized as non-judgmental "weaknesses" to be exploited in a specific context, not personal deficiencies.

3. HVSS (Human Vulnerability Severity Score): A 0–10 severity scoring system analogous to CVSS. It calculates a dynamic risk score by combining:

   • Base Metrics: Intrinsic properties of the attack (from HVE).
   • Context Metrics: The victim's psychological state and susceptibility (from HWE).
   • The output includes a Spell Intensity flag (Low, Medium, High), indicating the victim's visceral state and the level of cognitive friction required.

4. HVP (Human Vulnerability Patches): Actionable intervention bundles linked to specific HVE/HWE records. These translate cognitive friction research into deployable actions (e.g., verification steps, pacing-and-leading scripts) tailored to the calculated Spell Intensity.

2.2 Design Principles

The framework adheres to seven design principles:

• Interoperability: Reuses CVE conventions (unique IDs, JSON schemas).
• Decomposition: Treats scams as compositions of reusable elements (Family × Tactics × Persona) rather than atomic events.
• Psychological Grounding: Every human-factor field maps to established behavioral science constructs.
• Agent-Deployability: Designed for real-time consumption by AI agents.
• Separation of Attack and Victim: HVE and HWE are independent registries that combine only at scoring time.

3. Key Contributions

• Standardized Taxonomy: Introduces the first machine-readable taxonomy for human manipulation patterns, decomposing attacks into a 3-Layer DNA (Family, Tactics, Persona).
• Contextual Severity Scoring: Proposes HVSS, a multi-dimensional score that accounts for both the attack's sophistication and the victim's real-time psychological state, addressing the limitations of static technical scoring.
• Operational Intervention (HVP): Bridges the gap between theory and practice by binding vulnerability records to specific, calibrated intervention bundles (patches) based on the victim's "Spell Intensity."
  • Low Intensity: Logic and education.
  • Medium Intensity: Guided verification and friction.
  • High Intensity: Pacing, leading, and reality re-anchoring to avoid the backfire effect.
• Vector String Fingerprint: A compact representation (e.g., HVEV1) enabling vector-similarity matching for real-time classification and cross-jurisdictional clustering of attacker signatures.
• Governance Model: Proposes a tiered access model (Public for HVE, Restricted for HWE/HVP) managed by a CNA (CVE Numbering Authority) style governance to balance defense utility with dual-use risks.

4. Results and Validation Status

The paper presents the HVE Framework as a version 1 (v1) structural and conceptual specification. It does not report empirical results from large-scale deployment or randomized controlled trials within the text. Instead, the "results" are the successful synthesis of existing behavioral science and cybersecurity standards into a coherent architecture.

The paper notes that:

• The 21-family taxonomy is designed to cover empirical case distributions with a target residual rate of <2%.
• The framework is intended to be validated against a labeled corpus to calibrate HVSS weights and Spell Intensity thresholds (planned for v1.1).
• Inter-rater agreement and classifier performance metrics are identified as future work to be published alongside the validation corpus.

5. Significance and Claims

The authors claim the HVE Framework provides the "missing victim-side companion" to existing cybersecurity frameworks (CVE, ATT&CK, F3). Its significance lies in:

• Shifting the Focus: Moving from "what the attacker did" (TTPs) to "what human vulnerability was exploited and how to patch it."
• Enabling Real-Time Defense: By operationalizing concepts like the "hot–cold empathy gap" and "cognitive friction" into machine-readable patches, the framework enables AI agents to intervene in real-time with strategies calibrated to the victim's emotional state.
• Standardizing Intelligence: Providing a shared language for cross-institution intelligence sharing (e.g., banks, telcos, law enforcement) to track evolving scam patterns and measure the effectiveness of interventions.
• Ethical Safeguards: Explicitly designing the framework to prevent stigmatization by classifying "weaknesses" as contextual factors rather than personal traits, and restricting the use of HWE data to protective interventions only.

The paper concludes that while the framework is a v1 specification, it establishes the necessary theoretical and practical foundations to bridge the gap between behavioral science and operational cybersecurity defense.