Article Review 1

Introduction

This review examines Bray, Johnson, and Kleinberg’s (2023) study, Testing human ability to detect ‘deepfake’ images of human faces, published in the Journal of Cybersecurity. The study explores whether people can distinguish AI-generated deepfake images from real human faces and whether simple interventions can improve detection accuracy. This topic is crucial to cybersecurity because deepfakes represent a rapidly growing digital threat that exploits human psychological weaknesses and social trust.
Relation to Social Science Principles

The study connects to several social science principles:

1. Human perception – It explores how individuals process facial cues and make judgments under uncertainty, reflecting psychological principles of perception and decision-making.
2. Behavioral sociology – It highlights how people adapt to new technological threats, influencing trust and interaction in online environments.
3. Criminology and cybercrime – The misuse of deepfakes for fraud, scams, and misinformation aligns with crime opportunity and victimization theories in criminology.
   Research Questions, Hypotheses, IV & DV

The authors addressed three primary research questions:

• RQ1: Can participants detect deepfake images above chance levels?
• RQ2: Do interventions (familiarization, advice, reminders) improve detection accuracy?
• RQ3: Does participant confidence correlate with accuracy?

Hypotheses: Interventions would improve accuracy, and participant confidence would correspond with correctness.

Independent Variables (IVs): Experimental condition (control, familiarization, one-time advice, advice with reminders).
Dependent Variables (DVs): Accuracy in labeling images (real vs. deepfake), reported confidence, and reasoning strategies.
Research Methods

The study used an experimental online survey with 280 participants recruited via the Prolific platform. Participants were randomly assigned to one of four groups: a control group or one of three intervention groups. Each participant was shown 20 images (from 50 real and 50 AI-generated human faces) and asked to identify each image as ‘real’ or ‘AI-generated,’ along with rating their confidence on a 10-point scale.
Data and Analysis

Data collected included binary image classifications, confidence ratings, and qualitative explanations. Statistical tests such as t-tests and ANOVAs were used to analyze accuracy, while qualitative data were coded using NVivo to identify reasoning strategies.

Findings: Participants averaged about 62% accuracy, only slightly better than chance. Interventions did not significantly improve results, and confidence remained high despite low accuracy. These results suggest that human intuition is unreliable for detecting AI-generated images.
Relation to Class Concepts

This research connects to multiple class concepts:

• Trust in digital environments – It reflects the challenge of verifying authenticity in digital contexts.
• Human factors in cybersecurity – Deepfake detection mirrors issues of user vulnerability, similar to phishing.
• Critical thinking and decision biases – The study highlights overconfidence bias, where individuals trust their judgment more than evidence supports.
• Policy implications – It supports the idea that defending against digital deception requires education and behavioral change alongside technical tools.
  Marginalized Groups and Social Impact

Deepfake technology disproportionately impacts marginalized populations. Women and minority groups face higher risks of non-consensual sexual deepfakes, harassment, and reputational damage. Such misuse exacerbates social inequalities, emphasizing the need for stronger ethical, legal, and technological protections for vulnerable communities.
Contributions to Society

This study contributes to society by:

1. Demonstrating the limitations of human perception in recognizing AI-generated content.
2. Showing how overconfidence can amplify misinformation risks.
3. Highlighting the need for interdisciplinary solutions that combine technical detection tools with social awareness and education.
   Conclusion

Bray et al. (2023) reveal that humans perform only slightly above chance when identifying deepfakes and that confidence does not correspond with accuracy. The study underscores an urgent cybersecurity and social challenge: human perception cannot keep pace with rapidly advancing AI manipulation. Addressing deepfakes requires not only technological innovation but also societal adaptation to strengthen digital literacy and trust.
References

Bray, S. D., Johnson, S. D., & Kleinberg, B. (2023). Testing human ability to detect ‘deepfake’ images of human faces. Journal of Cybersecurity, 9(1), 1–18. https://doi.org/10.1093/cybsec/tyad011

Article Review 2

Introduction / BLUF
This article, Controlling Cyber Crime through Information Security Compliance Behavior, examines how organizational culture, cybersecurity awareness, employee engagement, and trust in management shape employees’ compliance with security policies. BLUF: The study finds that organizational and psychological factors strongly influence compliance, and trust in management plays a key mediating role in how culture and awareness shape secure behavior.

Relation to Social Science Principles
This study reflects several social science principles including human behavior, organizational culture, and social influence. Human behavior is central because compliance is driven by employees’ psychological perceptions, motivation, and awareness. Organizational culture represents a major social science principle concerning shared norms, values, and social expectations within a group. Social influence and social learning theories help explain how employees model behaviors from leadership and peer norms. Together, these principles show that cybersecurity is as much a social and behavioral issue as it is technical.

Research Question / Hypotheses / Independent & Dependent Variables
Research Questions:

1. How does organizational culture impact information security compliance?
2. To what extent does cybersecurity awareness influence compliance behavior?
3. Does employee engagement moderate these relationships?
4. Does trust in top management mediate these effects?
   Hypotheses:
   The study proposes six hypotheses predicting that organizational culture, cybersecurity awareness, employee engagement, and trust in management each impact compliance directly or indirectly.
   Independent Variables:
   • Organizational culture
   • Cybersecurity awareness
   Moderators / Mediators:
   • Employee engagement (moderator)
   • Trust in top management (mediator)
   Dependent Variable:
   • Information security compliance behavior

Types of Research Methods Used
The study uses a quantitative research design. Data was collected from 261 employees across various production companies using validated questionnaires. The researchers applied Structural Equation Modeling (SEM) to test relationships among the variables and evaluate the overall model.

Types of Data and Analysis Used
Data consisted of Likert-scale survey responses measuring culture, awareness, engagement, trust, and compliance behavior. Following data collection, the authors performed Confirmatory Factor Analysis (CFA) to test validity and reliability, followed by SEM path analysis to test hypotheses. Reliability tests (Cronbach’s Alpha), model fit indices (CFI, RMSEA, SRMR), and correlation tables strengthened the statistical rigor.

Connections to Course Concepts
This study directly aligns with course concepts such as the social science view of cybersecurity, organizational behavior, trust theory, and human factors. It reflects how non-technical factors influence risk, echoing class discussions about behavior being the weakest link in cybersecurity. The findings also connect to the Theory of Planned Behavior, covered in lectures, by showing that attitudes, norms, and perceived control shape compliance. Leadership’s role in shaping norms ties to modules on power, influence, and culture.

Connections to Concerns or Contributions of Marginalized Groups
While the study does not directly analyze marginalized groups, its themes relate to their experiences in organizational environments. Marginalized employees may experience lower trust in management or feel excluded from security decision-making, influencing compliance behavior. Additionally, unequal access to training or psychological safety can affect awareness and engagement levels. Understanding these dynamics helps ensure cybersecurity programs are equitable and inclusive.

Overall Societal Contributions / Conclusion
This study contributes to society by demonstrating that cybersecurity compliance is not just technical—it is fundamentally social and behavioral. By showing that trust, culture, and engagement significantly influence compliance, the article provides guidance for organizations seeking to strengthen security through people-focused strategies. Developing supportive cultures and trustworthy leadership improves employee adherence to security protocols, reducing cyber risk and enhancing organizational resilience.

Reference
Ghaleb, M. M. S., & Pardaev, J. (2025). Controlling cyber crime through information security compliance behavior: Role of cybersecurity awareness, organizational culture, and trust in management. International Journal of Cyber Criminology, 19(1), 1–26.

Social Science Principles in Cybersecurity Policy Analysis

Cybersecurity Policy Analysts bridge technical knowledge and social science to craft effective policies. In their daily work, analysts rely on social science research to interpret human behavior, guide ethical decisions, and build inclusive security frameworks (Schaltegger et al., 2025). Understanding how people perceive risk is crucial: risk perception theory shows that individuals often use emotional reactions and heuristics rather than technical facts to judge cyber threats (Schaltegger et al., 2025). By applying this insight, analysts design communication campaigns and training programs that better align with public perceptions. For example, Schaltegger et al. (2025) note that “many serious incidents can be traced back to human behavior,” and recommend using mental models and heuristics to improve risk communication and security policy design. In practice, this means a policy analyst might promote clear, relatable examples of phishing risks and tailor warnings to match common mental shortcuts.

Key Social Science Concepts in Cybersecurity Policy:
– Human Behavior and Risk Perception: Cyber analysts use behavioral research to predict how different groups respond to threats (Schaltegger et al., 2025). For instance, people’s optimism bias or uncertainty aversion affects how strongly they comply with a new privacy rule. Knowing this, analysts may frame regulations to reduce fear or emphasize personal relevance.
– Social Engineering Awareness: Analysts consider principles of social engineering – the psychological manipulation used by attackers – in policy development (Wibowo, 2024). Understanding that over 90% of breaches involve social tactics (Wibowo, 2024), they recommend policies for mandatory employee training and stronger authentication protocols.
– Ethical Frameworks and Privacy: Concepts from ethics and political philosophy help analysts balance security with individual rights. For example, they apply social contract theory when evaluating surveillance policies, ensuring that public safety measures do not unduly infringe on privacy. Ethical reasoning guides choices like how much user data can be collected for threat intelligence without violating civil liberties.
– Cultural Sensitivity and Inclusion: Analysts draw on sociology and cultural studies to make policies equitable. They recognize that marginalized communities have different needs and vulnerabilities. Studies emphasize culturally relevant and localized approaches (e.g., using local language and examples) to increase cybersecurity awareness (Ghosh et al., 2023). By considering cultural context, analysts develop training programs and guidelines that resonate with diverse populations.

These social science principles play out every day. A policy analyst might use a public survey or focus group (methods from social research) to gauge community attitudes toward a proposed law. They examine demographic data to see which groups feel excluded by current rules. For instance, research in a developing country shows that individuals with lower income and less connectivity are significantly more likely to fall victim to cyberattacks (Khan et al., 2024). Recognizing this, analysts push for public investment in cybersecurity education and affordable technology. They craft policies such as subsidized broadband or community training to address these disparities.

Interacting with Marginalized Groups: Challenges

Cybersecurity policy analysts must ensure policies serve all segments of society, but marginalized populations pose specific challenges:

• Digital and Economic Access: Many underserved groups lack up-to-date devices or reliable internet, a concept known as “digital exclusion.” For example, people without smartphones cannot use certain multi-factor authentication tools, limiting their access to secure services (Khan et al., 2024; National Association of State Chief Information Officers [NASCIO], 2024). Analysts must address this by recommending low-tech alternatives or government-supported resources.
• Education and Literacy: Lower digital literacy means some community members do not understand security features (Ghosh et al., 2023; NASCIO, 2024). Policy analysts therefore advocate for tailored cybersecurity education programs. Research shows that culturally relevant, local-language training (rather than generic materials) is more effective in raising awareness among rural or low-income populations (Ghosh et al., 2023; NASCIO, 2024).
• Socioeconomic and Trust Barriers: Economic constraints and distrust of authorities can hinder policy acceptance. Marginalized groups may fear that cybersecurity measures (like data-sharing) could lead to surveillance or discrimination. Analysts must use inclusive communication and stakeholder engagement, for example by holding community forums and involving local leaders, to build trust and ensure policies are fair. They also use social science insights (e.g. critical race theory) to identify and mitigate bias in technologies like facial recognition, where federal testing found that many algorithms produced higher false-positive rates for some demographic groups than others (Grother et al., 2019).

By confronting these challenges, analysts aim to create equitable security measures. They often recommend public-private partnerships to bring cybersecurity tools and training to underserved areas. One study argues that improving security for vulnerable communities requires “investment in appropriately tailored digital literacy initiatives… both in terms of public-private partnerships and policy design tailored to those needs” (Ghosh et al., 2023).

Career and Society: A Dynamic Relationship

The role of a Cybersecurity Policy Analyst is deeply intertwined with society’s values and needs. Society’s demands – for privacy, freedom of expression, or economic innovation – shape cybersecurity policies, and analysts use social science to gauge public opinion on these issues. In turn, policies affect social outcomes: for example, encryption laws influence how freely individuals communicate and businesses operate internationally. Analysts must track social trends (like the rise of social media) and adjust policies to protect citizens without stifling innovation. The evolving threat landscape (e.g. generative AI for phishing) requires constant research into new social behaviors.

Moreover, analysts often translate complex technical debates into policy debates at the societal level. They write reports, testify before lawmakers, and work with community groups to explain how cybersecurity intersects with public welfare. Public trust is crucial: policies are more effective when people understand and buy into them. Thus, analysts apply marketing and communication research to craft clear messages, drawing on social science methods to measure public sentiment. Over time, this ensures that cybersecurity policy supports social goals like democracy and equity, while social values (ethics, cultural norms) in turn guide how cyber laws are framed.

Conclusion

Cybersecurity Policy Analysts operate at the nexus of technology and society, relying heavily on social science research. By applying principles of psychology, sociology, and ethics, they design policies attuned to human behavior and cultural context. They must understand social engineering tactics, risk perceptions, and community values to draft effective, inclusive regulations. Engaging marginalized groups requires recognizing barriers like digital access and literacy, and crafting solutions that address social inequities (Ghosh et al., 2023; NASCIO, 2024). Ultimately, the dynamic between cybersecurity and society means analysts continually adapt their approaches as social conditions change. Through social science-informed strategies, they aim to protect digital infrastructure in ways that are effective, ethical, and responsive to all members of society.

References

Ghosh, A., Diyasi, S., & Dey, D. (2023). Cybersecurity literacy programs for marginalized communities: Bridging the gap in digital security. Zenodo. https://doi.org/10.5281/zenodo.14740268

Grother, P., Ngan, M., & Hanaoka, K. (2019). Face recognition vendor test part 3: Demographic effects (NISTIR 8280). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.IR.8280

Khan, N. F., Ikram, N., & Saleem, S. (2024). Effects of socioeconomic and digital inequalities on cybersecurity in a developing country. Security Journal, 37(2), 214–244. https://doi.org/10.1057/s41284-023-00375-4

National Association of State Chief Information Officers. (2024). Bridging digital divides: Expanding cybersecurity in underserved communities. https://www.nascio.org/resource/bridging-digital-divides-expanding-cybersecurity-in-underserved-communities/

Schaltegger, T., Ambuehl, B., Bosshart, N., Bearth, A., & Ebert, N. (2025). Human behavior in cybersecurity: An opportunity for risk research. Journal of Risk Research, 28(8), 843–854. https://doi.org/10.1080/13669877.2025.2539109

Wibowo, B. (2024). Social engineering as a major cybersecurity threat: Analysis of challenges and solutions for organizations. International Journal of Science Education and Cultural Studies, 3(2), 57–65. https://ejournal.sultanpublisher.com/index.php/ijsecs/article/view/306