Toward Adaptive Privacy-Enhancing Training: A Longitudinal Study of How Personality Shapes Responsiveness to Information Security Awareness Training
Authors: Ofir Cohen (Ben-Gurion University of the Negev), Asaf Shabtai (Ben-Gurion University of the Negev), Rami Puzis (Ben-Gurion University of the Negev)
Volume: 2026
Issue: 4
Pages: 1072–1087
DOI: https://doi.org/10.56553/popets-2026-0160
Abstract: Human error remains the primary vector for privacy breaches, with users frequently exposing sensitive personal data through unsafe behaviors, such as granting excessive permissions, neglecting screen locks, or falling for social engineering. Yet, existing information security awareness (ISA) programs often adopt a one-size-fits-all approach, neglecting users’ personality traits and risk perception. In this work, we conducted a comprehensive five-week study with 105 participants to evaluate how personality traits and Passive Risk-Taking (PRT) interact with different ISA training methodologies. Prior research has primarily examined direct associations between personality traits and self-reported ISA measures, producing mixed findings and providing limited insight into how individual differences shape responsiveness to ISA training interventions. To address these limitations, we used a longitudinal sensor-based framework that captures real-world security behaviors over time, enabling a more reliable assessment of ISA training outcomes. Our results show that individual differences moderate training efficacy: users with high Agreeableness achieved greater gains through active-risk training (social engineering simulations), whereas those with lower Agreeableness benefited more from passive-risk training targeting omission-based risks. Furthermore, we find that Agreeableness moderates the relationships between both baseline PRT and changes in PRT and subsequent ISA improvements, while Conscientiousness moderates how resource-related PRT translates into ISA gains. Overall, these findings show that personality traits shape how users benefit from different training strategies and influence the alignment between risk reduction and awareness gains, supporting a shift toward adaptive, privacy-enhancing ISA training.
Keywords: Information Security Awareness, Personality Traits, User Study, Privacy, Human Factors
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
