In recent years, I’ve been coming across some questions about using psychological profiling as a tool to guide decisions in awareness-raising plans.<\/p>\n
Here’s the idea: figure out the psychological profile of our users<\/strong> using various techniques and algorithms. Then, use this info to deliver tailored awareness content to each person’s needs. Additionally, conduct specific phishing simulations to exploit the weaknesses of each profile.<\/p>\n We can determine a psychological profile through simple surveys or, in a less transparent way, using chatbots or artificial intelligence.<\/em><\/p>\n But here’s the kicker: using these profiles in awareness-raising isn’t backed by enough evidence of its effectiveness. Plus, a person’s psychological profile is clinical info. So, if we’re planning to test our users psychologically, store this info, and make decisions based on it, we need to be extremely careful.<\/p>\n Let’s break this down in the context of the GDPR:<\/p>\n The awareness platform can typically be accessed by:<\/p>\n If the platform contains info about our users’ psychological profiles, we’re in a dicey situation. Normally, only specialized psychology personnel within the organization should handle this sensitive information, keeping it under wraps. Only they should see any info, reports, or data related to users’ psychological profiles.<\/p>\n Users in our organization need to understand how their psychological profiles will be created.<\/strong><\/p>\n Here, we might face some challenges. If, for example, we’re using a survey, we can explain it clearly. But if our awareness platform builds profiles using algorithms or AI, it’s really tough for us to understand and convey this process clearly to everyone in our organization.<\/p>\nAccess to Information<\/strong><\/h3>\n
\n
Transparency<\/strong><\/h3>\n