In recent years, I\u2019ve been coming across some questions about using psychological profiling as a tool to guide decisions in awareness-raising plans.<\/p>\n
Here\u2019s the idea: figure out the psychological profile of our users<\/strong> using various techniques and algorithms. Then, use this info to deliver tailored awareness content to each person\u2019s needs. Additionally, conduct specific phishing simulations to exploit the weaknesses of each profile.<\/p>\n We can determine a psychological profile through simple surveys or, in a less transparent way, using chatbots or artificial intelligence.<\/em><\/p>\n But here\u2019s the kicker: using these profiles in awareness-raising isn\u2019t backed by enough evidence of its effectiveness. Plus, a person\u2019s psychological profile is clinical info. So, if we\u2019re planning to test our users psychologically, store this info, and make decisions based on it, we need to be extremely careful.<\/p>\n Let\u2019s break this down in the context of the GDPR:<\/p>\n The awareness platform can typically be accessed by:<\/p>\n If the platform contains info about our users\u2019 psychological profiles, we\u2019re in a dicey situation. Normally, only specialized psychology personnel within the organization should handle this sensitive information, keeping it under wraps. Only they should see any info, reports, or data related to users\u2019 psychological profiles.<\/p>\n Users in our organization need to understand how their psychological profiles will be created.<\/strong><\/p>\n Here, we might face some challenges. If, for example, we\u2019re using a survey, we can explain it clearly. But if our awareness platform builds profiles using algorithms or AI, it\u2019s really tough for us to understand and convey this process clearly to everyone in our organization.<\/p>\nAccess to Information<\/strong><\/h3>\n
\n
Transparency<\/strong><\/h3>\n