DOI: 10.11118/ecos2026_006

SOCIAL ENGINEERING AND HUMAN-FACTOR VULNERABILITIES IN CRITICAL INFRASTRUCTURE: FINDINGS FROM A SIMULATED PHISHING CAMPAIGN

Kateřina Dobrovolná¹, Tomáš Pitner¹

¹ Department of Informatics, Faculty of Business and Economics, Mendel University in Brno, Zemědělská 1, 613 00 Brno, Czech Republic

Critical infrastructure organizations increasingly face cyberattacks that exploit human behaviour rather than technical vulnerabilities. Social engineering attacks, especially phishing and spear-phishing, remain among the most effective attack vectors because they target employees directly. This paper analyses the role of the human factor in cybersecurity within a critical infrastructure environment through a combination of threat intelligence analysis, questionnaire-based research, and a simulated phishing campaign implemented using the GoPhish framework. The study evaluates employee awareness, behavioural vulnerabilities, and organizational preparedness against social engineering attacks. The results confirm that phishing remains one of the dominant cyber threats and that technical protection alone is insufficient without systematic employee education and awareness-building. The paper proposes a set of organizational and technical countermeasures focused on strengthening the organizational “human firewall.” The findings contribute to current discussions on cybersecurity resilience in critical infrastructure and highlight the importance of integrating continuous awareness programs with practical simulation exercises.

Keywords: cybersecurity, social engineering, phishing, critical infrastructure, human factor, threat intelligence

pages: 7-7, online: 2026