Method for assessing the risk of user compromise based on individual security profile

This article presents a method for assessing the risk of user compromise in corporate information systems caused by social engineering cyberattacks. The approach integrates an evaluation of the individual security profile of each user – based on psychological, organizational, technical, and information influence factors – with graph-based modelling of internal interactions within the organization. Unlike most existing methods that focus solely on isolated user characteristics or assume a single-stage (direct) cyberattack scenario, the proposed method accounts for the propagation of cyberattacks through multi-stage trajectories in communication networks. A formalized four-phase model of social engineering cyberattack implementation is developed, with each phase described as a function of interacting factors. Conditional probabilities are estimated using dynamic coefficients that reflect both the base value and the contextual impact of modifying factors. A graph-based procedure is introduced to calculate the probability of multi-stage compromise based on the structure and intensity of user interactions (e.g., project participation, communication frequency, hierarchical relationships, and shared access to information assets). The proposed method was validated through individual user security profiling, followed by scenario-based modeling of multi-stage social engineering attack propagation on a representative subset. Results show that users with strong individual protection can remain vulnerable due to their position in critical communication chains. The visualization of trajectories exceeding a defined probability threshold supports the identification of high-risk paths and intermediary nodes that require prioritized protection measures. The main scientific contribution lies in combining individualized risk assessment with system-level propagation modelling using interpretable and adaptable mathematical constructs. The method does not require large volumes of empirical data, which ensures its practical applicability even in conditions of limited access to internal information. Future research will focus on automating data collection for factor assessment, adapting the model for real-time operation, and extending it through advanced modelling of behavioral attack scenarios.