By Dave DeFusco
For years, organizations have spent billions of dollars protecting their computer systems from hackers. Yet one of the biggest cybersecurity risks is not a piece of software or a network vulnerability. It is human behavior. That challenge inspired Mayukh Paul, a recent graduate of the Katz School’s M.S. in Cybersecurity, to create VISHWAR, a human-centered cybersecurity training and risk measurement platform designed to help people recognize and respond to cyber threats more effectively.
He recently presented his project, “VISHWAR: A Human-Centric Cybersecurity Training and Risk Measurement Platform,” at the 2026 Symposium on Science, Technology and Health.
The need for a new approach is significant. An IBM report shows that 95% of cybersecurity breaches involve human error, including falling for phishing emails or misusing credentials. Social engineering attacks, in which criminals manipulate people into revealing sensitive information, remain one of the most common ways hackers gain access to organizations. The average cost of a social engineering breach is estimated at nearly $5 million. Paul believes traditional cybersecurity awareness programs are not doing enough to address the problem.
“When I started researching cybersecurity training, everything I came across felt very static,” said Paul. “I kept asking myself, ‘Are people actually learning from this?’ If me and my friends were sitting through the training, we could just copy each other’s answers. No one was really learning.”
His interest in social engineering began long before graduate school. Paul said he was fascinated by stories of expert manipulators who could persuade people to reveal sensitive information through conversation alone.
“That human element was the interesting angle for me,” he said. “I wanted to solve a problem that hadn’t really been solved yet.”
The result was VISHWAR, which stands for Virtual Interactive Simulation Hub for Warfare Against Ruses. Instead of relying on annual training sessions and quizzes, the platform uses realistic simulations to measure how people respond to cyber threats over time.
“What if we could gamify cybersecurity training?” said Paul. “People don’t want another task on top of their nine-to-five jobs. I wanted to make learning happen naturally, without people feeling like they were sitting through another compliance exercise.”
At the heart of the platform is what Paul calls the Human Vulnerability Management Lifecycle, or HVML. Inspired by the way cybersecurity teams manage software vulnerabilities, the framework follows five stages: identify, test, patch, verify and report.
“In traditional cybersecurity, we identify technical vulnerabilities, test them, patch them, verify the fix and report the improvement,” said Paul. “I wanted to apply that same thinking to human behavior. When I started this project, I believed humans were the weakest link in cybersecurity. By the end, I realized they could become the strongest link if measured properly.”
To test the platform, Paul conducted an evaluation using multiple cybersecurity simulation scenarios. The results were encouraging. Click-through rates on suspicious content dropped by 15% to 25% after feedback-driven interventions. Participants also reported threats more quickly as the simulations progressed.
The research revealed that cyber risk varies widely from person to person. Some users struggled with phishing attacks, while others were vulnerable to different forms of social engineering.
“Everyone is different,” said Paul. “The personalized feedback helps identify what your weakest link is. Current training programs usually give everyone the same material. VISHWAR adapts the experience so people can focus on the areas where they need the most improvement.”
The platform also uncovered behavioral patterns among users who repeatedly made the same mistakes. Rather than treating these incidents as isolated events, VISHWAR tracks them over time and identifies individuals who may need additional support.
Today, Paul is applying many of the lessons from VISHWAR in his role as a security researcher and architect at PR3CORIA, an AI-driven risk and organizational intelligence platform. The research has also begun attracting academic attention. The VISHWAR research paper, “Measuring What Training Cannot See: VISHWAR as a Longitudinal Framework for Human Cyber Risk Assessment,” was recently published in the European International University’s Journal of Action of Research, expanding on the project's vision for continuously measuring and improving human cyber risk over time.
“With AI and emerging technologies, maybe one day VISHWAR will become a fully immersive experience,” said Paul. “The goal is to make cybersecurity learning engaging, measurable and effective. If we can change behavior, we can reduce risk before an attack ever happens.”
