Cybersecurity in context: Perceptions, behaviors, and lived experiences in Saudi Arabia

Saudi Arabia is currently experiencing rapid technological, social, and economic transformation associated with its ongoing digitalization efforts. Protecting individuals’ valuable data is therefore essential for ensuring safe digital progress. Cyberattacks, particularly those based on social engineering, are often shaped by local context and culture in order to exploit trust. This emphasizes the need for culturally aware cybersecurity research, particularly in highly collectivist societies like the Saudis, where ongoing changes require evidence-based guidance to ensure safe and effective progress. Understanding the behaviors, perceptions, and concerns of individuals, as well as sources of cybersecurity advice is essential. This study involved in-depth face-to-face interviews with 33 Saudis and analyzed 12 real-life phishing experiences using a narrative inquiry approach. Participants showed various levels of security vigilance; most recognized common threats like viruses but lacked understanding of more advanced practices such as multi-factor authentication. We found that some risky behaviors were common, such as sharing passwords; participants expressed frustration and difficulty remembering passwords; the decision to share was often driven by convenience and priorities. From the narrative, we identified cultural factors such as avoiding reporting incidents, possibly due to shame, social pressure, or a lack of trust, which must be considered when designing effective, localized cybersecurity strategies.