Can Artificial Intelligence Predict Human Vulnerability to Cyber Threats? A Machine Learning Approach to Cybersecurity Behaviour

Individual users, rather than the technical systems around them, are frequently a critical point of vulnerability in cybersecurity: a reused password, an unexamined link, a postponed software update, or a banking session conducted over an unsecured public network can expose individuals to significant cyber risks.Existing approaches to behavioural cybersecurity often reduce vulnerability to a single overall score, which may indicate that an individual is at risk without identifying the specific behaviours contributing to that risk.At the same time, the growing application of supervised machine learning in cybersecurity has focused predominantly on organisational networks, systems, and software rather than on individual behavioural profiles.This paper addresses this gap by developing a multidimensional framework for analysing human vulnerability to cyber threats.The framework incorporates eight behavioural domains-password management, authentication, phishing response, device security, privacy practices, network behaviour, digital payment security, and incident response-along with a transparent and leakage-aware procedure for behavioural risk scoring.It further proposes a supervised machine-learning pipeline using Logistic Regression, Decision Tree, Random Forest, and K-Nearest Neighbours, with model assessment based on accuracy, precision, recall, F1-score, and ROC-AUC rather than accuracy alone.A SHAP-based explainability layer is incorporated to connect model classifications with the behavioural factors underlying them, making the resulting assessment more transparent and actionable.By integrating behavioural cybersecurity measurement, machine learning, and explainable artificial intelligence, the study presents a structured and non-stigmatising approach to understanding individual cybersecurity vulnerability and provides a foundation for future empirical investigation and targeted cybersecurity awareness strategies.