A Layered Risk-Based Framework for Protecting Internet Users from Common Cybersecurity Threats

Abstract Internet users and small organisations rely on digital accounts, devices, cloud services, and connected applications, yet often lack a manageable process for deciding which cybersecurity actions should be taken first. This article develops a user-oriented, layered risk-assessment framework that connects asset identification, scenario-based threat analysis, ordinal likelihood–impact scoring, control selection, implementation ownership, monitoring, and reassessment. The framework was developed through a design-oriented synthesis of established cybersecurity standards, public guidance, threat-landscape reporting, and selected usable-security research. It is not a systematic literature review. The resulting design specifies seven operational stages, a five-point rating rubric, provisional prioritisation bands, critical-risk escalation rules, and a threat-to-control mapping covering common account, device, data, malware, availability, and third-party risks. Five hypothetical scenarios demonstrate how the scoring procedure can be applied; their ratings are illustrative judgements, not observed frequencies or empirical findings. No participants, operational dataset, controlled experiment, or measured security improvement are reported. The principal contribution is a traceable implementation structure for non-specialist users and small organisations, together with an evaluation protocol for future testing. The framework should be treated as a design proposal requiring expert review and user-centred validation, not as a proven intervention or a substitute for formal risk-management obligations.