Human Factor in Cybersecurity: Cyber Education as a Systemic Response to Growing Threats in the Digital Space of Ukraine and the EU

Abstract

This article addresses a critical vulnerability in contemporary cybersecurity defenses: the persistent dominance of human factors as the primary vector in successful cyberattacks across Ukraine, the European Union, and globally, despite substantial investments in technical security infrastructure. Empirical evidence from authoritative sources, including Verizon, the World Economic Forum, CERT-UA, and ENISA, consistently identifies that most cybersecurity breaches involve human elements encompassing insider errors and psychological manipulation, with phishing and social engineering accounting for the majority of intrusion entry points. Ukraine’s decade-long trajectory of escalating cyber threats – from the 2014 Crimea operations through the catastrophic 2017 NotPetya campaign to sustained high-tempo operations during Russia’s 2022–2025 full-scale invasion – demonstrates that adversaries systematically exploit human cognitive vulnerabilities rather than relying exclusively on technical sophistication. Similarly, the European Union faces a diverse threat landscape affecting critical infrastructure. This article argues that cybersecurity policy and practice exhibit a strategic misalignment: while technical defenses have matured substantially, educational frameworks addressing human behavioral vulnerabilities remain fragmented, episodic, and sometimes disconnected from real-world attack patterns. The article frames cybersecurity education not as a mere technical skill domain but as a fundamental dimension of digital citizenship and organizational resilience. It presents the EnCycLEd Erasmus+ project – a cross-border educational initiative that brings together partners from five European countries (Germany, Austria, Greece, Malta, and Ukraine) – as a concrete implementation model demonstrating how cybersecurity literacy can be mainstreamed into general school curricula through interactive, story-driven, age-segmented educational resources grounded in pedagogy and real-world threat patterns. The article employs multi-method research combining quantitative threat intelligence analysis, previous cyber incident narrative analysis, threat landscape characterization, and case study examination to establish that human-centered cybersecurity education constitutes a necessary complement to technical defenses and a strategic policy imperative for institutional and societal resilience in an interconnected digital environment.