While students have a general awareness of security cues, they sometimes lack the knowledge to interpret them. They do not actively check for these indicators unless they are visiting unfamiliar sites or receiving email or SMS from unknown sources. It is more of a preventive measure in unfamiliar contexts.

Familiarity with the user interface and procedure reduces vigilance. Many students fell victim to attacks involving popular sites like Amazon or Spotify. The trust in the interface led students to overlook security cues, such as the full URL and legitimacy of email. This highlights the importance of user interface design in creating a false sense of security, showing that social engineers can exploit this trust and familiarity to increase the effectiveness of their attack.

Students exhibit selective cybersecurity awareness. While most UK university students were familiar with phishing attacks, they were less aware of other forms of social engineering, such as smishing and social media impersonation.

Previous experience with cyber attacks play a crucial role in shaping security behaviour. Participants who had encountered phishing or similar attacks in the past demonstrated more caution and had developed personal coping mechanisms, such as using separate accounts for potentially risky and suspicious activities.

Huge gap between perceived and actual cybersecurity knowledge. Many participants overestimated their cyber security knowledge, rating themselves highly in the questionnaire despite falling victim to several attacks during the simulation. This suggests that overconfidence may contribute to increased vulnerability, as students may not feel the need to be vigilant if they believe they are already well-protected.