A Framework to Secure Business Assets Against Social Engineering Attacks in State Corporations in Kenya

Purpose. To develop a framework for securing business assets against social engineering attacks in state corporations in Kenya. Method: Mixed methods. Findings. The study found a rise in social engineering (SE) attacks, with phishing being the most common. Employee awareness and training were identified as the most critical factors in managing SE threats, supported by awareness programs, reporting practices, and integration with other training initiatives. Theoretical Implications. A lack of tailored frameworks and methods for addressing SE attacks in Kenyan state corporations was identified, underscoring the need for an effective cybersecurity framework. Practical implications. The study provides insights for cybersecurity professionals to better prevent, detect, and respond to SE attacks, while helping state corporations strengthen security, promote cybersecurity culture, and improve policy and governance. Value. It highlights the importance of employee compliance with security policies and skills in mitigating SE threats to business assets. Future Research. Further work should focus on advanced detection techniques, such as machine learning, and the impact of emerging technologies like AI chatbots on SE methods.