THE HUMAN VECTOR OF INTRUSION INTO CRITICAL INFRASTRUCTURE FACILITIES: RECONCILING THREE INDEPENDENT ACCOUNTS OF INITIAL ACCESS

Abstract

The paper addresses one specific mechanism by which critical infrastructure facilities are damaged: the one in which intrusion starts with a member of staff and ends with interference in the technological segment. The problem behind the study is not a shortage of publications but the absence of any overlap between two existing bodies of literature. Ukrainian work on critical infrastructure describes facilities, threats and legal regimes, while work on social engineering and phishing describes user behaviour outside any sectoral context, and the employee through whom entry into an energy facility actually occurs falls out of both. The introduction shows that this gap carries a practical rather than a bibliographic cost: protective measures are designed either for the technological perimeter or for the office user, and the seam between them is left without an owner. The theoretical basis of the study reconstructs the damage chain as a sequence of four links — influence on the employee, acquisition of initial access, lateral movement to the boundary of the technological segment, and interference in control — and records that each link has its own statistics, its own set of protective measures and its own research literature, while the transition between links is described nowhere. The research methodology consists in reconciling three independent accounts of initial access over partially overlapping observation windows: the global Verizon Data Breach Investigations Report, the European ENISA Threat Landscape, and the semi-annual analytics of the State Cyber Protection Centre of Ukraine. The results comprise four parts. The first records the divergence: the share attributed to social engineering ranges across the three accounts from sixteen to sixty per cent, and these figures do not reconcile by direct comparison. The second explains the divergence through four methodological differences, the principal one concerning the unit of account, and presents a recalculation that converts the European distribution into the same unit as the global one and shows that the residual gap falls not on phishing but on the exploitation of vulnerabilities. The third examines the reproducibility of the chain on Ukrainian material, where the documented episode of 2015 is set against later campaigns in which the entry vector was different or was never disclosed. The fourth assesses what generative artificial intelligence has actually changed in this chain, and why raising staff awareness does not close the vector according to the available experimental evidence. The verbatim text of a proposed addition to paragraph 9 of the General Requirements for Cyber Protection of Critical Infrastructure Facilities is given in the results, and the conclusions set out directions for further research, among them the transfer of susceptibility-to-persuasion estimates from the general population to operators of industrial control systems.