Deep Learning Models and Social Engineering Dynamics in Insider Threat Detection: A Systematic Review

The exponential expansion of the global digital ecosystem has significantly increased organizational vulnerability to sophisticated insider threat attack vectors. Although Machine Learning and Deep Learning models have improved anomaly detection techniques, a critical gap remains in addressing insider threats influenced by internal social engineering. In particular, Reverse Social Engineering, where malicious insiders manipulate unintentional or innocent colleagues, poses an emerging and underexplored threat. This study systematically reviews forty-nine peer-reviewed articles published between 2015 and April 2025, using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses methodology to investigate current deep learning approaches for insider threat detection. The review highlights a reliance on sequential models such as Long Short-Term Memory and Gated Recurrent Unit algorithms, attention-based transformer models, and graph neural networks. These techniques demonstrate effectiveness in identifying behavioral anomalies and system misuse but fail to detect trust manipulation and social exploitation. Additionally, commonly used datasets, including the Computer Emergency Response Team Insider Threat Dataset from Carnegie Mellon University, DARPA1999, and Enron, do not adequately represent realistic social engineering scenarios, thereby limiting the ability of detection models to address human-driven threats. Traditional evaluation metrics, including Precision, Recall, and F1 Score, also fall short in assessing the contextual and behavioral dimensions of insider threats. This review emphasizes the urgent need for adaptive, context aware and behavior-aware detection frameworks, enriched datasets that incorporate social dynamics, and evaluation models that account for cognitive influence. Addressing these overlooked dimensions is essential for advancing organizational cybersecurity resilience against evolving insider threat landscapes.