Why The Human Problem In Cybersecurity Requires A More Humane Solution

People are the biggest vulnerability in cybersecurity. But are businesses doing enough to control and manage this risk? Short answer, no. Looking at cybersecurity spending it becomes evident that many strategies are focused on technological controls, as cybersecurity has traditionally been perceived solely as a technology-centric function. This mindset needs a reboot. People don’t make mistakes from lack of security technology investments; they err because, well, we’re human.

Understanding The Social Behavior Of Human Error
Humans are flawed by design. We have biases, we are judgmental, we repeat the same mistakes over and over again. We do have free will and the ability to choose. Sometimes we’re stressed, sometimes we’re distracted, sometimes we’re tired or just overworked. The remote work situation hasn’t helped either. Most employees are juggling between home and work, leading to cognitive overload. 

Threat actors and adversaries understand these emotions and situations well. They design social engineering attacks that invoke human emotions (such as greed, fear, urgency, lust, anger, et. al.) and which solicit a reaction such as clicking a link, visiting a website, entering credentials, downloading an attachment or application. 

Humans are also fairly predictable. For instance, many users apply simple and common passwords that can be easily guessed or hacked. It’s also not uncommon to reuse passwords across multiple accounts. Attackers are well familiar with these habits -- either they attack vulnerable websites and steal credentials or they simply purchase leaked credentials from underground dark web marketplaces.

There's also a prevalent lack of common cybersecurity knowledge. Even if, hypothetically, employees did possess the security know-how, gaps will generally appear between their knowledge, intention and behavior. What this means is that, even if one has the right security knowledge, it doesn’t guarantee they will pay heed to security protocols and policies. We ignore a speeding sign because we’re oblivious or we’re running late. In the same way, employees often treat cybersecurity policies, instructions and advice in the same way. 

Organizations Conduct Training, But Not Enough To Impact Behaviors
Many organizations run some form of annual security training for their staff. But let’s face it, these types of “check-the-box” training are not enough to influence overall behaviors, attitudes, feelings, perceptions and beliefs with regards to security. To influence these things organizations need to instill a positive culture of cybersecurity. Below are leading factors that support a resilient security culture:

  • Employees have an awareness and understanding of security challenges
  • Employees recognize that security is a shared responsibility
  • Security is embedded in the values of the organization
  • Employees feel safe from recrimination for reporting incidents
  • Employees consider security as part of their job description
  • Employees help colleagues become more secure
  • Employees feel comfortable asking questions to security teams
  • Employees receive monthly training or briefings

Additionally, employees should feel they are an extended part of the security team; they should value security not because they are being told to do so, but because they know that’s the right thing to do. 

How Organizations Can Build A Humane Security Culture
Following these best practices, organizations can build and sustain a culture of security:

1. Articulate the value of security: The key to engaging people is speaking in a language they understand. This means conveying that security isn’t only imperative in a crisis but is an enabler of operations, contributing to the wider success of the organization.

2. Improve Culture At the Top: Culture is infectious and driven top-down. If leadership is not fully engaged or unappreciative of the value of security, then culture will not flourish and succeed. Leadership must endorse security, promote it actively and lead by example.

3. Show Commitment: Culture isn’t static but requires ongoing commitment. This means communicating often, reminding employees of the true purpose of security, offering them tools and training, running regular phishing and social engineering attack simulations that help embed security instincts and promote best practices. 

4. Reward, Don’t Punish: Reward people for their positive contributions to security rather than applying scare tactics. An arrogant, punitive or fear-focused security team will always lead to a weak and toxic business and security culture.

5. Apply Common Sense to Policies: The quality of messaging and communications can make or break the security culture. Apply easy to follow, easy to digest policies clearly and simply defined by a supportive security staff. This can lead to deeper security bonding across the organization.

The effectiveness of your security culture hinges on the quality of your training and communications. Having concise and practical policies will foster a deeper understanding of security and cultivate stronger bonds across the organization. Humans are intelligent, adaptive, and learn over time. But humans are also emotional, unpredictable and error-prone creatures. Organizations must recognize these strengths and weaknesses and practice empathy for building a robust culture of cybersecurity.

Featured

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Motorola Solutions Named Official Safety Technology Supplier of the Ryder Cup through 2027

    Motorola Solutions has today been named the Official Safety Technology Supplier of the 2025 and 2027 Ryder Cup, professional golf’s renowned biennial team competition between the United States and Europe. Read Now

  • Evolving Cybersecurity Strategies

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

New Products

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.