The Human Factor in Cybersecurity: Why technology alone cannot stop cyberattacks

Imagine an organisation that invests thousands of dollars in advanced firewalls, antivirus software, intrusion detection systems, and sophisticated security monitoring tools. Its digital infrastructure appears secure. Yet, one employee receives a convincing email, clicks on a malicious link, and unknowingly gives a cybercriminal access to sensitive organisational information.

This scenario highlights one of the most significant challenges in modern cybersecurity: technology can strengthen security, but people remain an essential part of the defence. Cybersecurity discussions often focus on technical solutions such as encryption, firewalls, multi-factor authentication, and endpoint protection.

Although these technologies are necessary, they cannot independently eliminate cyber risks. Cybercriminals increasingly exploit human behaviour, trust, fear, urgency, and gaps in security awareness to gain unauthorised access to digital systems. Consequently, understanding the human factor has become essential to developing effective cybersecurity strategies.

Understanding the Human Factor in Cybersecurity

The human factor in cybersecurity refers to how people's behaviour, decisions, knowledge, and interactions with technology influence the security of digital systems and information. It encompasses accidental mistakes, susceptibility to manipulation, poor security practices, and deliberate malicious activities.

One common example is phishing. In phishing attacks, cybercriminals impersonate trusted individuals, financial institutions, organisations, or service providers to deceive victims into disclosing sensitive information, clicking malicious links, or downloading harmful attachments.

Other examples include password reuse, sharing confidential information through unauthorised platforms, approving unexpected authentication requests, and failing to report suspicious activities. However, it would be inaccurate to attribute every human-related security incident to employee negligence.

Organisational culture, inadequate training, excessive workloads, complicated security procedures, and poor system design can also influence employee behaviour.

Therefore, cybersecurity professionals must examine not only individual decisions but also the organisational environments in which those decisions occur.

What Does the Evidence Tell Us?

The importance of human behaviour in cybersecurity is reflected in industry research.

According to Verizon's 2025 Data Breach Investigations Report, the human element was involved in approximately 60% of breaches examined. The report analysed more than 22,000 security incidents, including 12,195 confirmed data breaches.

This finding demonstrates the continuing importance of human-related risks in organisational cybersecurity. However, human involvement should not automatically be interpreted as employee negligence, since it encompasses different forms of interaction between people, credentials, social

engineering, and malicious activities.

Similarly, the National Institute of Standards and Technology (NIST), through its Cybersecurity Framework 2.0, emphasises that cybersecurity should be managed as an organisational risk rather than treated exclusively as a technical responsibility. The framework identifies six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.

These functions demonstrate that effective cybersecurity requires leadership, risk assessment, protective measures, incident detection, response capabilities, and recovery planning. Together, these perspectives reinforce an important principle: cybersecurity resilience depends on the relationship between people, technology, and organisational processes.

Why Technology Alone Is Not Enough

. First, cybercriminals exploit human trust. Even sophisticated security systems may fail to identify every deceptive communication. Attackers can impersonate managers, colleagues, business partners, or trusted institutions to manipulate individuals into taking actions that compromise security.

. Second, poor security practices can weaken technical protection. Password reuse, excessive access privileges, careless handling of confidential information, and failure to follow security procedures can expose organisations to unnecessary risks.

. Third, technology cannot independently establish organisational accountability. Security software cannot ensure that management provides adequate training, employees understand reporting procedures, suppliers maintain appropriate security standards, or organisations comply with applicable data protection requirements.

. Finally, no security system is completely immune to attacks. Organisations must recognise that prevention alone is insufficient. They also need effective monitoring, incident response, recovery procedures, and continuous improvement mechanisms.

These limitations do not diminish the importance of cybersecurity technologies. Rather, they demonstrate why technological protection must be supported by informed people and effective organisational practices.

Practical Strategies for Reducing Human-Related Cyber Risks

1. Continuous cybersecurity education. Employees should receive regular, practical training on phishing, social engineering, password security, data protection, and suspicious online activities. Training should reflect the threats employees are likely to encounter in their respective roles.

2. Promoting a positive security culture. Organisations should encourage employees to report suspicious activities and security mistakes without unnecessary fear of punishment. A culture that discourages reporting can delay incident detection and increase potential damage.

3. Strengthening authentication and access controls. Organisations should implement multi- factor authentication, password managers, unique passwords, and least-privilege access. Where practical, phishing-resistant authentication should be prioritised for sensitive accounts.

4. Integrating security into organisational processes. Security procedures should be clear and practical. For instance, unusual financial requests or changes to payment details should require independent verification through trusted communication channels.

5. Conducting regular security assessments. Authorised phishing simulations, access reviews, security awareness assessments, and incident analysis can help organisations identify weaknesses and improve their security practices.

6. Developing effective incident response plans. Organisations should establish clear reporting channels, assign incident response responsibilities, maintain reliable backups, and regularly test recovery procedures.

These strategies support the broader risk management principles promoted by NIST and the Cybersecurity and Infrastructure Security Agency (CISA).

Conclusion

The human factor remains a critical consideration in cybersecurity because digital systems do not operate independently of the people who design, manage, use, and protect them. However, the solution is not to label people as the weakest link in cybersecurity. Instead, organisations must create environments where employees are equipped to make informed security decisions, technological controls are properly implemented, leadership takes responsibility, and

suspicious activities are reported promptly.

The future of cybersecurity depends on combining technological innovation with human awareness, effective governance, and organisational resilience.

Firewalls, encryption, and advanced security software remain essential, but their effectiveness also depends on the people, processes, and decisions surrounding them.

Ultimately, the question is not whether organisations should invest in technology or people. It is how effectively they can bring both together to build a more secure digital environment.

References

7. Cybersecurity and Infrastructure Security Agency (CISA). (n.d.). Secure Our World. https://www.cisa.gov/secure-our-world

8. National Institute of Standards and Technology (NIST). (2024). The NIST Cybersecurity Framework (CSF) 2.0. https://www.nist.gov/cyberframework

9. National Institute of Standards and Technology (NIST). (2024). Building a Cybersecurity and Privacy Learning Program (NIST SP 800-50 Rev. 1). https://doi.org/10.6028/NIST.SP.800-50r1

10. Verizon. (2025). 2025 Data Breach Investigations Report.

https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf