{"id":307,"date":"2026-10-02T04:46:31","date_gmt":"2026-10-02T04:46:31","guid":{"rendered":"https:\/\/sites.wp.odu.edu\/alyssacarter\/?p=307"},"modified":"2026-10-02T04:46:31","modified_gmt":"2026-10-02T04:46:31","slug":"the-human-factor-in-cybersecurity","status":"publish","type":"post","link":"https:\/\/sites.wp.odu.edu\/alyssacarter\/2026\/10\/02\/the-human-factor-in-cybersecurity\/","title":{"rendered":"The Human Factor in Cybersecurity"},"content":{"rendered":"The Human Factor in Cybersecurity
The field of cybersecurity is traditionally associated with such technological means as firewalls, antivirus software, encryption, and others. However, the application of technology alone does not provide sufficient guarantee against all possible threats. It is the people working with those technologies who can influence the degree of security provided by them. The concept of the \u201chuman factor\u201d in relation to cybersecurity can be interpreted as the influence of human activity, decisions, mistakes, and interaction upon the security of information and technologies. The employees can enhance cybersecurity of their organizations depending on their behavior.
Human Behavior
Human actions may lead to cybersecurity attacks in several ways. People take decisions regarding security every day while working, and even one unwise decision may provide the attacker with a chance. An employee may follow a link, install unauthorized software, use the same password, leave the computer without locking it or share sensitive information with the wrong recipient. The actions may not be conducted maliciously, but they still pose a threat to organizational information. The mistake made by a person may become even more risky for a reason that cyber attackers are aware of people\u2019s reactions are based on emotions like fear, curiosity, trust, and urgency. Instead of attacking a well-protected computer, the attacker may find it easier to manipulate a person who already has access to it.
Phishing
Phishing is an instance of cyber threats that require interaction with people to some degree. Phishing is a social engineering threat whereby the attackers try to make the victim share information, open an attachment that is dangerous, and even go to a particular site. The attacker could use an email that seems to come from a supervisor, bank, courier service, or any other source that is trusted by the recipient. There could be a note saying that his or her account would be locked if he or she did not act quickly.
According to CISA (2024), you should be careful of messages that ask you to do something quickly or share some personal information. This demonstrates that phishing attacks could exploit psychological traits of people like fear, urgency, and trust rather than any technical vulnerability. Even if there is powerful software for cybersecurity protection in place, an individual who falls into a trap could give some critical information away to an attacker.
Weak Passwords
Human actions can lead to cybersecurity vulnerabilities by using weak or reused passwords. People usually have numerous accounts to handle, which makes it easy to develop an idea of using simple passwords or using the same password repeatedly to access different accounts. While such an approach can make things easier, it poses greater risks in case the password is exposed. In case someone gets hold of the reused password, they might try using the same credentials for accessing other accounts.
CISA recommends the development of long, random, and unique passwords and using a password manager to help with creating strong passwords (Cybersecurity and Infrastructure Security Agency, n.d.). Organizations can also use multifactor authentication (MFA) to require an additional step of confirming an individual’s identity. MFA will offer an additional level of security since the attacker may still be unable to gain entry even if the password is known. This demonstrates how technology can be used by organizations to reduce the harm done by human errors.
Workplace Factors
The behavior of individuals also depends on the working environment. The culture of the organization affects whether the employees will see cybersecurity as their vital responsibility or just a set of rules with which they must comply. If the employees observe coworkers using each other’s passwords, not logging out of systems, not locking computers, and violating any other security rules without facing any consequences, then such actions may become normative.
Psychological and social aspects can affect the behavior of employees regarding cybersecurity as well. They may choose to skip some security procedures when these procedures are complicated or inconvenient, or they affect the employee’s work negatively. Social aspects of the environment can also affect the employee’s decisions. If the employee shares some information or skips some steps at the request of a colleague because this is a common practice in the company, he or she can be under social pressure and comply with such requests. Employees can also behave improperly when they are stressed or in a hurry. These examples prove that people do not rely only on the knowledge to perform cybersecurity procedures.
Reducing Cybersecurity Risks
A company can mitigate human-related risks by establishing a corporate culture in which cybersecurity practices become an integral part of its operations. Training is necessary; however, it should be more than just mandating that staff members attend a one-time presentation each year. Employees should be trained in how to spot phishing scams, create strong passwords, keep sensitive data safe, and report suspicious activities. Practical training such as sending out fake phishing e-mails to employees will allow staff members to learn how to recognize a threat in advance.
According to the National Institute of Standards and Technology (NIST), cybersecurity training programs should be developed with a goal to instill change and foster a security culture (Merritt et al., 2024). Policies play a vital role here since employees need to know what is expected of them and what to do when something goes wrong.
Management can play an equally crucial role in minimizing human-induced risks. The importance of following certain security measures will be emphasized when the management itself adheres to those same measures as any other person in the organization. When the management shows negligence towards the adherence of security measures, employees may feel that those measures are insignificant and therefore should not be followed. The organization must encourage the reporting of any suspicious incident by the employees without any fear of being penalized since it gives the organization enough time to deal with the problem. It is also crucial to implement technical security measures to help minimize risk even after human errors.
Conclusion
However, the point is that the human element must not be neglected in cybersecurity since any complex security systems remain dependent on humans in terms of their correct use. The cases of phishing, poor passwords, and human errors at the office, among many others, prove the fact that failures in cybersecurity cannot be guaranteed by failures of technology. Human errors are possible due to daily decisions, psychology, peer pressure, and working conditions. Though it would be unachievable for organizations to avoid all the human mistakes, the effects of these mistakes can be minimized by means of training, clear policy, effective communication, advanced security measures, and good management.
\u2003
References
Cybersecurity and Infrastructure Security Agency. (2024). Phishing. U.S. Department of Homeland Security. https:\/\/www.cisa.gov\/sites\/default\/files\/2024-02\/Update%20to%20Phishing%20General%20Security%20Postcard_01.01.2024.pdf
Cybersecurity and Infrastructure Security Agency. (n.d.). Cyb3r_Sm@rT!: Use a password manager to create and \u201cremember\u201d strong passwords. U.S. Department of Homeland Security. https:\/\/www.cisa.gov\/resources-tools\/training\/cyb3rsmrt-use-password-manager-create-and-remember-strong-passwords
Cybersecurity and Infrastructure Security Agency. (n.d.). Require multifactor authentication. U.S. Department of Homeland Security. https:\/\/www.cisa.gov\/audiences\/small-and-medium-businesses\/secure-your-business\/require-multifactor-authentication
Merritt, M., Hansche, S., Ellis, B., Nethery Snyder, J., Sanchez-Cherry, K., & Walden, D. (2024). Building a cybersecurity and privacy learning program (NIST Special Publication 800-50 Rev. 1). National Institute of Standards and Technology. https:\/\/doi.org\/10.6028\/NIST.SP.800-50r1","protected":false},"excerpt":{"rendered":"

The Human Factor in CybersecurityThe field of cybersecurity is traditionally associated with such technological means as firewalls, antivirus software, encryption, and others. However, the application of technology alone does not provide sufficient guarantee against all possible threats. It is the people working with those technologies who can influence the degree of security provided by them…. <\/p>\n

Read More<\/a><\/div>\n","protected":false},"author":32711,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wds_primary_category":0},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/posts\/307"}],"collection":[{"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/users\/32711"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/comments?post=307"}],"version-history":[{"count":1,"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/posts\/307\/revisions"}],"predecessor-version":[{"id":308,"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/posts\/307\/revisions\/308"}],"wp:attachment":[{"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/media?parent=307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/categories?post=307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/alyssacarter\/wp-json\/wp\/v2\/tags?post=307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}