Cyniah Dunlap
Old Dominion University
CYSE 201: Cybersecurity
Charlie Kirkpatrick
September 25, 2026
The Human Factor In Cybersecurity
Introduction
When people think about cybersecurity they usually think about hackers, computers, and technology. However, people are also a big part of cybersecurity. A system can have strong security tools and still have problems if the people using the system make unsafe choices. This is known as the human factor. Human behavior can affect whether a cybersecurity system is protected or put at risk. This paper explains the human factor in cybersecurity. It also discusses some risks caused by human behavior and ways organizations can reduce these risks.
What Is the Human Factor in Cybersecurity?
The human factor means how people’s actions and decisions can affect cybersecurity. People use computers and technology every day. Because of this their choices can have a direct effect on security. Payne and Hadzhidimova explain that the phrase “human factors” looks at how individual factors can affect behavior. They also explain that understanding human behavior is important when studying cybercrime and cybersecurity (Payne & Hadzhidimova). This means cybersecurity is not just about having good software or strong security systems. People still have to use those systems correctly. For example an organization can have security software in place. However an employee could still click on a dangerous link or give their password to someone. The technology may be working correctly but the person’s decision can still create a problem.
How Human Behavior Can Create Cybersecurity Risks
People can create cybersecurity risks in many different ways. Some mistakes may happen because someone does not know what to look for. Other mistakes may happen because someone is in a hurry or does not think something is a big deal. One example is phishing. A phishing attack usually involves someone pretending to be a trusted person or company. They may send an email or message that looks real.
The goal is usually to get someone to click a link or give away information. If an employee falls for the message they could accidentally give an attacker access to a company account. Another example is weak passwords. Some people use simple passwords because they are easier to remember. Some people may also use the same password for multiple accounts. If one password gets stolen an attacker could try using it to access other accounts. These examples show why human behavior matters in cybersecurity. A company can have strong technology but employees still have to make safe choices.
White-Collar Cybercrime and Human Behavior
Human behavior can also be connected to cybercrime that happens in the workplace. Payne (2018) explains that white-collar crime and cybercrime can overlap. Technology has created new opportunities for people to commit crimes through their jobs or businesses. For example an employee who has access to company information could use that access for the wrong reasons. They could steal information or use technology to commit fraud. This is different from someone accidentally clicking a phishing link because the person is intentionally using their position or access to commit a crime.
Payne looked at 109 cases investigated by the U.S. Department of Justice to study the connection between white-collar crime and cybercrime. This shows that cybercrime is not always about an outside hacker attacking a company. People working inside an organization can also be involved in cybercrime (Payne, 2018).
Psychological and Social Factors
People do not always make cybersecurity decisions based only on what they know. Their emotions and surroundings can also affect their choices. For example someone who is busy at work may quickly click on an email without checking it carefully. Someone who is stressed may also take shortcuts. People can also learn behaviors from the people around them. If employees see other workers ignoring security rules they may start doing the same thing.
Payne and Hadzhidimova discuss learning theory as one way to understand cyber behavior. Learning theory suggests that people can learn behaviors through their interactions with other people. This means the behavior of coworkers can influence how someone else acts online (Payne & Hadzhidimova).
Another important idea is routine activities theory. This theory says that crime can happen when there is a motivated offender, a suitable target, and a lack of a capable guardian. In cybersecurity the guardian could be security software or a person who notices something suspicious. If the right protection is missing an attacker may have an easier opportunity to cause harm (Payne & Hadzhidimova).
How Organizations Can Reduce Human-Related Risks
Organizations can lower human-related cybersecurity risks by making sure employees understand what they are supposed to do. Training is one important way to do this. Employees should learn how to recognize phishing messages. They should also understand why strong passwords and other security practices matter.
Organizations should also have clear cybersecurity policies. Employees need to know what is allowed and what is not allowed. These rules should be easy to understand. Employees should also know what to do if they make a mistake or notice something suspicious.
Communication is important too. Employees should feel comfortable reporting a possible security problem. If someone clicks on a suspicious link they should be able to report it without being afraid that they will automatically get in trouble. Reporting problems quickly can give the organization a better chance of stopping an attack.
Organizations also need to create a security-focused culture. Cybersecurity should not only be the responsibility of the IT department. Everyone who uses the organization’s technology has a role in protecting it. Payne and Hadzhidimova explain that technology alone is not enough. Understanding human behavior is also important when creating cybersecurity protections (Payne & Hadzhidimova).
Conclusion
The human factor is an important part of cybersecurity because people are the ones using the technology. A person can make a mistake that creates an opportunity for an attacker. People can also intentionally use technology to commit crimes. Phishing and weak passwords are examples of simple actions that can create security problems. Insider threats and white-collar cybercrime show that people inside an organization can also create serious risks.
Organizations can reduce these risks through training and clear policies. Good communication is important too. Employees need to understand that cybersecurity is everyone’s responsibility. Technology can help protect an organization but it cannot completely replace people. Understanding how people think and behave is an important part of keeping organizations safe.
References
Choong, Y. Y., & Theofanos, M. F. (2015). What 4,500+ people can tell you: Employees’ attitudes toward organizational password policy do matter. In Human aspects of information security, privacy, and trust (pp. 299\u2013310). Springer.
Cybersecurity and Infrastructure Security Agency. (2022). Insider threat mitigation guide. U.S. Department of Homeland Security.
Dawkins, S., & Jacobs, J. (2023). Phishing with a net: The NIST Phish Scale and cybersecurity awareness. National Institute of Standards and Technology.
Merritt, M., Hansche, S., Ellis, B., Sanchez-Cherry, K., Nethery Snyder, J., & Walden, D. (2024). Building a cybersecurity and privacy learning program (NIST Special Publication 800-50 Rev. 1). National Institute of Standards and Technology.
National Institute of Standards and Technology. (2018). Building a cyber-secure culture.
Payne, B. K. (2018). White-collar cybercrime: White-collar crime, cybercrime, or both? Criminology, Criminal Justice, Law & Society, 19(3), 16\u201332.
Payne, B. K., & Hadzhidimova, L. (n.d.). Cybersecurity and criminal justice: Exploring the intersections.
<\/p>\n","protected":false},"excerpt":{"rendered":"
Cyniah Dunlap Old Dominion University CYSE 201: Cybersecurity Charlie Kirkpatrick September 25, 2026The Human Factor In CybersecurityIntroduction When people think about cybersecurity they usually think about hackers, computers, and technology. However, people are also a big part of cybersecurity. A system can have strong security tools and still have problems if the people using the… <\/p>\n