Cybersecurity is often treated like a technical problem, but people are also a major part of security. Employees make decisions every day that can either reduce risk or create new vulnerabilities. Even an organization with strong security technology can still have problems if someone falls for a phishing message, reuses a password, mishandles information, or ignores a security procedure.<\/p>\n\n\n\n
Verizon\u2019s 2025 Data Breach Investigations Report found that around 60% of confirmed breaches involved a human element. That stood out to me because it shows why organizations cannot rely only on technical security tools.<\/p>\n\n\n\n
Phishing is a good example of how attackers take advantage of human behavior. Instead of attacking a system directly, an attacker may try to convince someone to give up login credentials, click a malicious link, or open a harmful attachment. These messages often use urgency, fear, curiosity, or trust to get someone to react quickly.<\/p>\n\n\n\n
Password habits can also create risk. Employees may use simple passwords or reuse the same password across several accounts because it is easier. If one account is compromised, attackers may try those same credentials on other services. Unique passwords, password managers, and multifactor authentication can help reduce that risk.<\/p>\n\n\n\n
Training is important, but organizations should not expect employees to be perfect. People get tired, distracted, rushed, and stressed. If security procedures are too difficult or time-consuming, employees may start looking for shortcuts. Strong cybersecurity should account for normal human behavior instead of assuming every mistake can be prevented through training.<\/p>\n\n\n\n
Organizational culture matters too. Employees should feel comfortable reporting suspicious activity or mistakes quickly. If people believe they will automatically be blamed or punished for admitting an error, they may hesitate to report it. That delay can give a security problem more time to grow.<\/p>\n\n\n\n
Management also plays an important role. If supervisors regularly ignore security procedures because they are inconvenient, employees may start doing the same thing. When leadership follows the rules and treats cybersecurity seriously, it becomes part of normal workplace behavior instead of something that only the IT department is responsible for.<\/p>\n\n\n\n
What I learned from this topic is that employees should not be viewed as separate from cybersecurity. People are part of the security system. Strong cybersecurity depends on technology, training, realistic policies, communication, and workplace culture working together.<\/p>\n\n\n\n
References Cybersecurity is often treated like a technical problem, but people are also a major part of security. Employees make decisions every day that can either reduce risk or create new vulnerabilities. Even an organization with strong security technology can still have problems if someone falls for a phishing message, reuses a password, mishandles information, or… <\/p>\n
CISA. (2024). Multifactor authentication. Www.Cisa.Gov. https:\/\/www.cisa.gov\/topics\/cybersecurity-best-practices\/multifactor-authentication<\/a>
<\/a>Secure our world | CISA. (2026). Cybersecurity and Infrastructure Security Agency CISA. (n.d.).
https:\/\/www.cisa.gov\/secure-our-world<\/a>
Merritt, M., Hansche, S., Ellis, B., Nethery Snyder, J., Sanchez-Cherry, K., & Walden, D.
(2024). Building a cybersecurity and privacy learning program (NIST Special Publication 800-50
Rev. 1). National Institute of Standards and Technology. https:\/\/doi.org\/10.6028\/nist.sp.800-50r1
Verizon. (2025, April 22). Verizon Business.
2025-dbir-data-breach-investigations-report.pdf<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"