BLUF

The human factor is an important part of cybersecurity because people’s actions and decisions can affect the security of systems and information. This paper discusses how human behavior contributes to cybersecurity vulnerabilities, examines phishing and social engineering, considers psychological, social, and organizational influences on cybersecurity, and reviews ways that organizations can reduce these risks. 

The Human Factor

Within cybersecurity, the human factor refers to how people’s behavior and actions affect the security of computer systems and information. Cybersecurity is typically viewed as a technical issue, but people are the ones who use and interact with the technology, which means their knowledge, and actions can affect how secure a system is. Payne and Hadzhidimova (2018) explain that technology alone is not enough to provide effective cybersecurity and emphasize that the human element is also important to cybersecurity. Humans have the ability to strengthen security, or to create vulnerabilities either intentionally or unintentionally, making the human factor especially important to consider within cybersecurity.

Human Behavior

Human behavior can contribute to cybersecurity vulnerabilities when people make decisions that create opportunities for cyber security incidents. Payne and Hadzhidimova (2018) explain that individuals may know an action is wrong but still rationalize or justify the behavior, which is described through neutralization theory. The authors also discuss research connecting low self-control with forms of cyber deviance, which shows that a person’s decisions can influence cybersecurity risks. Human behavior can also create risk within the workplace. As Payne (2018) explains, as computers became a routine part of the workplace, opportunities also developed for people to use computer technology to commit workplace offenses. Human behavior can even be influenced by other people. Payne and Hadzhidimova (2018) discuss learning theory, which suggests that criminal behavior can be learned through interactions with others. This means that cybersecurity behavior could be shaped by the people an individual is exposed to, especially when harmful behavior is normalized or encouraged. 

Phishing and Social Engineering

Phishing is a cybersecurity risk that depends on human actions. Oesteraas (2025) explains that phishing is a way for attackers to obtain sensitive information such as passwords or financial information by pretending to be a trustworthy source through email or messaging. Social engineering uses similar tactics by manipulating people into sharing confidential information and may take advantage of trust, lack of knowledge, urgency, or fear (Oesteraas, 2025). In this type of attack, the attacker is relying on the victim’s judgment rather than only looking for a technical weakness. For example, an employee might receive what appears to be an urgent email from who they believe is a trusted person, and go on to click a link or send information before realizing it’s fraudulent. This shows how human behavior can directly contribute to cybersecurity incidents and vulnerabilities when attackers successfully manipulate a person’s judgment and trust. 

Cybersecurity risks and prevention

Psychological, social, and organizational factors can all influence the way people make cybersecurity decisions. Payne and Hadzhidimova (2018) explain that individual behavior may be affected by factors such as self-control and by behaviors learned from others. This means cybersecurity is not only reliant on whether people know the rules, but also on personal judgment and others behavior. Organizational factors can influence behavior as well. Payne (2018) mentions that business employees may be responsible for keeping track of a large number of passwords, which shows how workplace security requirements can become difficult to manage. Since these factors can affect the choices employees make, organizations need to create security practices that are effective, and reasonable for employees to follow. Oesteraas (2025) emphasizes education, cybersecurity training, targeted awareness efforts, and continued collaboration as important to cybercrime prevention. Oesteraas (2025) also discusses how the TSA introduced cybersecurity procedures requiring pipeline operators to implement specific security measures and report cybersecurity incidents to the Department of Homeland Security. Effective prevention should combine technical protections with strategies that address human behavior (Payne & Hadzhidimova, 2018). 

Conclusion

In conclusion, human factors directly affect cybersecurity because the actions people take can either protect systems, or create incidents. Phishing and social engineering show how attackers can take advantage of human judgment and behavior, while psychological, social, and organizational factors can influence the decisions people make when using technology. Overall, understanding the human factor can help organizations better address the behaviors that can contribute to cybersecurity vulnerabilities. 

References

Oesteraas, I. (2025). Criminal justice and cybersecurity. In H. Aldabagh, C. Bowman, C. Kirkpatrick, I. L. Oesteraas, & V. L. D. Yalpi (Eds.), Cybersecurity, technology & society (pp. 121–140). Old Dominion University. 

Payne, B. K. (2018). White-Collar Cybercrime: White-Collar crime, Cybercrime, or both? Criminology, Criminal Justice, Law & Society.

Payne, B. K., & Hadzhidimova, L. (2018). Cybersecurity and criminal justice: Exploring the intersections. International Journal of Criminal Justice Sciences.