{"id":282,"date":"2026-10-04T20:51:55","date_gmt":"2026-10-04T20:51:55","guid":{"rendered":"https:\/\/sites.wp.odu.edu\/mariahansen\/?p=282"},"modified":"2026-10-04T20:51:55","modified_gmt":"2026-10-04T20:51:55","slug":"the-human-factor-in-cybersecurity","status":"publish","type":"post","link":"https:\/\/sites.wp.odu.edu\/mariahansen\/2026\/10\/04\/the-human-factor-in-cybersecurity\/","title":{"rendered":"The Human Factor In Cybersecurity"},"content":{"rendered":"The human factor is both the greatest vulnerability and the crucial defensive asset in cybersecurity. Human behavior creates openings through phishing, weak credentials, and negligence, but that same capacity for judgment and responsibility strengthens an organization\u2019s posture when supported by good training of the system and of policy and a culture that treats security as a shared moral responsibility rather than just a technical problem.
What the Human Factor Means
The \u201chuman factor\u201d in cybersecurity refers to the role that people play in both creating and preventing security failures. Technical controls like firewalls, encryption, and access management form the foundation of most defenses, but they operate through and are shaped by our actions. Information and communication technologies do not sit outside us as neutral tools; they influence what we see, how we act, and even our relationships with both others and technology (Verbeek, 2014). In this blended \u201conlife\u201d reality, the boundary between human and technology becomes increasingly blurred. As a result, cybersecurity can never be purely technical; it is always a blended moral practice of the user, the system, and who the system affects.
The socio-technical approach is paramount to the nature of cyber security because at its base nature, the technology was made to protect our technology from attacks. Technology can process data, enforce rules, and detect patterns at scale, but it can never fully grasp the essence of the human condition. This isn\u2019t a temporary limitation that better algorithms can one day overcome. It is a difference in essence and being.
How Human Behavior Creates Risk
Though the person is integral to the system’s success, human behavior contributes to vulnerabilities in multiple overlapping ways. Everyday negligence, such as using weak or reused passwords, leaving workstations unlocked, or dismissing security alerts, quietly expands the attack surface. Individual biases and time pressure lead to hasty decisions instead of the right ones, leading them to bypass multi-factor authentication or share credentials with colleagues. Social engineering succeeds because it exploits trust, authority, and urgency, turning ordinary dynamics into attack vectors. At the same time, insider threats, whether malicious or accidental, demonstrate that legitimate access combined with flawed judgment can bypass many technical defenses. Even well-intentioned workarounds, like installing unauthorized software to finish a task faster, introduce new weaknesses. SImply, the systems we design and the people who operate them co-produce both security and risk.
Two Key Examples
Two concrete examples illustrate these dynamics. Phishing and broader social engineering remain highly effective precisely because they target decision-making rather than code. Attackers craft messages that appear to come from trusted sources, (banks, IT departments, or senior executives) that create a sense of urgency or invoke authority. Users are prompted to click links, open attachments, or reveal credentials. These attacks succeed not because of sophisticated malware, but because of the mediated environment in which people already trust screens, notifications, and digital authority. Real-world campaigns, including large-scale business email compromise schemes, have repeatedly shown that a single successful social-engineering message can lead to significant financial and operational damage.
A second major risk involves weak authentication practices and insider actions. Password reuse, default credentials, and the failure to enable multi-factor authentication continue to enable breaches across industries. Trusted people with privileged access can cause even greater harm acting carelessly or maliciously, because they already operate inside the perimeter that technical controls are designed to protect. Both examples demonstrate that human factors are not peripheral add-ons to a technical problem; they are structural elements of the security environment itself.
Reducing Human-Related Risk
Organizations can reduce these risks through training, policy, communication, and culture. Realistic, scenario-based awareness exercises, including simulated phishing campaigns with immediate feedback, help employees recognize and report threats more effectively than generic annual modules. Clear, enforceable policies on password management, data handling, remote access, and acceptable use establish behavioral boundaries. Technical supports like password managers and single sign-on reduce cognitive load and make secure behavior the easier path. Leadership communication is also emphasized in training. When executives visibly follow the same rules they impose on others and treat near-misses as learning opportunities rather than occasions for blame, employees prove to be more likely to internalize security as a shared responsibility.
A self driven desire of safety and protection is also much needed to maintain security. Our ability to foresee the long-term consequences of complex technological systems remains limited, what Jonas (1973) described as the \u201cshort arm of predictive knowledge.\u201d Security awareness therefore cannot stop at teaching people to spot phishing emails. It needs to also cultivate an urgent sense of responsibility for the systems we design. Design and governance decisions carry an additional moral weight because their effects extend to immediate users and any other people connected to the security in any way.
Psychological, Social, and Organizational Influences
Psychological, social, and organizational factors continuously mold cybersecurity behavior and decision-making. Cognitive biases like optimism bias (\u201cit won\u2019t happen to me\u201d), authority bias (compliance with requests that appear to come from superiors), and urgency bias (acting quickly under time pressure) increase susceptibility to social engineering. Within teams, peer pressure to bypass controls for the sake of productivity, or the gradual normalization of workarounds, can erode formal policy over time. Organizational culture exerts a powerful influence: environments that reward speed and output above all else inadvertently incentivize risk-taking, whereas cultures that explicitly value transparency, continuous learning, and accountability tend to produce higher quality and more secure systems. Rather than treating humans as the perpetual weak link, systems and cultures should be designed to guide better decisions from within everyday use. We can not forget that we are not just protecting systems; we are protecting the conditions for human existence and the interests of those who will live with the consequences of the technologies we build or leave unsecured today (Jonas, 1973).
Conclusion
The human factor is both the integral element and also a liability in security systems. Human actions create openings through phishing, weak credentials, negligence, and insider behavior, yet the same capacity for judgment, restraint, and responsibility strengthens an organization\u2019s posture when properly supported. Effective cybersecurity therefore requires technical controls, sustained attention to behavior and culture, and the recognition that design and governance are inherently moral activities. When people are treated as partners in a mediated technological world rather than as the weakest link, organizations move closer to a more responsible and resilient approach to security.
References
Jonas, H. (1973). Technology and responsibility: Reflections on the new tasks of ethics.
Verbeek, P. P. (2014). Designing the public sphere: Information technologies and the politics of mediation.
","protected":false},"excerpt":{"rendered":"

The human factor is both the greatest vulnerability and the crucial defensive asset in cybersecurity. Human behavior creates openings through phishing, weak credentials, and negligence, but that same capacity for judgment and responsibility strengthens an organization\u2019s posture when supported by good training of the system and of policy and a culture that treats security as… <\/p>\n

Read More<\/a><\/div>\n","protected":false},"author":32864,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wds_primary_category":0},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/posts\/282"}],"collection":[{"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/users\/32864"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/comments?post=282"}],"version-history":[{"count":1,"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/posts\/282\/revisions"}],"predecessor-version":[{"id":285,"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/posts\/282\/revisions\/285"}],"wp:attachment":[{"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/media?parent=282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/categories?post=282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/mariahansen\/wp-json\/wp\/v2\/tags?post=282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}