Riley Copeland | 9/27/26

The Human Factor in Cybersecurity
What the Human Factor Means

Cybersecurity isn’t just firewalls and encryption. Most breaches start with a person, someone makes a mistake like clicking a link or trusts a call they shouldn’t have. This is the “human factor,” the idea that people are as much a part of an organization’s attack surface as its tech. A strong network can still fail because of a distracted employee.

How Behavior Creates Vulnerabilities

People take shortcuts because shortcuts are convenient. They reuse passwords instead of tracking a dozen unique ones, or click links quickly to clear their inbox. None of this is malicious it’s just normal behavior, but attackers build their tactics around it. Social engineering works by exploiting trust, urgency, and the instinct to be helpful. A system can be patched but a person’s instinct to trust a convincing email is harder to fix.

Two Examples of Human-Driven Risk

Phishing is the clearest example. An attacker sends a message that looks like it’s from a trusted source asking them to click a link or hand over credentials. It works because it looks routine like a message about a password expiring soon creates urgency and mimics something employees see all the time. Even trained employees fall for well-made phishing attempts because the message is built to trigger a fast response instead of careful thinking. One bad click can give an attacker a foothold into an entire network. Insider threats are the second example, and weak passwords are part of this. Most insider incidents aren’t malicious. Aldabagh et al. (2025) describe them as accidental like an employee sending a file to the wrong person or clicking a malicious link. Reusing a password across work and personal accounts is the same kind of shortcut, since a password breached on a personal account can give them access to your work account. The 2013 Target breach shows this: attackers got in through a single under protected computer at one of Target’s HVAC vendors and exposed more than 110 million customer records. As the reference put it, a company’s protection is only as good as its weakest link (Aldabagh et al., 2025). In both examples, the risk isn’t broken software its just human behavior.

Reducing the Risk

Telling employees to “be careful” doesn’t fix this. Training needs to be ongoing, not a slideshow every now and then, and it should cover regulatory and compliance basics, since Aldabagh et al. (2025) names employee knowledge of those requirements as a direct way to cut down on human error. Simulated phishing tests build real recognition skills instead of just awareness. 2FA addresses the weak-password problem directly, since a stolen password alone isn’t enough to get in. Reporting culture matters too: employees who make a mistake need to feel safe reporting it right away, or they will hide it, giving attackers more time to do damage.

Why This Keeps Happening

Shortcuts like trusting anything official looking or acting fast under pressure are exactly what social engineering exploits. Employees are also less likely to question a request that looks like it came from a boss which is why executive impersonation scams work so well. Culture affects this too. If leadership treats security as someone else’s problem, employees will too. When it’s built into daily workflow instead of treated as a hurdle, people take it seriously.

Reference
Aldabagh, H., Bowman, C., Kirkpatrick, C., Oesteraas, I., & Yalpi, V. L. D. (2025).
Cybersecurity, technology & society: An interdisciplinary look at the field of
cybersecurity. Self-published.