The Human Factor in Cybersecurity
By: Vincent Saunders
11/10/2023
CYSE 300

First, I would want to understand what technologies we already have in place, and what vulnerabilities or threats they aren’t addressing. Running a security assessment could help identify priority areas to focus on. Then I would look at our people – what security awareness training have they received, and are there any gaps in their knowledge? Training is important because humans are often the biggest security risk

With the results of the assessment and a review of our training in hand, I would work to allocate roughly 30% of the budget to additional technologies and 70% to training.

While technology can help monitor and block threats, it is not foolproof. Our employees are on the front lines of defense and need regular skills development to stay vigilant and make smart security decisions. Training has been shown to yield a 5x return on investment. According to Verizon’s 2022 Data Breach Investigations Report, human error and compromised credentials were factors in 95% of breaches. While technology aids defense, motivated attackers still focus on exploiting end users via tactics like phishing. With limited funds, focusing more on training could help maximize our protection for each dollar spent.

Technology is only as good as its implementation. Even the best tools require knowledgeable users to configure, operate, and respond properly. Without training end users on how and when to utilize security features, much of the value could be lost. Once basic security controls are in place, each additional technology has less impact and the costs tend to rise exponentially. Studies show the most effective security spending is earlier on, not continually layering on more tools. Some example technology purchases might include firewall upgrades in critical systems, endpoint detection and response tools, or a security information and event management platform. However, the bulk of funds would go towards an ongoing security awareness program with phishing simulations, in-person sessions, online modules, and individualized coaching as needed.