Human Factors in Cyber Security Risk

The relationship between human behaviour and cyber security risk is one of the most extensively researched and most consistently misunderstood areas of the discipline. The misunderstanding takes a particular form: organisations frequently treat the human element as a problem of awareness. If people only knew better, the thinking goes, they would behave more securely. This assumption is both partially correct and fundamentally incomplete, and the gap between the two matters enormously for managers.

IBM’s 2025 CISO Report found that 74% of chief information security officers identify human error as their top cyber security risk. The Verizon 2025 Data Breach Investigations Report found that the human element contributes to 60 per cent of all successful cyber attacks. Academic research published in the International Journal of Information Security in 2025 characterises human factors as encompassing the characteristics of attackers, users and defenders, all of whom may contribute to or mitigate cyber risk. The direction of that contribution, whether towards vulnerability or resilience, is shaped by factors that organisations can influence but not fully control.

Why Awareness Training Alone is Insufficient

The assumption that cyber security failures are primarily a knowledge problem has driven a global industry of security awareness training, from annual e-learning modules to phishing simulation campaigns. The evidence for the effectiveness of training alone is more mixed than its widespread adoption might suggest. The Verizon 2025 DBIR found that phishing click rates in simulation exercises are largely unaffected by standard awareness training. A 2025 report from KnowBe4 found that while extended training programmes over twelve months can reduce phishing susceptibility from 33.1% to 4.1%, the vast majority of organisations do not sustain this level of engagement.

This does not mean training is worthless. It means training is necessary but not sufficient, and that its effectiveness depends heavily on how it is designed, delivered and reinforced. Training that is relevant to people’s actual roles, that uses realistic scenarios rather than generic examples, that is delivered at the moment of need rather than annually, and that is followed by genuine management reinforcement consistently outperforms box-ticking compliance modules.

The Psychology of Security Decision-Making

Understanding why people make decisions that create security risk requires engaging with some basic principles of human psychology. Cognitive biases, social pressure, emotional states and organisational culture all influence security behaviour in ways that cannot be addressed by knowledge alone.

• Cognitive load and fatigue: security decisions are rarely made in isolation from other demands. A team member under pressure to complete a task before a deadline, managing multiple competing priorities or exhausted at the end of a long working day is making security decisions in a cognitively depleted state. Research consistently shows that decision-making quality deteriorates under cognitive load, and that under pressure people fall back on habitual responses rather than careful evaluation. Secure procedures that create friction (additional steps, verification requirements, approval processes) are most likely to be bypassed precisely when cognitive load is highest.
• Authority and social compliance: humans are social creatures who are strongly influenced by perceived authority, social norms and the behaviour of those around them. Social engineering attacks explicitly exploit this: a phishing email that appears to come from a senior executive, a phone call from someone claiming to be from IT support, or a text message impersonating a government agency all exploit the tendency to comply with perceived authority without fully evaluating the legitimacy of the request. In organisations where managers model secure behaviour, it becomes a social norm; in organisations where managers bypass procedures or communicate that security is the IT department’s problem, that norm is equally powerful.
• Amygdala hijacking and emotional manipulation: effective phishing attacks and social engineering attempts are designed to trigger strong emotional responses, typically urgency, fear or excitement, that override rational evaluation. A message warning that your account will be suspended within two hours, that a payment has been declined or that an unexpected tax refund is available is deliberately engineered to provoke an immediate emotional response. Psychologists describe the phenomenon of the emotional brain overriding the rational mind as amygdala hijacking, and it is one of the primary mechanisms through which technically aware individuals fall victim to social engineering attacks.
• Optimism bias and risk normalisation: research in risk psychology consistently finds that people tend to underestimate the likelihood that negative events will happen to them personally, even when they are aware of those events happening to others. In a cyber security context, this manifests as a belief that one’s own organisation, team or account is unlikely to be targeted. Risk normalisation occurs when risky behaviours that go unpunished become accepted as normal: if a team has been sharing passwords for two years without incident, the absence of visible consequence creates a powerful (if false) signal that the behaviour is safe.
• Blame culture and reporting suppression: one of the most consistently damaging human factors in organisational cyber security is the absence of a culture in which security mistakes can be reported without fear of punishment. Research on high-reliability organisations, such as aviation and healthcare, consistently finds that non-punitive reporting cultures generate better safety outcomes than punitive ones, because they surface errors and near-misses while there is still time to intervene. In cyber security, a team member who clicks a phishing link and stays silent to avoid blame extends the attacker’s dwell time; a team member who reports it immediately enables rapid containment. Which of those outcomes occurs depends almost entirely on the culture the manager has created.

Security Culture as a Management Responsibility

Security culture refers to the shared values, attitudes, beliefs and behaviours within an organisation or team that shape how security is approached in everyday practice. It is distinct from security policy, which defines what should happen, and security training, which attempts to teach what should happen. Security culture describes what actually happens when no one is watching, when procedures are inconvenient, and when the pressure to get work done competes with the requirement to get it done securely.

Research published in the International Journal of Information Security in 2025, reviewing 41 high-quality studies on human factors in cyber security, identified security culture as one of the strongest predictors of security outcomes across organisations and contexts. The paper notes that existing frameworks often fail to address generational and cultural diversity in their approach to security culture, an important consideration for managers leading global or multi-generational teams. Building a strong security culture is one of the highest-value activities a manager can undertake. It requires visible leadership commitment to security principles in one’s own behaviour; consistent reinforcement of secure practices through recognition and positive feedback rather than blame; transparent communication about why security matters and what the stakes are; and the creation of psychological safety around reporting concerns. These are not activities that can be delegated to a security team or delivered through a training module. They are the ongoing work of leadership.