The average enterprise organisation now spends millions annually on cybersecurity technology. Firewalls, endpoint detection, encryption, intrusion prevention systems, security information and event management platforms. The technology stack has never been more sophisticated.
Breaches are still happening at record rates.
In 2023, IBM's Cost of a Data Breach Report found that the global average cost of a data breach reached $4.45 million. The Verizon Data Breach Investigations Report found that the human element was involved in 74% of all breaches that year.
The math is clear. Organisations are investing heavily in the part of the problem that accounts for roughly a quarter of their risk, while the part that accounts for three-quarters, human behaviour, remains the most underinvested area in most security programmes.
Why Technology Cannot Solve a People Problem
The assumption underlying most enterprise security spending is that a sufficiently sophisticated technical layer will eventually close the gap. This assumption misunderstands the nature of the threat.
Technical controls work by enforcing rules on systems. They are highly effective against threats that operate within predictable parameters. They are significantly less effective against threats that operate through legitimate user behaviour, authorised people doing unauthorised things, or authorised people being manipulated into doing things that appear legitimate.
The techniques that account for the majority of successful breaches, phishing, social engineering, credential theft, insider threat, all involve human behaviour that looks, at some point in the attack chain, like normal activity. A phishing email that prompts a user to enter their credentials on a convincing fake login page does not trigger a firewall alert. The user is doing something they do legitimately every day. The manipulation happens before any technical control has a chance to intervene.
The most reliable vulnerability in any security system is the person inside it. Not because people are careless, but because they are human, and being human means being susceptible to certain predictable patterns of manipulation.
The Anatomy of a Human-Exploiting Attack
Social engineering, the practice of manipulating people into taking actions or disclosing information, works by exploiting predictable cognitive responses. The three most reliable are urgency, authority, and helpfulness.
Urgency creates time pressure that bypasses careful evaluation. The time pressure short-circuits the analytical process that would identify the deception.
Authority exploits the deeply human inclination to comply with perceived expertise or power. An email that appears to come from the CEO, from IT support, or from a regulatory body carries the weight of institutional authority.
Helpfulness exploits one of the best qualities of professionally trained people. People in customer-facing roles, in technical support, in operational functions, people who have been trained to be responsive and accommodating, are disproportionately vulnerable to social engineering precisely because their professional instinct is to help.
What a Strong Security Culture Actually Looks Like
The organisations with the lowest successful breach rates are not always the ones with the most sophisticated technical infrastructure. They are the ones that have built a culture in which security awareness is embedded in the fabric of how people work.
Security awareness training, the annual compliance module that most employees click through in thirty minutes, is not a security culture. It is a documentation exercise. A genuine security culture has different characteristics. Security is treated as everyone's responsibility. People feel safe reporting potential incidents without fear of blame. Verification is normalised. Slowing down to confirm the legitimacy of an unusual request is rewarded rather than treated as inefficiency.
Practical Measures That Actually Move the Needle
Make verification easy and expected
Most people comply with suspicious requests because the path of least resistance is to comply. If your organisation makes verification easy, clear protocols for confirming identity through a separate channel, explicit permission to slow down, people will use them.
Run realistic simulations, not compliance exercises
The most effective security awareness programmes include regular, realistic phishing simulations that reflect the actual sophistication of current attacks. Not the obvious fake. The convincing one that most people would click. The value is in building the pattern recognition that makes real attacks identifiable.
Separate the report from the punishment
If someone clicks a phishing link, the most valuable thing that can happen next is that they report it immediately. Creating genuine psychological safety around security incidents is one of the highest-leverage investments an organisation can make.
The Leadership Dimension
Security culture is, ultimately, a leadership problem. The norms of an organisation are set from the top, and security is not exempt from this principle. When senior leaders bypass security protocols, they signal to the organisation that security is optional for the people who matter.
Conversely, leaders who model good security behaviour and who speak openly about the organisation's security challenges create the conditions for a culture that takes it seriously.
