The history of information security investment is predominantly a history of technical investment. Firewalls, encryption, endpoint protection, intrusion detection, and the full architecture of technical controls have received sustained resource allocation reflecting the security profession’s foundational assumption that the security problem is primarily a technical one requiring a technical solution. The human dimension of security has been addressed residually, through the awareness training that compliance requires and the acceptable use policies that governance documentation demands, without systematic investment in understanding why people behave as they do and how the security environment can be designed to support better security decisions rather than simply requiring them.
The evidence that this approach has produced is unambiguous. Human behaviour remains the primary factor in the majority of significant security incidents, not because awareness training has failed to communicate the importance of security, but because the technical and compliance-oriented approach has consistently addressed the wrong problem. The workforce members who click on phishing links, misconfigure systems, share credentials under social engineering pressure, and bypass security controls to complete their work efficiently are not ignorant of security requirements. They are human beings whose decision-making is shaped by psychological factors, cognitive limitations, social pressures, and environmental conditions that the security programme has historically ignored in favour of the technical controls and compliance disciplines more tractable to the security profession’s technical expertise.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
