We’ve all seen them. Those cringe-worthy posters warning employees not to click suspicious links. The mandatory training modules everyone speeds through to tick a box. The stern emails from IT after someone in accounts nearly transferred £50,000 to a scammer pretending to be the CEO.
For too long, cyber security has been treated as a purely technical challenge. We’ve thrown money at firewalls, antivirus software and increasingly sophisticated detection systems. Yet breaches keep happening, and more often than not, they start with something remarkably simple: a human being making a very human mistake.
The uncomfortable truth is that your most expensive security suite is only as strong as the most stressed, distracted, or overwhelmed person in your organisation. And before you think that’s a problem to be solved by more training or stricter policies, consider this: what if the way we’ve been thinking about cyber security has been fundamentally wrong?
The problem with treating people as the weakest link
There’s a phrase that gets tossed around in cyber security circles: “users are the weakest link.” It’s become so common that we barely question it anymore. Thanks to the work of Dr Jessica Barker MBE, this is changing and we don’t use the term ourselves, but I have included it in this blog to highlight the problem. Let’s unpack what that term actually means.
When we label people as weak links, we’re essentially saying that humans are flawed components in an otherwise functional system. It’s a perspective borrowed from engineering, where you genuinely can identify the weakest point in a chain or circuit. But organisations aren’t machines, and people aren’t components.
This mindset has real consequences. It creates an environment where making a mistake feels like a personal failure rather than a learning opportunity. It encourages people to hide errors rather than report them. Perhaps most damaging, it positions IT and security teams as enforcers rather than enablers.
The result? A culture where people are afraid to admit they clicked a dodgy link until their computer starts behaving strangely. By then, the damage is done. The attacker has had time to move laterally through your network, exfiltrate data, or deploy ransomware.
Why smart people fall for stupid scams
If you’ve ever felt smug about not falling for an obvious phishing email, I’ve got news for you: you’ve probably just been lucky. The attacks that succeed aren’t the ones with spelling mistakes and princes offering fortunes. They’re the ones that arrive at exactly the wrong moment.
Let’s talk about cognitive biases, because understanding these is key to building better defences.
Authority bias is perhaps the most exploited vulnerability in social engineering. We’re wired from childhood to respond to authority figures. When an email appears to come from your CEO, the finance director, or even just your direct manager, your brain shortcuts past critical thinking. You want to be helpful. You want to be seen as competent and responsive.
This is why business email compromise attacks are so devastatingly effective. A stressed accounts payable clerk receives an urgent email from someone senior asking for an immediate transfer to a new supplier. The language is right, the email address looks legitimate (attackers are masters at registering domains that are one letter off), and there’s pressure to act quickly. In that moment, all the training in the world can evaporate.
Scarcity and urgency work together beautifully from an attacker’s perspective. “Your account will be closed within 24 hours.” “This offer expires today.” “Immediate action required.” These phrases trigger our fear of missing out and our instinct to solve problems quickly. When we’re in this heightened state, we make snap decisions. We don’t pause to verify. We act.
Then there’s familiarity bias. We trust things that look familiar. An email that appears to come from Microsoft or your bank, with logos and formatting that match their legitimate communications, gets past our mental filters more easily than something obviously foreign. Attackers know this, which is why so much effort goes into making phishing attempts look pixel-perfect.
But here’s what makes all of this worse: cognitive load. Every decision we make throughout the day depletes our mental resources. By 2pm on a busy Thursday, when you’ve been in back-to-back meetings, your inbox has exploded, and you’re trying to finish three urgent tasks before school pickup, you simply don’t have the same mental bandwidth to scrutinise every email.
This isn’t a personal failing. It’s being human.
The Monday morning catastrophe: A case study in culture
Imagine this scenario. Sarah, who works in HR, arrives at work on Monday morning to find her inbox overwhelmed. Over the weekend, her team’s been dealing with a sensitive redundancy situation, and she knows there will be difficult conversations ahead.
Buried in her emails is one that appears to be from the external employment law firm they’ve been working with. The subject line references the case. The email asks her to review an urgent document via a link. Sarah clicks it without thinking twice. Why wouldn’t she? She’s been exchanging emails with this firm all week.
Except it wasn’t from the firm. It was a sophisticated spear-phishing attack. The attacker had been monitoring communications, understood the context, and crafted the perfect lure.
Now, here’s where culture makes all the difference.
In a blame-focused culture, Sarah might not report the click. She’s embarrassed. She knows she should have been more careful. Maybe she thinks IT will judge her, or worse, that it might reflect poorly on her competence in front of senior management during an already stressful time. She hopes nothing bad will come of it.
Hours pass. Maybe days. The attacker uses Sarah’s credentials to move through the network. By the time the breach is discovered, the damage is extensive.
In a supportive, blame-free culture, Sarah clicks the link, immediately feels uneasy, and reports it to IT within minutes. There’s no shame in this. Everyone knows that these attacks are sophisticated. The security team has made it clear that quick reporting is what heroes do, not what failures do.
IT investigates immediately. They isolate Sarah’s account, check for any unusual activity, and confirm that the attacker hasn’t had time to establish a foothold. Crisis averted.
Same person. Same mistake. Completely different outcomes. The difference wasn’t technology. It was culture.
Building a blame-free security culture
Creating a supportive security culture isn’t about being soft or lowering standards. It’s about being pragmatic. It’s recognising that attacks will happen, people will make mistakes, and your best defence is an environment where those mistakes are caught and contained quickly.
Normalise mistakes
Start by acknowledging that everyone is vulnerable. Share stories (anonymised if necessary) of when senior people in your organisation fell for attacks or nearly fell for them. When leaders are open about their own close calls, it removes the stigma.
Some organisations run internal “near miss” campaigns, similar to what you’d find in health and safety. When someone spots and reports a phishing attempt, they’re celebrated. When someone clicks and reports quickly, they’re also celebrated. The emphasis is on the reporting, not the mistake.
Make reporting easy and positive
If reporting a potential security incident involves filling out a lengthy form, having an awkward conversation with IT, or waiting on hold, people won’t do it. The threshold for reporting needs to be incredibly low.
Many organisations now have a simple button in their email clients: “Report Phishing.” One click, done. IT investigates, and the person gets a quick, friendly response thanking them.
The language matters enormously. Compare “You clicked a malicious link” with “Thanks for reporting this quickly. We’ve secured your account and we’re investigating. You did the right thing.” Same situation, entirely different tone.
Train for reality, not compliance
Traditional security awareness training often feels punitive. You watch a video, answer some questions, and if you fail the follow-up phishing test, you get sent for more training. It’s the digital equivalent of writing lines.
Better training acknowledges reality. It explains why these attacks work, what’s happening in your brain when you’re targeted, and how to create habits that help without adding significant burden to your day.
Some of the most effective training is scenario-based and relevant to people’s actual roles. What does phishing look like for someone in accounts payable versus someone in customer service versus someone in executive leadership? The attacks they face will be different.
Create Security Champions, Not Police
Rather than positioning IT security as the team that says no to everything, embed security champions throughout the organisation. These are people in various departments who have a bit more training and serve as friendly first points of contact.
When security is seen as something that protects the organisation rather than something that restricts it, attitudes shift. Security champions can help translate security requirements into practical workflows that make sense for their teams.
Lead from the top
If executives treat security as an irritation or regularly ask for exceptions to policies, that message cascades down. But when leadership visibly prioritises security, takes training seriously, and models good behaviour, it sets the tone.
This also means leaders need to be vulnerable. When a CEO admits they nearly fell for a sophisticated attack, it’s powerful. It shows that this isn’t about intelligence or competence. It’s about staying vigilant in the face of determined adversaries.
The business case for human-first security
If the human arguments haven’t convinced you, let’s talk numbers.
The average cost of a data breach in 2024 reached £3.5 million for UK organisations. The average time to identify and contain a breach was 277 days. Think about that. Nearly nine months of an attacker potentially having access to your systems.
Now consider that organisations with strong security cultures report breaches 60% faster than those without. Faster reporting means faster containment. Faster containment means less damage, lower costs, and reduced regulatory penalties.
But the benefits go beyond breach response. A supportive culture reduces the time your IT team spends on blame and investigation, freeing them to focus on actual threats. It reduces employee stress and turnover. And it makes your organisation genuinely more resilient.
For MSPs and IT service providers, this represents an opportunity. You can differentiate yourselves not just on the sophistication of your security stack, but on your approach to the human element. Clients increasingly understand that technology alone isn’t enough. They need partners who can help them build cultures that support security.
Practical steps for organisations of all sizes
You might be thinking this all sounds great for large enterprises with dedicated security teams, but what about smaller organisations? The good news is that culture doesn’t scale with size. In some ways, it’s easier to build a positive security culture in a smaller organisation where communication is more direct and changes can be implemented quickly.
For small businesses (under 50 people):
Start with simple, regular conversations about security. Make it part of team meetings. When someone receives a phishing attempt, discuss it openly. Create a culture where people feel comfortable saying “I’m not sure about this email” before clicking.
Implement simple reporting mechanisms. Even a dedicated Slack channel or Teams channel where people can quickly share suspicious emails works wonders.
For medium-sized organisations (50-250 people):
Invest in at least one person who has security as a significant part of their role, even if it’s not their full-time job. This person can coordinate training, manage reporting, and serve as a friendly face for security.
Implement gamification if it suits your culture. Some organisations run regular simulated phishing campaigns but reward people for reporting them rather than punishing those who click. League tables, small prizes, and recognition can work well.
For larger organisations:
Consider formal security champion programmes across departments. Create clear career paths for people interested in security, even if they’re not in IT roles.
Use data thoughtfully. Track reporting rates, time to report, and trends in attack types. But share this data in ways that highlight successes and improvement, not individual failures.
The role of MSPs and IT partners
For those providing IT services, you have a unique opportunity and responsibility. You’re not just managing technical infrastructure; you’re influencing organisational culture through your interactions and recommendations.
When a client experiences a security incident, resist the urge to lecture about what should have been done differently. Instead, focus on containment, investigation, and learning. Your response in that moment shapes how that organisation will approach security going forward.
Consider offering culture assessments alongside technical audits. Help clients understand where their gaps are in awareness, reporting, and response. Offer training that’s engaging and relevant rather than generic and compliance-focused.
And model the behaviour you want to see. When you make a mistake (and you will, because you’re human too), be open about it. Show clients that even security professionals get targeted and occasionally slip up. What matters is the response.
Looking forward
The threats are getting harder to spot – attackers are using artificial intelligence to craft more convincing phishing emails, deepfake technology to impersonate executives in video calls, and increasingly sophisticated techniques to exploit human psychology.
We can’t out-technology this problem. Every defence we build, attackers adapt to. The only sustainable approach is to build organisations where people are genuinely empowered to be the first line of defence rather than blamed for being the weakest link.
This requires a fundamental shift in thinking. It means accepting that perfect security doesn’t exist. It means focusing on resilience and rapid response rather than prevention alone. And it means treating the humans in our organisations as the intelligent, capable, but occasionally fallible people they are.
The organisations that thrive in the coming years won’t be those with the most expensive security tools. They’ll be those where a junior employee feels confident reporting a suspicious email immediately, where mistakes are treated as learning opportunities, and where security is genuinely everyone’s responsibility because everyone feels supported in that role.
That’s what human-first cyber security looks like. And it’s not just better for security outcomes. It’s better for people, better for culture, and ultimately better for business.
The question isn’t whether you can afford to build this kind of culture. It’s whether you can afford not to.
