Cybersecurity is a human problem and not just a technology one

At this time last year, several businesses were looking at the long-term potential of hybrid work

There was a sense that something was happening. Twelve months later, however, it’s safe to say that this “new way of working” is now normal. The shift in working methods has brought cybersecurity into the spotlight, and not only is the threat landscape far more complex and extensive than it has ever been, but the frequency and intensity of attacks are the most severe we’ve ever witnessed. The frightening part is how routine this is and how commonplace it is as companies have to adapt to the ever-changing threat.

This is why many organizations are falling into the trap of thinking that their cybersecurity issues are due to technology issues alone. While it’s certainly important to be equipped with the appropriate tools to be in place, many organizations fail to consider the human aspects they should also consider. A significant portion of security breaches (40 percent according to conservative estimates) results from human behavior, like clicking on a fake link while browsing for an online casino. The companies use all the tools that are available they have at their disposal, however, when the cause is caused by human activities which are not adequately secured or controlled, they are still vulnerable to an attack.

This is the reason I believe it’s crucial for companies to consider how their investments in human-centered initiatives, like changing the culture of their company and education, can bring positive effects on cybersecurity. Let me tell you why.

One of the biggest issues companies face is not just an absence of cybersecurity expertise among their employees as well as insecurity about the reporting of a potential security breach or threat that could be linked to them due to fear of punishment or shame. As cyberattacks are occurring more often, this culture-based issue is creating massive security risks for businesses.

Furthermore, it’s producing a negative impact on the retention rate of employees who are charged with overseeing their company’s cybersecurity and security, since the inflexible continuous nature of cybersecurity results in fatigue and burnout. Another study has revealed that more than half (41 percent) of IT security executives are contemplating whether they should quit their cybersecurity jobs within the next six months, but only a small percentage of them would be inclined to suggest an opportunity in cybersecurity.

While this isn’t exactly research, there are essential steps organizations can implement to tackle this issue. First, there is the introduction of training programs, so that employees are equipped with the necessary information to recognize potential dangers. The leaders must make sure that employee training includes certificates for all kinds of employees to help ensure they are prepared for potential threats or attacks that may occur in the near future. Companies can further enhance these skills by utilizing the expertise and technology of a trusted security company to ensure that they have the right balance. Multiplier forces that work together could have a positive impact on an organization’s general security position, which allows employees to manage important initiatives and priorities efficiently.

Additionally, it’s a change in their culture regarding the way they manage their security. This requires establishing a culture that is based on trust and empowerment in which employees are comfortable reporting security-related incidents, accidents or errors to IT. Even the most reputable security experts aren’t perfect, and no one is immune to an easily motivated adversary. If there is an acceptance that individuals can and are prone to making mistakes in cybersecurity, as opposed to having a culture of blame that employees be encouraged and empowered to voice their concerns.

This could also have a positive impact on reducing the threat of insider cyber attacks. When employee loneliness increases and employee loyalty decreases due to the hybrid work environment and other work-life balance issues, naming and shaming employees for security breaches can encourage employees to react negatively by choosing to reveal the security of their company because of anger. If you adopt a more inclusive and common approach to cybersecurity, in general, you can help reduce the feelings of blame or anger among employees.

While there isn’t a magic solution to cybersecurity, it is apparent that both processes and individuals have a major role to play. If you focus only on technology, it is to overlook the other half of the issue. In the end, if companies can discover the perfect balance between both the human and technical aspects of their cybersecurity it will be a major change in their future operations.