Is the human really the weakest link in cybersecurity — or the strongest control we keep failing to use?
Posted by Dr Jenny Tan15 Sep 2026 · 
Almost every breach report ends the same way: someone clicked, someone shared, someone bypassed a control to hit a deadline. It is easy to conclude that people are the problem.
But the same people are also the ones who notice the odd invoice, question the urgent request from the 'CEO', and report the near-miss that stops the next incident. In my experience the difference between the two is rarely the individual. It is pressure, opportunity and rationalisation — the old fraud triangle — and whether the culture around them makes speaking up safe.
Angles to consider
- Where has your organisation invested more: technology or behaviour? What changed as a result?
- Have you seen security training that actually changed habits, rather than ticking a box?
- What would make it easier for staff to admit a mistake early?
My starting position: treat human behaviour as a control to be designed, measured and maintained, exactly as we do a firewall. I would love to be challenged on that.
Enjoying the discussion?
Subscribe to hear about new questions, or invite Jenny to bring the conversation to your organisation.
Discussion ·