The digital landscape is fundamentally a human domain, much like any city, state, or country. While we often focus on the code, hardware, and networks that create instant connectivity, it is critical to remember that the true endpoint for every digital connection is a human. At some point, the data transmitted will be interpreted, moved, or used by a person. People are often considered the “weakest link” in cybersecurity. In this article, I want to pose a different perspective: we, humans, are in fact the most vulnerable but certainly not the weakest. Also, many of the problems we encounter are of our own doing.

Due to our hyper-connectivity to all kinds of information from around the world, people are constantly in psychological hot states. These psychological hot states put us in a position where impulsive urges and short-term demands override long-term consequences. When our brains are constantly processing an overwhelming amount of information, they attempt to find ways to cope with this seemingly endless influx of information. To do this, we take mental shortcuts to assist with processing information quickly with minimal effort. To achieve this, we associate past experiences with current situations. Without this, every decision would require extensive deliberation, rendering us paralyzed by analysis.

Think about the simple act of recognizing a familiar face or deciding if a street is safe to cross. These actions are often instantaneous, often referred to as second-nature, as they are guided by deep-rooted patterns of thought based on the outcomes of past experience. These same principles exist no matter where we are or who we interact with. Another example we see in online interactions is that most people have a tendency to trust information from authority figures. Simply put, we trust the messenger before we trust the message. Typically, this is a useful heuristic, but it can become problematic when we blindly accept information from an individual posing as an authority figure, even if their claims are dubious. This tendency to rely on these mental shortcuts, even when they lead to errors in judgment, is a fundamental aspect of human psychology.

Whether they know it or not, these mental shortcuts are exactly what malicious actors seek to exploit during online interactions. It is natural for an adult to develop predictable patterns of thinking. Threat actors have found ways to manipulate people by exploiting certain thinking processes that lead to predictable psychological vulnerabilities. This moves us beyond the simplistic notion of “human error” to a more nuanced understanding of how our minds, in their quest for efficiency, can inadvertently pave the way for compromise. It’s widely known that 80-90% of all data breaches involve the human factor to some degree.

Phishers and social engineers are skilled at identifying and triggering these biases to manipulate their targets. They understand that by presenting information in a specific way, or by creating a particular set of circumstances, they can influence an individual’s decision-making process towards a desired outcome, making them an unknowing accomplice to their own attack. These biases do not signify, or even remotely suggest, a lack of intelligence or a failure of will on the part of the victim. Studies show these biases simply highlight the predictable ways in which our cognitive architecture can be subtly exploited. In the same way marketing departments influence customers to buy a product or service, social engineers influence people to click a link or provide sensitive information. An attacker doesn’t need to break through complex firewalls if they can simply convince a user to willingly open the proverbial door.

These kinds of exploits are not new by any means. One of the most infamous, widely spread exploits was the “ILOVEYOU” worm that circulated in May 2000. The ILOVEYOU computer worm reached over 45 million computers in 24 hours and ultimately infected 10 percent of computers connected to the internet, causing billions of dollars in damage. This worm forced organizations like the U.S. military, the British Parliament, and major corporations to shut down their email servers entirely to stop the spread. The worm spread so quickly because of people’s curiosity about an email from someone who claimed to “love” them.

Technology has progressed greatly, but human psychology has stayed the same and is relatively overlooked when analyzing security plans and approaches. Attacks have continued to rise. Private data is rapidly shared, and we, as a cybersecurity community, have become frustrated and have adopted fear-based approaches to drive behavior change.  Cybersecurity has become “cyberwar”.  We have attempted to scare users into compliance, and by doing this, we have created an industry that people fear and try to ignore.

Research has been found that “cyber-fear” or “cyber-paranoia” increases with age in the general population. Consequently, as we share information regarding cybersecurity or cyber-attacks, if we choose to use fear-based verbiage, we are instilling an emotional response we may not want. However, these findings were not seen in IT or security professionals. Therefore, the perspective we, as security professionals, have is not shared by the general population.  What we see as useful or directed information may be interpreted as fear-inducing or intimidating to those we need to see it most.

Cybersecurity is inherently about risk. The threats are real; phishing scams, ransomware, viruses, worms, and data breaches happen daily. However, when every message is designed to scare, it can backfire. There’s over 50 years of hard evidence demonstrating that fear is not a good vehicle for motivation. James Clear notably researched this in his study on Atomic Habits. He argues that the most durable and sustainable behavior changes come not from outcome-based goals like “I want to stop clicking phishing links” but from identity-based ones. Identity-based outcomes require ownership or engagement and sound like “I am someone who protects this organization with my actions and decisions”.

This follows up well with the work of psychologist Daryl Bem. In 1977, Bem published his self-perception theory. In this theory, the finding is that people don’t just behave according to who they are. They become who they are through how they behave. Identity and behavior are not fixed and sequential, and thus are circular and jointly reinforce each other. To support long-term behavior change, according to the self-perception theory, one must design an environment that makes the desired behavior the path of least resistance.

In many organizations, security is treated as a low hurdle to jump through— mandatory training nobody fully watches—and phishing training is focused on the outcome and technology, not the “why” behind the click. Telling someone to “read the email header” is simply not enough. The email header does not drive emotion and influence like the name or messenger of the email. The “why” is almost always psychological, not technical.

When polled, the general population perceived the risk and ‘seriousness’ of cybercrime as just as serious when compared to street crimes. This suggests that there may be different drivers to cyber-fears and cyber-paranoia in different groups. A major problem we are facing in the workplace is that these groups can be found in different departments in our organizations. For example, HR, finance, sales, and marketing departments are traditionally not security technology-facing in their career descriptions. This disconnect, I propose, is leading to confusion about the effectiveness of security awareness training.

Since the beginning, security training has been developed by technical professionals. Although these professionals may be advanced in a technical perspective, they may be out of touch with the larger organization. This separation may be the cause of misaligned outcomes and result in not provoking the appropriate emotional response for long-term behavioral change.

Digital social engineering is not a technical problem; it is psychological exploitation delivered through interactions through technology. To this current point, the focus has been on understanding the technology and not how the user interacts with and digest the information from the technology. Understanding technology certainly helps, as previously stated, but understanding the triggers attackers used and how you are influenced by them is the type of training we need for long term behavior change.

Attackers can use all of the standard principles of influence (and reciprocity, commitment and consistency, social proof, authority, liking, conformity, and impulsiveness) and pair them with an emotion. For example, this would look like: