Why I don’t believe people are the weakest link

By Barbara van Bebber, Founder of Shannon Digital Trust

For years, I’ve heard people described as the weakest link in cybersecurity.

While I understand where that statement comes from, I’ve never been entirely comfortable with it.

Not because people don’t make mistakes. We all do.

But because the phrase often suggests that security failures happen because people didn’t pay enough attention, didn’t know enough or simply made the wrong decision.

In my experience, the reality is usually more complex.

People make decisions within the environments we create for them. They work under pressure, manage competing priorities, adopt new technologies and try to get their jobs done efficiently.

When security measures are difficult to understand, difficult to follow or disconnected from everyday work, even well-intentioned people can struggle.

That doesn’t make them the weakest link.

It means we need to look beyond the individual.

When I look at a security challenge, I don’t just ask:

“What did the person do?”

I also ask: