The 60 Second CISO · E03
What Role Do People Play in Cybersecurity? (Are People the Weakest Link?)
People are not the cyber problem to manage around. They become the strongest line of defence when leadership removes needless friction, builds secure choices into day-to-day work, and stops treating blame as a strategy.
Direct answer
Direct answer
Calling employees the weakest link usually hides a leadership and design failure. People become your strongest defence when the organisation makes the secure path the easiest path, brings staff into the conversation, and builds cyber security into the way work is actually done rather than bolting it on afterwards.
The leadership mistake
Why the 'Weakest Link' Myth Fails
The weakest-link cliché sounds tidy, but it usually points attention in the wrong direction. When leaders blame people by default, they avoid the harder question of whether the organisation has designed work, tooling, communication, and decision-making in a way that makes secure behaviour realistic. That blame culture creates two problems at once. First, it encourages workarounds because staff still need to get their jobs done, even if approved systems are slow, awkward, or disconnected from operational reality. Second, it teaches people to hide mistakes, uncertainty, and near misses because speaking up feels risky. In practice, that means the organisation loses visibility precisely where it most needs honesty. If people feel punished for friction or failure, leadership will see less truth, not more security. Stronger outcomes come when the business treats people as part of the defence model and designs the environment around that reality.
Where this usually breaks
Signs security is creating too much friction
When security is slowing work down instead of supporting it, people usually tell you through their behaviour long before they tell you directly.
- Teams turn to Shadow IT or unofficial AI tools because the approved route is too slow, too limited, or too frustrating for the pace of the work.
- Employees hide mistakes, mis-clicks, or near misses because they expect blame instead of useful support when something goes wrong.
- Policies are technically in place but are quietly ignored because they interrupt real work and nobody believes they were designed with operations in mind.
- Security training becomes a tick-box exercise because it lectures people about risk without fixing the underlying friction they run into every day.
- Managers keep hearing that controls are being bypassed, but there is no honest mechanism for feeding that reality back into better process design.
What good looks like
What frictionless security looks like
The goal is not to make people more afraid. It is to make secure behaviour easier, more natural, and more sustainable inside the way the organisation already works.
- The secure choice is also the easy choice, so people do not need extra effort or heroics to do the right thing.
- Security is built into standard operating procedures, onboarding, and day-to-day workflows instead of being treated as a separate lecture after the fact.
- Employees are invited into the conversation early enough to explain where real friction exists and which controls genuinely help or hinder the work.
- Training is practical, relevant, and tied to real decisions people make, rather than generic awareness material that never changes behaviour.
- Senior management treats people as part of the defence system and takes responsibility for removing the design and leadership failures that create risky shortcuts.
Where this usually fits
Need help building a human-centred security programme people can actually follow?
If security is currently creating workarounds, silence, or weak buy-in, the next step is often a vCISO-style governance and programme route. That helps the organisation redesign friction points, improve leadership ownership, and build a security culture that works with employees rather than against them.
Useful questions
Frequently asked questions
How do we make the secure path the easy path?
Start by looking at the points where people feel forced into workarounds. If the approved route is too slow, unclear, or impractical, leadership needs to redesign that path so secure behaviour fits naturally into the job instead of competing with it.
Why do employees bypass security controls?
Most people bypass controls because they are trying to get work done, not because they want to create risk. When a control blocks real operational needs without offering a workable alternative, people will often choose convenience, speed, or certainty over policy.
Why is employee training often ineffective?
Training loses impact when it focuses on blame, generic warnings, or annual compliance rather than the real decisions people make in their roles. Training works better when it is practical, role-aware, and backed by systems and processes that make secure choices easier to follow.
Who is responsible when people keep taking insecure shortcuts?
Senior management owns the environment that makes those shortcuts attractive in the first place. That includes tooling, process design, communication, incentives, and the overall culture around speaking up when something is not working safely.
Read or route next
Keep the momentum practical
Next route
Browse the series
See the episode archive and future short-form cyber answers.
Next route
Browse all advice
Move from the episode into the wider advice hub for related situations and plain-English answers.
Next route
See Virtual CISO
Use this route when the business needs leadership, governance, and a stronger operating rhythm around security.
Next route
See security programme ownership
See how retained support helps shape practical controls, ownership, and follow-through across the business.
Next route
See board security reporting
See how stronger leadership reporting supports clearer decisions and more durable security culture.
Need help now?
Need help building a human-centred security programme that works with your people?
If staff are being blamed for friction that leadership has not yet designed out of the system, now is the right time to build a steadier programme, clearer ownership, and safer ways of working people can actually follow.