13. Human Risk, Culture and Organizational Change

Introduction and Context

Cybersecurity is often described in technical terms: systems are patched, identities are authenticated, networks are segmented, and data are encrypted. Yet every control is ultimately operated, interpreted, or bypassed by people. An employee may approve a fraudulent payment, reuse a password, disclose information to a convincing caller, misconfigure a cloud service, or report an unusual event that enables rapid containment. Human action is therefore not an incidental variable in cybersecurity risk; it is part of the risk environment itself.

Human risk includes the possibility that behaviour, judgement, capability, motivation, or organizational conditions will contribute to a security incident. It includes malicious insiders, negligent insiders, compromised users, and well-intentioned employees operating under pressure. It also includes weaknesses in organizational culture: unclear accountability, excessive workload, fear of reporting, poorly designed processes, and incentives that reward speed while ignoring security.

For cybersecurity leaders, the central challenge is not to make people perfectly compliant. Such an objective is unrealistic. The more useful objective is to design an organization in which secure behaviour is understandable, feasible, supported by technology, reinforced by leadership, and measured without creating a blame-oriented culture. This requires integration between risk management, human resources, legal and compliance functions, communications, learning and development, business operations, and technical security teams.

Learning Objectives

After studying this chapter, students should be able to:

1. Explain human, insider, and social-engineering risk and distinguish their major forms.

2. Analyse how organizational culture, incentives, leadership, and work design influence security behaviour.

3. Apply behavioural and change-management models to cybersecurity interventions.

4. Design role-based awareness and secure-behaviour programmes.

5. Select meaningful measures of human risk and interpret their limitations.

6. Develop stakeholder-engagement strategies that support cross-functional security change.

7. Evaluate ethical, legal, and professional issues in monitoring and managing human risk.

Human Risk as an Organizational Risk Domain

Human risk is broader than employee error. A useful classification considers both intent and control conditions. Unintentional actions include misdirected email, accidental disclosure, insecure storage, failure to apply a procedure, and unsafe use of consumer applications. Negligent actions involve disregard for known requirements, such as disabling security controls or sharing credentials. Malicious insider actions are deliberate attempts to steal, disrupt, defraud, or expose information. Compromised insider actions occur when an attacker uses a legitimate person’s account or manipulates that person into performing an unsafe act.

These categories overlap. A person who clicks a phishing link may be deceived rather than careless; a privileged administrator who violates procedure may be responding to an emergency; and an employee who exfiltrates data may be acting under coercion. Classification is consequently useful for analysis but insufficient for judgement. Investigations should examine context, intent, opportunity, capability, and organizational controls rather than assigning blame from a single event.

Human risk is also shaped by the socio-technical system. Behaviour results from the interaction of individuals, technologies, rules, workload, social expectations, and management practices. A complex access-request process may encourage workarounds. Frequent false-positive alerts may cause warning fatigue. A remote worker may use an unsanctioned file-sharing service because the approved system is inaccessible. These are not merely personal failures; they are indications that the designed system does not adequately support the desired behaviour.

Important Concepts and Terminology

Several concepts are particularly important:

• Insider threat: The potential for a person with authorized access to harm confidentiality, integrity, or availability, intentionally or unintentionally.
• Human error: An unintentional deviation from an intended action or outcome.
• Social engineering: The manipulation of people to obtain information, access, money, or action.
• Security culture: Shared values, assumptions, norms, and practices concerning security.
• Security climate: Employees’ current perceptions of how seriously security is treated and supported.
• Secure behaviour: An observable action that reduces security exposure, such as verifying a payment request or reporting a suspicious message.
• Behavioural intervention: A designed activity intended to influence security-related decisions or actions.
• Role-based awareness: Education and support tailored to a person’s responsibilities, access, threats, and decisions.
• Psychological safety: A condition in which people can raise concerns and admit mistakes without disproportionate fear of humiliation or punishment.
• Just culture: An approach that distinguishes human error, risky choices, and reckless or malicious conduct while maintaining accountability.
• Security champion: A business representative who helps translate security requirements into operational practice.
• Human-risk indicator: A measure used to identify exposure associated with behaviour, capability, or organizational conditions.
• Leading indicator: A measure of conditions or activities that may predict future outcomes.
• Lagging indicator: A measure of an event or loss that has already occurred.
• Change fatigue: Reduced willingness or capacity to adopt further change after repeated initiatives.

Why People Make Unsafe Decisions

The assumption that employees make unsafe choices because they do not care about security is analytically weak. Behaviour is influenced by perceived benefits, effort, social norms, authority, time pressure, habits, and the design of available choices. A worker who bypasses multifactor authentication may value productivity, believe the risk is remote, and experience repeated technical obstacles. A finance employee may approve a suspicious request because it appears to come from a senior executive and because the organization rewards rapid payment processing.

The Theory of Planned Behavior explains behaviour through attitudes, subjective norms, and perceived behavioural control. In security, an employee is more likely to report phishing when reporting is viewed positively, colleagues and managers support it, and the reporting mechanism is simple. The model highlights why information alone is insufficient: knowledge may improve attitudes but does not guarantee social support or practical ability.

The COM-B model proposes that behaviour depends on capability, opportunity, and motivation. Capability includes knowledge and skills; opportunity includes tools, time, access, and social conditions; motivation includes conscious decisions and automatic habits. A secure-behaviour programme should therefore ask three questions: Can the person perform the behaviour? Does the environment make it possible? Is there sufficient reason and reinforcement to do it?

The Swiss cheese model views incidents as the alignment of weaknesses across multiple defensive layers. Training is one layer, but so are technical controls, approval procedures, segregation of duties, supervision, and incident reporting. If a phishing message reaches an employee, bypasses filtering, appears credible, and encounters no transaction verification, the incident cannot fairly be attributed to one individual alone.

The Nudge approach focuses on changing the choice environment. Examples include defaulting devices to encryption, placing a reporting button in the email client, providing just-in-time warnings, and making approved storage easier than unapproved storage. Nudges should support, not replace, substantive controls and informed decision-making.

Social Engineering and Insider Risk

Social engineering exploits trust, authority, urgency, fear, curiosity, or helpfulness. Common techniques include phishing, business email compromise, pretexting, impersonation, baiting, quid pro quo offers, and physical tailgating. Contemporary attacks may combine publicly available information, artificial intelligence-generated text or voice, compromised accounts, and carefully timed requests.

Effective defence is not achieved by telling staff to be suspicious of everything. Excessive suspicion can impair collaboration and produce warning fatigue. Instead, organizations should define a small number of high-value verification behaviours. For example, a payment-account change should be verified through a trusted channel; requests for sensitive data should be checked against authorization; unexpected attachments should be handled through approved mechanisms; and suspected compromise should be reported immediately without fear of punishment.

Insider-risk management requires proportionality. Useful signals may include unusual downloads, access outside normal duties, repeated policy violations, unexplained privilege use, or attempts to defeat monitoring. None of these signals proves malicious intent. They must be interpreted with contextual information and reviewed through authorized processes. Monitoring should not become indiscriminate surveillance or a substitute for competent management.

A mature insider-risk programme combines preventive, detective, and supportive measures. Preventive measures include least privilege, separation of duties, access reviews, secure offboarding, and clear data-handling rules. Detective measures include behavioural analytics, logging, data-loss prevention, and anomaly detection. Supportive measures include fair grievance processes, assistance for stressed employees, clear reporting channels, and manager training. Security and human resources should define in advance how concerns are escalated and how privacy and due process are protected.

From Awareness Training to Secure Behaviour

Traditional awareness programmes often rely on annual training and completion percentages. These activities may satisfy a compliance requirement but provide weak evidence of changed behaviour. A stronger programme begins with risk analysis. It identifies critical behaviours, high-risk roles, likely threat scenarios, decision points, and barriers to safe action.

Role-based design is essential. A general employee may need to recognize credential theft and report suspicious messages. A software developer needs guidance on secrets management, dependency risk, and secure code review. A system administrator needs privileged-access discipline and emergency-change procedures. A senior executive needs protection against impersonation, secure travel practices, and decision-making responsibilities during a crisis. A procurement officer requires supplier-verification procedures, while a call-centre worker needs identity-verification scripts and protections against pretexting.

A practical intervention can be designed through the following sequence:

1. Define the risk and the desired observable behaviour.

2. Identify the people, situations, and decisions involved.

3. Diagnose capability, opportunity, motivation, and existing controls.

4. Remove unnecessary friction and provide usable tools.

5. Deliver learning through short, contextual, role-specific activities.

6. Reinforce behaviour through managers, reminders, defaults, and feedback.

7. Measure adoption and outcomes, then improve the intervention.

Learning should be active. Simulations, guided exercises, tabletop events, secure configuration practice, and realistic decision scenarios are generally more valuable than passive presentations. However, phishing simulations must be ethically designed. They should test organizational resilience, not publicly shame individuals. Results should be used to improve controls and coaching, with strict limits on individual-level reporting.

Measuring Human Risk

Measurement is difficult because human risk is latent: it cannot be observed directly in its entirety. A balanced measurement system combines behaviour, exposure, capability, culture, and outcomes.

Possible leading indicators include the proportion of critical roles receiving relevant training, time taken to remove access after role change, use of multifactor authentication, reporting rates for suspicious messages, completion of privileged-access reviews, and the percentage of high-risk processes with independent verification. Behavioural indicators may include reporting speed, repeated unsafe actions after coaching, secure use of approved tools, and adherence to transaction-verification procedures. Lagging indicators include confirmed incidents involving human action, data-loss events, fraud losses, and recurrence of similar events.

Metrics require careful interpretation. A low phishing-report rate may indicate low awareness, a poor reporting mechanism, or few simulated opportunities. A high click rate may reflect a realistic test but does not directly estimate compromise. A high number of reports may indicate increased vigilance rather than increased attack activity. Completion rates show participation, not competence. Therefore, metrics should be triangulated and connected to risk decisions.

A useful measurement framework asks:

• What critical behaviour is being measured?
• Which population and risk scenario are relevant?
• Is the measure leading, behavioural, or lagging?
• What alternative explanations could produce the result?
• What decision will the measure support?
• Could the metric create harmful incentives?

Maturity can be assessed by progression from compliance reporting, to behaviour measurement, to risk-based analysis, and finally to continuous improvement integrated with operational and incident data. Quantitative measures should be supplemented with interviews, focus groups, incident narratives, and culture surveys.

Culture, Leadership, and Organizational Change

Security culture develops through repeated signals. Employees observe whether leaders follow security procedures, whether deadlines excuse unsafe conduct, whether reporting leads to constructive support, and whether security teams understand operational realities. Written policies matter, but observed leadership behaviour often matters more.

A blame-oriented culture discourages disclosure. If an employee expects humiliation or automatic punishment after reporting a mistake, the organization may lose the opportunity to contain an incident. A permissive culture is equally problematic because it treats preventable risk as unavoidable. A just culture offers a more balanced approach. It supports learning from human error, coaches risky choices, and applies proportionate accountability to reckless, malicious, or repeated conduct.

Change-management models help security leaders move from intention to adoption. Lewin’s model describes unfreezing existing assumptions, changing practices, and refreezing new norms. Kotter’s approach emphasizes urgency, coalition-building, vision, communication, removal of barriers, short-term wins, and institutionalization. The ADKAR model focuses on individual awareness, desire, knowledge, ability, and reinforcement. These models are not mechanical recipes; they are lenses for identifying what is missing.

Cross-functional change requires a shared problem definition. Security may describe credential sharing as unacceptable, while operations may see it as a response to shift work and system limitations. The solution should preserve the security objective while addressing the operational cause—for example, role-based access, delegated workflows, or approved break-glass procedures. Security champions, process owners, managers, legal advisers, and employee representatives can help translate the change into credible practice.

Stakeholder engagement should be purposeful. Senior leaders need a concise risk and investment case. Managers need practical guidance and clear responsibilities. Employees need understandable expectations and convenient support. Technical teams need requirements that can be implemented. Human resources and legal teams need clarity on privacy, investigation, and disciplinary boundaries. Suppliers and contractors need proportionate contractual and operational controls.

Technology, Automation, and Artificial Intelligence

Technology can reduce human exposure when it is designed around real work. Password managers, phishing-resistant authentication, secure defaults, data classification prompts, automated access reviews, and contextual warnings can prevent or interrupt unsafe actions. Security orchestration can route reports, enrich alerts, and trigger rapid containment. Behavioural analytics can identify anomalies that would be difficult to detect manually.

Artificial intelligence introduces both opportunities and risks. It can personalize learning, summarize incident patterns, identify unusual access behaviour, and generate realistic exercises. Attackers can also use it to create persuasive messages, imitate writing styles, generate deepfake audio, and scale reconnaissance. AI-based monitoring may produce false positives, encode bias, or obscure how a risk score was generated. Human review, transparency, data minimization, access controls, and documented escalation criteria remain necessary.

Automation should reduce cognitive and administrative burden rather than merely increase surveillance. A warning that appears for every routine action will be ignored; a warning tied to unusual context and accompanied by a clear alternative is more likely to be effective.

Illustrative Case: The Payment Verification Transformation

Background

Northbridge Components, a fictional multinational manufacturer, experienced two attempted business-email-compromise incidents. In both cases, finance employees received urgent requests apparently from senior executives to change supplier bank details. No funds were lost, but one request passed through several approval stages before being detected.

Situation and Analysis

The initial response proposed mandatory annual training and disciplinary action for anyone who approved an unverified change. Interviews revealed that the approved verification procedure was difficult to locate, managers routinely emphasized payment speed, and employees feared delaying executive requests. The organization also lacked a standard method for recording verification evidence.

The security team used the COM-B model. Employees had adequate general awareness but insufficient capability regarding the specific procedure. Opportunity was weak because the workflow did not enforce independent verification. Motivation was distorted by performance pressure and perceived executive authority. The Swiss cheese analysis showed weaknesses in email filtering, process design, approval controls, and leadership signals.

Strategy and Solution

A cross-functional team from finance, security, procurement, internal audit, human resources, and executive administration redesigned the process. Bank-detail changes required verification through a known telephone number or supplier portal, independent approval, and electronic evidence. The payment system displayed a contextual reminder and blocked completion when required fields were missing. Finance staff received scenario-based training, while executives agreed to use a standard request format and never bypass verification. Managers were coached to reward appropriate challenge rather than speed alone.

A simulation programme tested the process without naming individual employees in management reports. Near misses were recorded as learning events. The team measured reporting, verification completion, exception frequency, process time, and employee confidence in challenging suspicious requests.

Outcome

The revised approach shifted responsibility from individual vigilance to layered organizational protection. Employees reported greater confidence because the procedure gave them legitimate authority to question urgent requests. Exceptions still occurred, but they became visible, documented, and reviewable. The organization concluded that awareness had value only when combined with usable workflow controls and leadership reinforcement.

Learning Points

The case demonstrates that human risk is often a process-design problem as well as a training problem. It also illustrates the importance of role-specific intervention, cross-functional ownership, proportionate measurement, and a culture in which reporting and verification are treated as professional behaviour rather than obstruction.

Challenges, Ethical Issues, and Common Mistakes

Human-risk programmes face several difficulties. Data may be incomplete, inconsistent, or interpreted without context. Individual scoring can damage trust and create legal and ethical concerns. Employee monitoring may conflict with privacy obligations, collective agreements, or expectations of proportionality. Insider-risk investigations may expose sensitive personal information. Organizations must establish purpose limitation, data minimization, retention rules, access controls, transparency, and independent oversight.

Common mistakes include treating annual training as the whole programme, using click rates as definitive evidence of individual risk, publicly shaming employees, imposing controls that obstruct legitimate work, ignoring contractors and privileged users, and measuring activity without linking it to decisions. Another mistake is assuming that a security culture can be created by slogans. Culture changes when systems, incentives, leadership actions, and consequences consistently support the stated values.

Ethically, employees should not be treated as inherently untrustworthy. Security professionals must distinguish protection from surveillance and accountability from punishment. Investigations should follow authorized procedures, preserve evidence, respect confidentiality, and provide fair opportunity for explanation. Where monitoring uses AI, organizations should assess accuracy, bias, explainability, and the consequences of erroneous intervention.

Current Developments and Best Practices

Several developments are reshaping human-risk management. Hybrid work expands the range of devices, locations, and communication channels. Deepfakes and generative AI make voice and text impersonation more credible. Passwordless and phishing-resistant authentication reduce dependence on human recognition of fraudulent pages. Continuous control monitoring allows organizations to identify changing exposure rather than relying only on annual assessments. Security culture programmes increasingly use behavioural science, employee experience research, and operational metrics.

Effective practice generally includes the following:

• Treat human risk as an enterprise risk shared by security, business, human resources, legal, and leadership.
• Define a small number of critical, observable behaviours.
• Tailor interventions to role, privilege, threat, and context.
• Make secure choices easier than insecure workarounds.
• Combine training with technical and process controls.
• Use leading, behavioural, and lagging indicators together.
• Encourage reporting and apply a just-culture response.
• Protect privacy and limit individual-level monitoring.
• Test changes through realistic exercises and improve them from evidence.
• Hold leaders and process owners accountable for the conditions in which behaviour occurs.

Chapter Summary

Human risk is a socio-technical and organizational risk domain encompassing error, negligence, malicious insider behaviour, compromised accounts, and social engineering. Secure behaviour depends not only on knowledge but also on capability, opportunity, motivation, social norms, technology, workload, and leadership. The Theory of Planned Behavior, COM-B, the Swiss cheese model, nudge principles, and change-management frameworks provide useful analytical lenses.

Effective programmes move beyond annual awareness training. They identify critical behaviours, tailor interventions to roles, remove operational barriers, reinforce secure decisions, and measure outcomes through balanced indicators. Insider-risk programmes require layered controls, contextual analysis, privacy protection, and due process. A just culture supports reporting and learning while maintaining proportionate accountability. Ultimately, sustainable cybersecurity depends on integrating people, process, technology, governance, and organizational change rather than treating employees as the weakest link.

Key Terms

Human risk: The possibility that human behaviour, capability, motivation, or organizational conditions will contribute to security harm.

Insider threat: Potential harm caused by a person with authorized access.

Social engineering: Manipulation of people to obtain information, access, money, or action.

Security culture: Shared values, assumptions, norms, and practices concerning security.

Security climate: Employees’ current perceptions of how security is treated and supported.

Secure behaviour: An observable action that reduces security exposure.

Role-based awareness: Security learning tailored to a person’s duties, access, and threats.

Psychological safety: Confidence that concerns and mistakes can be raised without disproportionate fear.

Just culture: An approach distinguishing error, risky choices, recklessness, and malicious conduct.

Security champion: A business representative who supports practical adoption of security.

Human-risk indicator: A measure of behavioural, capability, or organizational exposure.

Leading indicator: A measure of conditions or activities that may predict future outcomes.

Lagging indicator: A measure of an event or loss that has occurred.

COM-B model: A behavioural model based on capability, opportunity, and motivation.

Swiss cheese model: An incident model in which weaknesses across defensive layers align.

Change fatigue: Reduced capacity or willingness to adopt further changes.

Insider-risk management: Coordinated prevention, detection, investigation, and response to insider-related exposure.

Behavioural intervention: A designed activity intended to influence security-related action.

Review Questions

Short Answer Questions

1. Distinguish between an unintentional insider action and a malicious insider action.

2. What is meant by a just culture in cybersecurity?

3. Define role-based awareness and explain why it is preferable to identical training for all employees.

4. Identify the three elements of the COM-B model.

5. Why is a high training-completion rate an insufficient measure of secure behaviour?

Long Answer Questions

1. Explain how organizational culture and leadership influence human cybersecurity risk.

2. Discuss the application of the Swiss cheese model to social-engineering incidents.

3. Describe a complete process for designing a role-based secure-behaviour programme.

4. Analyse the ethical and governance issues associated with insider-risk monitoring.

5. Compare the Theory of Planned Behavior, COM-B, and change-management models in cybersecurity practice.

Analytical / Application Questions

1. A hospital has frequent reports of staff sharing accounts because emergency access procedures are slow. Analyse the problem using COM-B and propose a proportionate intervention.

2. A company reports that phishing-simulation click rates have fallen but real incidents have increased. What alternative explanations should be examined, and which additional measures would you recommend?

3. Design a stakeholder-engagement and measurement plan for introducing mandatory phishing-resistant authentication in a distributed organization.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes human risk in cybersecurity?

A. It refers only to deliberate attacks by employees.

B. It includes behavioural, capability, motivational, and organizational conditions that may contribute to harm.

C. It is limited to failures caused by end users without considering technology.

D. It is the probability that every employee will violate policy.

Correct Answer: B. It includes behavioural, capability, motivational, and organizational conditions that may contribute to harm.

Question 2

According to the COM-B model, secure reporting behaviour requires capability, opportunity, and:

A. Punishment

B. Automation

C. Motivation

D. Certification

Correct Answer: C. Motivation

Question 3

A payment employee verifies a bank-detail change through an independently known telephone number. Which critical behaviour is being applied?

A. Least privilege

B. Independent transaction verification

C. Security championing

D. Data classification

Correct Answer: B. Independent transaction verification

Question 4

Why is public naming of employees who fail phishing simulations generally poor practice?

A. It eliminates the need for technical controls.

B. It may discourage reporting and damage psychological safety.

C. It guarantees that future simulations will be accurate.

D. It converts a leading indicator into a lagging indicator.

Correct Answer: B. It may discourage reporting and damage psychological safety.

Question 5

Which is the best example of a leading human-risk indicator?

A. Confirmed fraud loss

B. Number of data breaches last year

C. Percentage of critical roles using phishing-resistant authentication

D. Cost of incident recovery

Correct Answer: C. Percentage of critical roles using phishing-resistant authentication

Question 6

The Swiss cheese model suggests that an incident occurs when:

A. One careless employee always defeats all controls.

B. Multiple weaknesses across defensive layers align.

C. Training is removed from the security programme.

D. All security controls are technically ineffective.

Correct Answer: B. Multiple weaknesses across defensive layers align.

Question 7

A low phishing-report rate could mean:

A. The organization has no phishing risk.

B. Employees are highly secure in every situation.

C. The reporting mechanism is difficult or employees lack confidence in reporting.

D. All simulated messages were correctly blocked.

Correct Answer: C. The reporting mechanism is difficult or employees lack confidence in reporting.

Question 8

Which response best reflects a just culture?

A. Punish every employee involved in an error.

B. Ignore repeated reckless conduct to preserve trust.

C. Distinguish error, risky choices, reckless conduct, and malicious action.

D. Publish individual monitoring scores to encourage competition.

Correct Answer: C. Distinguish error, risky choices, reckless conduct, and malicious action.

Question 9

What is a major ethical safeguard for AI-based insider-risk analytics?

A. Remove all human review from investigations.

B. Use unlimited personal data to improve prediction.

C. Apply transparency, proportionality, privacy protection, and human oversight.

D. Treat every high-risk score as proof of malicious intent.

Correct Answer: C. Apply transparency, proportionality, privacy protection, and human oversight.

Question 10

A secure workflow is rarely used because it is much slower than an unapproved workaround. Which intervention is most consistent with the chapter?

A. Increase annual training hours only.

B. Make the secure workflow usable and easier while preserving required controls.

C. Punish all users of the workaround immediately.

D. Stop measuring the behaviour.

Correct Answer: B. Make the secure workflow usable and easier while preserving required controls.