The end-user is not cyber security’s weakest link

Rennie Naidoo, Professor of Information Systems at the Wits School of Business Sciences.

---

Few ideas in cyber security have been repeated as often, or accepted as easily, as the claim that the end-user is the weakest link.

It appears in awareness programmes, boardroom presentations, vendor messaging, academic journals and conference speeches.

The reasoning is familiar. People click suspicious links, reuse passwords, approve fraudulent requests and overlook warning signs. From there, it is a short step to the conclusion that the person must be the problem.

This explanation is simple. Simplicity, however, can hide the real problem.

The deeper weakness is often not the user, but the mismatch between security design and human behaviour. That distinction matters because it changes where responsibility sits.

Instead of asking why people continue to make mistakes, organisations should ask why their security systems continue to depend on people behaving in ways that are unrealistic, unnatural and often inconsistent with the demands of ordinary work.

The problem is not simply that employees fail to follow security rules. It is that many security environments are designed for ‘idealised users’ rather than real people.

Modern cyber security systems are sophisticated. E-mail gateways inspect suspicious messages, identity platforms verify access, endpoint tools monitor devices, and AI systems search for unusual patterns across vast amounts of activity.

The technical layer is impressive, but it rarely removes human judgement entirely.

At some point, a person must decide whether to open an attachment, approve a payment, trust a caller, reset a password, grant access or report a message.

This is where cyber security reveals itself as something more than a technical discipline. Many of its most important moments are behavioural.

The most damaging effect of the weakest-link narrative is that it can allow weak technical design to survive.

A system can detect an anomaly, but someone may still need to interpret what it means. A warning can appear on a screen, but an employee must decide whether it is important. A suspicious transaction can be flagged, but a manager may still be asked to authorise or reject it.

The technical system identifies the possibility of risk. The person must often resolve the uncertainty. That is where the mismatch begins.

Employees do not arrive at work intending to create security incidents. They are trying to complete tasks, respond to managers, assist customers, support colleagues and meet deadlines.

They are usually encouraged to move quickly, remain helpful and remove friction from business processes. Responsiveness is praised. Collaboration is rewarded. Trust is necessary. Delays can be interpreted as poor service or weak performance.

Security training, however, often asks employees to adopt a very different posture. They are told to slow down, question authority, distrust unexpected requests, verify familiar names and treat urgency as a warning sign. This places the employee between two competing systems.

The business rewards speed, trust, cooperation and responsiveness. The security function rewards caution, hesitation, scepticism and verification.

Both sets of expectations may be reasonable, but they are not always easy to reconcile in the moment.

Attackers understand this dilemma well.

A phishing e-mail works because responding to e-mail is normal. A fraudulent invoice works because paying suppliers is normal. An impersonation attempt works because employees are expected to respond to senior leaders. A malicious access request can succeed because modern work depends on sharing information and granting permissions.

In many cases, the attacker is not exploiting carelessness. The attacker is exploiting ordinary organisational behaviour.

This is an important shift in perspective.

It suggests that the problem does not begin when someone clicks. It may begin much earlier, when an organisation creates a process in which a hurried employee is expected to make a perfect decision under pressure.

Human behaviour is neither random nor irrational in the simplistic sense often implied by security awareness campaigns.

People rely on mental shortcuts because they must make many decisions with limited time and incomplete information. They respond to urgency, trust familiar names, follow established routines and hesitate to challenge authority. They also try to avoid unnecessary conflict and tend to cooperate with people who appear legitimate.

These tendencies are not signs of stupidity. They are part of how people function in complex social environments.

Trust allows teams to work. Routine reduces mental effort. Authority helps organisations coordinate. Reciprocity supports relationships. Cooperation makes scale possible.

The irony is that the same behaviours that allow organisations to function can also make deception effective.

Cyber criminals rarely need to invent entirely new forms of behaviour. They only need to imitate the patterns that already exist inside the organisation.

They copy tone, borrow authority, manufacture urgency and exploit familiarity. Their aim is to make the unsafe action resemble the normal one closely enough that it does not feel unusual. It is enough to make the fraudulent request appear to be ordinary work. And the attacker does not need to defeat every control.

This is why social engineering remains effective even in organisations with mature technology.

Calling the user the weakest link offers organisations a simple explanation after an incident. It identifies a person, a moment and a visible mistake. That simplicity is appealing, but it can also prevent deeper learning.

When attention focuses on the employee who made the final decision, the wider process may receive less scrutiny. The organisation may ask why the person clicked, but not why the e-mail reached them.

It may ask why they approved the payment, but not why a large transaction could be authorised through a single communication channel. It may ask why access was granted, but not why excessive permissions had accumulated over time.

Blaming the user can also create unrealistic expectations. No employee can remain perfectly alert through every message, meeting, request and notification. Vigilance is difficult to sustain, especially in environments that are already demanding speed and constant responsiveness.

The most damaging effect of the weakest-link narrative is that it can allow weak technical design to survive. When the user carries the blame, the system may avoid examination.

The failure then appears to sit at the edge of the organisation, even though the conditions for that failure may have been built into the process from the beginning.

Good cyber security does not assume that people will stop behaving like people. It assumes distraction, time pressure, routine, trust and occasional mistakes, and then designs controls to reduce the consequences.

Multi-factor authentication reduces reliance on passwords alone. Password managers reduce memory demands.

Least-privilege access limits the damage that can follow when an account is compromised. Structured payment verification makes fraudulent transfers more difficult.

Clear reporting channels reduce hesitation. Well-designed warnings help people understand the actual risk without overwhelming them with technical language.

Automated detection can also identify patterns that a person may miss, especially when the volume of activity is too large for sustained human attention.

These controls do not remove responsibility from the user. They place that responsibility inside a more realistic system.

The goal should not be to train people to behave like security software. It should be to build security systems that understand how people behave under real working conditions.

The phrase “the end-user is the weakest link” should be replaced with a more useful question: What assumptions does our security system make about human behaviour?

Does it assume that people will always notice small inconsistencies? Does it expect employees to challenge authority without hesitation? Does it rely on them remaining vigilant throughout the working day?

Does it assume they will remember every rule during a stressful moment? Does it expect annual awareness training to override the incentives and habits of daily work?

When security depends too heavily on these assumptions, the weakness is not simply the person. The weakness is the design.

Cyber security is not only about preventing technical failure. It is also about building systems in which predictable human behaviour does not become catastrophic risk.

Technology will continue to improve. Detection will become faster; identity systems will become more sophisticated, and AI will identify patterns that were once difficult to see. Yet the final challenge will remain both human and organisational.

Security improves when people are supported by good design, sensible incentives and controls that expect imperfection.

End-users are not outside the system. They are part of it. The weakest link is the gap between security design and human behaviour.