Human factors in IT security

Experience, evidence and a direct path to action

User mistakes also reflect time pressure, procedures, permissions and available tools. Virtline combines training with a review of technical safeguards and reporting channels. We agree the scope and expected evidence for each organisation. Call +48 12 200 27 10 to arrange a consultation.

Definition: human risk is the risk of the process, not the employee's fault

Human risk means the risk resulting from user decisions, time pressure, unclear procedures, excessive authorisations and technical gaps. The slogan about humans as the weakest link may be convenient, but it shifts the responsibility onto the user instead of the security system. If one mistake causes account takeover, data leakage, or downtime, the problem also lies in the lack of MFA, excessive permissions, weak verification procedures, and insufficient monitoring.

Situations where staff reveal process gaps

Social engineering attacks take advantage of haste, authority, routine and the lack of a clear path to confirm decisions. The greatest risk arises where the user must judge for themselves whether a message, phone call or access request is genuine.

• Finance: a false request to change an account number or an urgent transfer from a person impersonating the management.
• HR: an attachment from the candidate, a file with personal data or a request to reset access without identity confirmation.
• Sales: a link to an alleged request for quotation, an archive with malware or fake correspondence with a customer.
• IT and helpdesk: password reset, request to grant permissions or accept OAuth application consent.
• Remote work: private device, lack of encryption, outdated laptop or use of an unapproved communication channel.

The most common causes of user errors

Staff errors are rarely the result of bad faith. Most often, they are the result of haste, excess authorisations, lack of simple procedures, insufficient training and technology that does not stop obvious mistakes.

• Clicking on a link or attachment impersonating a customer, supplier or supervisor.
• Using the same passwords, saving them in uncontrolled places and no MFA.
• Sending data to the wrong recipient or sharing a file without access restrictions.
• Consent to password reset, transfer or account change without confirmation via the second channel.
• Putting off reporting an incident out of fear of the consequences.

Corporate user risk reduction checklist

An awareness programme gives users clear reporting and verification steps, while IT provides controls, support and evidence.

• Enable MFA for email, Microsoft 365, VPN, administrative accounts, and customer data systems.
• Establish a single channel to report suspicious messages, lost hardware, and incorrect file sharing.
• Verify payments, bank-detail changes and access resets through an independent channel with a previously known contact, following the identity-verification procedure.
• Limit user permissions and separate administrative accounts from everyday work accounts.
• Stop interacting and report immediately through the approved channel. Preserve the message and state whether you entered a password, approved MFA or ran a file. Do not use the suspicious link to change a password. IT will determine account or device containment and next steps.
• Practice scenarios for high-risk roles: management, finance, HR, sales, administration and IT.

Technology is intended to limit the effects of error

Training is important, but a company should not base safety only on employee vigilance. MFA, EDR, backup, email filtering, secure file sharing and login monitoring ensure that a single error does not have to turn into a critical incident.

Equipment, competences and IT maintenance reduce the number of difficult decisions

Modern equipment, up-to-date systems, EDR, backup and a competent IT team reduce the number of situations in which the user must decide the risk on his own. The technology should support the employee: block malicious files, enforce MFA, signal unusual logins and facilitate quick reporting.

How Virtline builds an awareness and control programme

We start with roles, processes and real attack vectors, not with universal slides. We combine workshops with an overview of MFA, email, Microsoft 365, permissions, endpoints, backup and reporting path. The programme is intended to produce a measurable effect: fewer unclear decisions on the user's side and better evidence on the IT side.

Awareness records for management and audit

Awareness should leave an operational trace: not only the attendance list, but also procedures, configurations and decisions of risk owners. This is important for ISO 27001, NIS2, GDPR and conversations with customers. Virtline maintains an ISO/IEC 27001:2022 information security management system certified by TÜV NORD, has completed audits and separates declarations from evidence in awareness projects. The application of NIS2/KSC and DORA depends on the organisation’s sector, status and activities. Technical records can support assessment, but do not by themselves confirm compliance or certification.

• Register of training, groups covered by the programme and repetition dates.
• Results of phishing exercises and post-test remediation actions.
• Incident reporting procedure and list of persons responsible for escalation.
• Export MFA policies, review permissions and confirm separation of administrative accounts.
• User incident report, reporting time and conclusions for internal communication.

Security-risk reduction plan to reduce human risk

Reporting, response after a click, payment verification, MFA and incident ownership need to work from the outset. Address urgent gaps alongside training. Reviews after 30/60/90 days assess progress rather than postpone protection.

• 30-day review: assess MFA, reporting, urgent remediation, high-risk roles and incident response.
• 60-day review: assess workshops, independent confirmation, post-click instructions and test outcomes.
• 90-day review: assess reporting trends, permissions, control effectiveness and further actions.

Management staff must also take care of IT security

Management and process managers must establish priorities, accept exceptions, and fund recurring activities. Training should be repeated after changes in the organisation, after incidents and new tools, and not as a one-off presentation for signature.

• Designate risk owners for finance, HR, sales, IT and customer data processes.
• Repeat short training and phishing exercises for high security impact roles.
• Combine training with measurable controls: MFA, tickets, response times, test results and corrections.
• Maintain blame-free communication so employees report errors quickly.
• Require evidence of programme operation: reports, decision lists, reviews and configuration changes.

Related articles

The topic of staffing ties in with phishing, passwords, MFA and the broader cybersecurity agenda.

User risk needs to become a controlled process

The largest incidents happen when an employee must judge risk alone, without a procedure, tool or fast IT support. A human risk programme should therefore connect behaviour, technology and management accountability.

• The user knows when to stop and how to report a suspicious message.
• The helpdesk has a first-response playbook, not only a general request to be careful.
• The process owner confirms exceptions, access resets and payment decisions through a second channel.
• IT maintains MFA, EDR, backup, login monitoring and permission reviews.

Devices and configuration should support safe decisions

A current laptop, managed account, disk encryption, EDR, secure email and controlled file sharing reduce the number of situations where an employee has to improvise. Technology should stop common mistakes, not only record an incident after it happens.

Management should require recurring evidence, not a one-off presentation

User security works when it has review cadence, owners and measurable evidence. Training should leave exercise results, a decision list, a technical change plan and clear information about risks that require management acceptance.

• Report ticket trends, phishing test results and first-response time.
• Update scenarios after incidents, tool changes and new customer requirements.
• Connect awareness with ISO 27001, NIS2, GDPR, access policies and incident handling.

How to reduce human-factor risk

Training is useful, but it works best with technical controls and simple reporting. Users need clear rules, MFA, phishing examples, safe reset paths and a culture where suspicious events are reported early.

• Teach users to recognise phishing and repeated MFA prompts intended to wear down resistance. Explain password-reuse risks, secure data sharing and incident reporting.
• Support users with password managers, MFA, clear reset procedures and safe channels.
• Measure training completion, phishing simulation results and reporting speed.
• Connect awareness with helpdesk, incident response and access reviews.

Typical human-factor incidents

Common scenarios include suspicious messages, links, files, phone calls or unusual sign-in requests. Each needs assessment and an appropriate response.

How to prepare and review a security exercise

Agree scope, timing, safe materials and protection of results with the programme owner. Assess reporting and technical controls as well as clicks. Use the findings to improve the programme without publicly shaming individuals.

• Before the exercise: choose roles and scenarios, approve materials and define contact with the exercise team.
• During the exercise: measure reporting speed, request verification and helpdesk response.
• After the exercise: assign corrective actions, owners and a date to check effectiveness.

Contact

Identify where a user error can become an incident and which controls should be implemented first.