In 2024, a Hong Kong-based finance worker clicked on an email purportedly from his UK-based CFO, instructing him to pay out hundreds of millions of HK dollars to the executive. But soon, to the worker and firm’s horror, the video call ‘confirming’ genuine contact with the boss was revealed to be a deepfake.

The victim could have fallen for the scam for any number of human reasons, including fatigue, cognitive overload and deference to authority, all factors routinely exploited in social engineering attacks. It’s an example of how human limitations can overcome any defences your organisation may have.

“Most successful attacks exploit human psychology rather than technological weaknesses alone,” affirms Dr Emma Arakas, a forensic psychologist at the Frazer Nash Consultancy, specialising in human vulnerabilities in cyber systems and organisational resilience to cyber-attacks.

Expecting people to behave in ways that aren’t human is one of the biggest mistakes organisations can make, she adds. “Rather than designing for an idealised user, organisations need to lean into the fact that people are humans and design for real people, with real pressures, limitations and competing priorities. Understanding what their workforce needs, what helps them do what they need to do, and supporting them to be more secure is key. The most secure solution isn’t always the most technologically sophisticated. It’s the one that works with human behaviour, rather than against it.”

COM-B: a model for behavioural change

Arakas references the ‘COM-B’ model of human behaviour, which proposes that behaviour is driven by three interacting factors: capability, opportunity and motivation. To successfully effect behavioural change, all three components must be considered.

“If we want good cyber security behaviours, people first need the capability to act securely. That means understanding the threats they face, recognising warning signs, and knowing what actions to take when something doesn’t look right. Second, they need the opportunity to behave securely.”

Even the most knowledgeable employee will struggle if the environment works against them, Arakas explains. For example, if someone is processing hundreds of emails under significant time pressure, it’s unrealistic to expect them to scrutinise every message in detail. Likewise, if the organisational culture prioritises speed over security, or if secure behaviours are difficult or inconvenient, people are less likely to adopt them.

Finally, there is motivation: “Employees need to understand why cybersecurity matters and recognise that it is part of their role, not solely the responsibility of the IT team. If people don’t appreciate the potential consequences of a cyber incident, or don’t believe their actions make a difference, they are far less likely to remain vigilant.”

Drawing on her experience advising organisations on cybersecurity, Arakas argues that organisations often focus too heavily on training while overlooking the systems, incentives and workplace pressures that shape behaviour. “Sometimes capability is part of the issue, but it's often not the whole story. If the working environment makes secure behaviour difficult, training alone won't solve the problem,” she says.

Who is responsible for cyber security?

The challenge isn't just teaching employees what to do and what not to do, Arakas asserts. “It's about creating a culture where secure behaviours become habitual, socially reinforced and, importantly, viewed as everyone's responsibility.”

Organisations often unintentionally reinforce the idea that cybersecurity belongs to the IT department. “You see it in the language they use, the reporting structures they create, and even who is seen to be communicating about cyber risk,” says Arakas.

“The reality is that cybersecurity is a people issue, a business issue and a resilience issue. Creating a secure organisation requires everyone to see themselves as part of the solution.”

Reposition cyber security as an enterprise-wide issue

Organisations must frame cyber security as a business resilience, human, and reputational issue impacting every employee rather than just the IT department. Organisations can take the following practical steps to embed cyber security across the business:

Change internal language, communication, and reporting structures: broaden ownership of cyber risk by ensuring it is discussed by business leaders, operational teams and senior management, not just cyber security specialists.

Connect risks to daily operational work: link cyber security guidelines directly to specific tasks, systems, and tools employees use every day, making safe practices fit naturally into ‘normal’ work routines.

Make cyber security personally relevant: help employees understand how cyber threats can affect them beyond the workplace, including risks such as identity theft, financial fraud and social media compromise. Drawing these connections can help secure behaviours feel more intuitive and meaningful.

Lead by visible example: ensure that leadership actively models the desired vigilance behaviours: publicly completing their security training, discussing risks during routine business meetings, and sharing lessons learned from incidents are all useful approaches.

Design human-friendly workflows and support systems: acknowledge human limitation by supporting workers with practical tools - such as password managers - and adjusting workloads to prevent cognitive overload, fatigue, and burnout, which can all increase their vulnerability to cyber-attacks.

Establish positive social norms: people are strongly influenced by the behaviour of those around them. Use behavioural insights and positive peer comparisons to reinforce desired behaviours. For example, highlighting high training completion rates or strong reporting behaviours across teams is often more effective than relying solely on mandates and compliance messaging.

Recognise and reinforce good practice: make secure behaviour visible and valued. Recognition schemes, manager feedback and small incentives (eg, coffee vouchers) can go a long way to reinforce positive behaviours and show executive commitment to cyber security. Recognition doesn’t have to be expensive to be effective.

Understand and measure change incrementally: cultural change does not happen overnight, so to keep the organisation motivated, set realistically achievable milestones and track small steps towards the end goal.

Avoid fearmongering: maintain a balanced, matter-of-fact tone when discussing cyber risks. While employees need to understand the risks, excessive alarmism can lead to disengagement, anxiety, or can make people feel that they are underqualified to manage threats. The goal is vigilance, not fear.