Human factor

The field draws on cognitive psychology, human-computer interaction and safety science. A useful starting point is dual-process theory, popularised by Daniel Kahneman: most everyday decisions are made by fast, automatic, heuristic System 1 processing, and only a small share by slow, deliberate System 2. Clicking a link in the fortieth email of the morning is a System 1 act, so security that relies on users consciously weighing every message will fail at scale. Attention, working memory and vigilance are finite and degrade with fatigue, interruption and multitasking.

Social engineering deliberately targets these heuristics. Robert Cialdini's principles of influence, reciprocity, commitment and consistency, social proof, authority, liking and scarcity (unity was added in 2016), map closely onto phishing and pretexting patterns: a message from the "CEO" (authority) needing a payment "before 15:00 today" (scarcity and urgency). Business email compromise and helpdesk impersonation attacks succeed largely through authority and urgency rather than technical sophistication.

Usable security research showed that non-compliance is often rational. Adams and Sasse's 1999 paper "Users Are Not the Enemy" found that password rules which exceed human memory lead to written-down or reused passwords, and Beautement, Sasse and Wonham (2008) described a "compliance budget": people accept a limited amount of security friction, after which they route around it. This work fed directly into modern guidance such as NIST SP 800-63B dropping periodic forced password changes and composition rules in favour of length and breach checks, and into designs such as password managers, single sign-on and passkeys that remove the memory burden instead of adding rules.

Organisationally, ISO/IEC 27002:2022 control 6.3 requires awareness, education and training appropriate to roles, and NIST SP 800-50 Rev. 1 (2024) frames it as a cybersecurity and privacy learning program. ENISA's work on cybersecurity culture emphasises measuring behaviour rather than course completion. Phishing simulations are useful for measuring reporting rates, but when used punitively they erode trust and reporting. Nudging adjusts the choice architecture, for example secure defaults and well-timed warnings; the human firewall concept frames staff as an active detection layer. The human factor differs from human error, which is one outcome, and from security culture, which is the shared norms that shape behaviour over time; it is also a vulnerability that the technical controls around it must be designed to tolerate.