Human firewall

Human firewall is a practitioner metaphor, not a standardised term; no NIST, ISO or ENISA glossary defines it. It is best read as a reframing of the older "weakest link" narrative. Usable-security research, starting with Adams and Sasse's 1999 paper Users Are Not the Enemy, showed that insecure behaviour is mostly a rational response to badly designed security, and that treating staff as the problem makes them hide mistakes. The human-firewall framing keeps the idea that people are a control layer, but assigns them a job they can actually do: detect and report, not be infallible.

Mechanically, the value is in the sensor network, not in individual resistance. A phishing campaign typically hits many recipients within minutes; if even a small fraction report early, one report can protect everyone else. That requires a pipeline: a one-click report button in the mail client (Microsoft's built-in Report button, Google Workspace's report phishing, or a third-party add-in), a shared mailbox or API feeding a SOC or SOAR playbook, automated clustering of identical messages by sender, URL and hash, verdicting, and bulk removal from all mailboxes, for example through Microsoft Defender for Office 365 remediation or zero-hour auto purge. Detonated URLs and sender indicators then go into block lists, so a single report hardens the technical layers too. A large field study by Lain, Kostiainen and Čapkun (IEEE S&P 2022) found that crowd-sourced reporting by employees was an effective and sustained detection signal, while embedded post-click training was not.

The metrics follow from this model: reporting rate and median time-to-first-report per campaign, the ratio of reports to clicks, the share of reported mails that were genuinely malicious (a signal of detection quality, not only volume), and the time from first report to purge. Feedback closes the loop; reporters who never hear back stop reporting.

Common failure modes are the metaphor turning into blame (click-and-shame, public league tables, disciplinary action for simulation failures), an unmonitored report mailbox, and over-reliance on people to compensate for missing technical controls. A human firewall is one layer in defence in depth, sitting behind SPF/DKIM/DMARC, filtering, sandboxing and phishing-resistant MFA; it complements them by covering what they miss, and it is a property of security culture rather than something a single awareness campaign can produce.