The biggest expenditure for most companies is their payroll and employee-related costs. In terms of cybersecurity, one would think that anti-virus packages, SIEM solutions or a managed services provider would sit at the top of the list when it comes to costs. I think the human firewall would rank number one on this list. I can’t say that for a fact but I am confident in that statement. This is the first line of defence and should be prioritised, yet it is often the element least associated with cost in the minds of most organisations. According to Verizon’s 2025 Data Breach Investigations Report, from a dataset of 10,798, 60% of breaches involved a human element. Human element includes credential abuse, social actions (phishing/pretexting), errors and interaction with malware.
A human firewall is an organisation’s layer of protection whereby employees are encouraged to follow security best practices to identify and prevent malicious activities such as data breaches and social engineering attacks. If you have ever had sight of a cyber proposal form, it’s usually the last question at the end that’s concerned about continuous annual cyber awareness training. Yes, this relates to the 2-5min videos that you are always reminded about on a Friday having fought the arduous battles of “increasing shareholder value”. A human firewall is primarily centred around transforming employee behaviour and organisational culture to mitigate human error. A human firewall should be focused around the following:
- Continuous and engaging education (kind of what the purpose of this newsletter): a human firewall centres on extensive, ongoing cybersecurity awareness training. It makes use of interactive and engaging methods, such as gamification and simulated phishing campaigns, to ensure employees understand and can practically respond to common threats like social engineering, malware, and weak password practices.
- Behavioural Science and Habit Formation: A successful program needs to leverage adult learning methodologies and behavioural science to shift secure practices from being a conscious effort to a subconscious habit. This involves using positive reinforcement, such as acknowledging and thanking employees who report suspicious activities, to encourage continued vigilance and create “stickiness” in their behaviour.
- Building a Security-Conscious Culture: It centres on making security a shared responsibility across the entire company, rather than leaving it solely to the IT department. This cultural shift relies heavily on visible support from leadership, where executives model secure behaviours, and an open-door environment where employees feel safe reporting potential incidents without the fear of retribution.
- Personal Relevance and Empowerment: To ensure employees are genuinely invested, a human firewall often centres on demonstrating “what’s in it for them” on a personal level. By showing staff how the cybersecurity skills they learn at work can help them act as the “CISO of their household” to protect their children, families, and personal digital lives, organisations can inspire workers to actively embrace secure habits.
Our lives are not only confined to work; however, the lessons we take from it can follow us home in ways we rarely appreciate. Sure, we cost companies a lot of money, and in return we get the odd bonus, a pizza day here and there and if you are lucky, a “self-help” guru to lift the spirits. Yet it is those Friday videos that nobody asked for that may carry the most lasting value. The same cyber awareness training that saves organisations millions is the very thing that quietly positions each of us as the CISO of our own household, protecting our families in a world where social media has made everyone a target.
Key Takeaways:
- People are the vulnerability. Technology alone cannot secure an organisation. With 60% of breaches involving a human element, the human firewall is not a soft investment; it is a strategic one.
- Culture beats compliance. Ticking the training box is not enough. Lasting security comes from embedding secure behaviour into everyday habit, driven by leadership, positive reinforcement and genuine employee engagement.
- The value travels home. Cyber awareness training extends well beyond the workplace. An employee who recognises a phishing attempt at work is the same person protecting their family online, making it one of the few organisational investments with a truly personal return.