Ahead of European Cybersecurity Month (ECSM) 2026, attention is once again turning to one of the most important elements of information security – people.
The official kick-off event of the European initiative, held on 25 September at the Court of Justice of the European Union in Luxembourg under the title “The Human Compass: navigating the future through cyber awareness”, placed particular emphasis on the human factor in cybersecurity and the effectiveness of cybersecurity awareness programmes.
This focus highlights a fundamental principle: technological safeguards are essential, but they are not sufficient on their own.
Firewalls, antivirus software, multi-factor authentication, encryption, backups and threat detection systems are all important elements of protecting information. However, even a well-designed technical environment cannot guarantee information security on its own.
Behind the technology are people – employees, managers, administrators, contractors and suppliers. They create and use information, grant access, make decisions and respond to unusual situations.
This is why the human factor is an essential part of information security management.
 
When the Attack Targets the Person, Not the System
Not every attack begins with the exploitation of a technical vulnerability. In many cases, attackers seek to exploit trust, inattention, insufficient awareness or an employee’s tendency to respond quickly.
A typical example is social engineering – the use of psychological and communication techniques to manipulate a person into disclosing information, granting access or taking an action that creates a risk for the organisation.
A phishing message may appear to come from a manager, supplier, bank or familiar online service. A phone call may be presented as coming from technical support. A request for an urgent payment or a change of bank account details may appear entirely legitimate.
Developments in artificial intelligence are further increasing the ability to create convincing messages, images, voice recordings and other content that can be used in such attacks.
 
The Human Factor Goes Beyond Phishing
People-related risk extends far beyond social engineering.
An incident may also result from:

• sending information to the wrong recipient;
• using weak or reused passwords;
• incorrectly assigned access rights;
• sharing sensitive information through an inappropriate channel;
• using unauthorised applications or cloud services;
• incorrect system configuration;
• loss of a device or document;
• delayed reporting of a suspicious event;
• failure to follow or understand established rules.

In this sense, the human factor should not be viewed solely as the “weakest link”. People can be both a source of risk and an important part of an organisation’s defence.
 
Training Is Necessary, but Not Sufficient
Regular information security training is an important measure, but a one-off presentation or an annual online course does not guarantee that employees will recognise a real attack.
Effective awareness requires a consistent approach tailored to the organisation’s specific risks and roles.
This may include:

• induction and periodic training;
• short, targeted training sessions when new threats emerge;
• practical examples and simulations;
• clear rules for working with information and information systems;
• an easy-to-use mechanism for reporting suspicious events;
• analysis of incidents and lessons learned;
• periodic evaluation of the effectiveness of the measures implemented.

The objective is not simply for employees to have completed training, but for knowledge to translate into behaviour that reduces risk.
 
Practical Testing Shows What Happens in a Real-World Situation
One way for an organisation to assess how well employees recognise attempts at manipulation is through controlled social engineering tests.
Such tests can show, for example, whether employees recognise suspicious messages, follow established procedures and promptly report a potential incident.
The results should not be used solely to identify mistakes. They can provide a basis for identifying areas where additional training, process changes or technical controls are needed.
Practical assessments can form part of broader information systems testing – vulnerability testing, penetration testing and social engineering, providing the organisation with a more realistic understanding of the effectiveness of the security measures in place.
 
Employees as Part of the Defence
A well-prepared employee may notice something that technical safeguards have not detected.
They may recognise an unusual request, verify the sender’s identity through another channel, refuse to disclose information or report suspicious activity before it leads to an incident.
This requires an organisational environment in which people know:

• what is expected of them;
• what the main risks are;
• whom to contact when in doubt;
• how and when to report an incident or suspicious event.

The role of management is particularly important. When information security is treated as a management priority rather than solely as the responsibility of the IT department, rules and training have a much stronger foundation for effective implementation in practice.
 
How Does an Organisation Know Whether Its Measures Actually Work?
Having policies, procedures and technical safeguards in place does not automatically mean that they are effective.
An organisation should periodically assess whether established controls are being applied in practice, whether access rights are appropriate, whether employees understand their responsibilities and whether existing measures address the actual risks.
Such an assessment may form part of an information systems audit (IT audit), which examines not only technological solutions but also policies, access management, personnel competence, business continuity and other organisational aspects of information security.
 
People, Processes and Technology – A Systematic Approach
Effective information security requires a balance between people, processes and technology.
This systematic approach is at the heart of ISO/IEC 27001. The standard specifies requirements for an information security management system (ISMS), through which an organisation manages risks to the confidentiality, integrity and availability of information.
In this context, awareness is not an isolated activity. It is connected with competence, communication, risk management, controls and the continual improvement of the management system.
This means that an organisation should not simply “train its employees”, but should create an environment in which secure behaviour becomes part of everyday processes.
 
Information Security Is a Shared Responsibility
Technology remains an indispensable part of security, but it cannot fully compensate for the absence of clear rules, appropriate processes and security-aware people.
Effective protection requires an organisation to understand its risks, implement appropriate technical and organisational measures, develop employee competence and verify whether the actions taken actually work.
The human factor is not simply a risk that needs to be mitigated. When people understand the threats, know how to respond and actively participate in protecting information, they become one of the organisation’s most important lines of defence.