Humans are the new firewall

For twenty years the security industry sold the perimeter. Firewalls, then next-generation firewalls, then segmentation, then zero trust. It worked well enough that sophisticated attackers largely stopped trying to break the wall, and started asking someone inside to open the door.

The uncomfortable consequence is that the most consequential security control in most organisations is not a product. It is whether a finance officer pauses before approving a payment instruction that arrived at 4:40pm on a Friday.

Why annual training fails

The standard response is a compliance video, watched once a year at 1.5x speed, followed by a quiz nobody fails. It satisfies an auditor and changes nothing, because it teaches definitions rather than recognition. People do not need to be able to define pretexting. They need to notice that this particular request feels wrong.

Effective programmes work the other way around. They start from the specific pretexts that would work against this organisation — the systems staff actually use, the approvals they actually give, the suppliers they actually pay — and rehearse those. Recognition is a trained reflex, and reflexes need repetition, not information.

Make reporting the easy path

The second failure is structural. In most organisations, reporting a suspicious message is slower and more socially awkward than ignoring it, and staff who report something that turns out to be legitimate feel foolish. That asymmetry guarantees under-reporting.

Fix the incentive and the numbers move: a one-click report button, a fast acknowledgement, and visible thanks for reports that turn out to be nothing. An organisation where people report freely detects intrusions in hours. One where they don't finds out from a customer.