When employees become the weakest cybersecurity link

Abstract

This teaching case addresses the core challenge of why 95% of internal cybersecurity breaches stem from employee error despite massive technology investments. Leveraging behavioral psychology, and featuring cybersecurity consultants Elsa and Maya, the case analytically structures the problem by identifying and examining four key behavioral factors contributing to breaches: Emotional, Cognitive, Negligence, and Diffused Responsibility. It then presents ‘employee conditioning' as a strategic intervention, requiring students to analyze its ethical and operational perils. Ultimately, the case frames a critical strategic decision: developing a resilient cybersecurity posture through the optimal integration of Human-in-the-Loop (HITL) and Human-Out-of-the-Loop (HOOTL) systems. Students are prompted to move beyond awareness training to design an integrated security mindset that systematically addresses human irrationality and the complex interplay of these behavioral risk factors.