October 13, 2026

Should We Blame Users for Cybersecurity Mistakes?

The Problem

By Htet Wai Yan

2 min read

Following a security incident, the answer is usually predictable: an employee clicked on a phishing email, re-used a password, or believed the wrong caller. The resulting answer then comes fast: people are the weak link. However, there may be another side to this story that calls for reconsideration because, in many cases, the error is actually a symptom of poor design.

Why it matters

Most security breaches involve human behavior. According to Verizon's Data Breach Investigations Report released in 2024, close to 68% of all breaches had the involvement of human factor in some way, like making a mistake or being subjected to social engineering. One of the recent cases of such a breach happened in September 2023 to MGM Resorts when their systems were breached, disrupting operations at the hotel and casinos for days. The public accounts have shown that the intruders posed as an employee during a phone call to the helpdesk. No sophisticated hacking was required — just a convincing voice.

The deeper problem

The statistic mentioned above indicates involvement of humans in some way. But it does not state that people are the cause of problems. This distinction appears to be critical according to scientific literature on the topic. Adams and Sasse, in their 1999 article "Users Are Not the Enemy," concluded that employees circumvented security policies not due to lack of attention, but because those policies were in contradiction with accomplishing their tasks. Complex password policies made users write down passwords. In turn, Whitten and Tygar in their article "Why Johnny Can't Encrypt" revealed that skilled users were not able to operate a tool for email encryption due to complexity of the user interface. Security, which most users cannot use properly, is no security at all.

Let us now take into consideration the case of MGM again. The help desk staff was simply doing what his/her job requires — helping a caller. The vulnerability was a process that allowed a voice over phone to unlock an account even without thorough validation. The attackers are professional in this. The employees have other things to do and receive many messages per day in time-bound manner. So expecting perfection from them is like never expecting accidents from a driver and yet taking away seat belts.

There is also an element of legality and ethics. The law in Indonesia on Personal Data Protection (UU №27 of 2022) puts the obligation to secure personal data on the data controller and not individual employees of the organization. According to ACM Code of Ethics, principle 2.9, computing professionals should design their system "robustly and usably secure."

My judgment

This section is my own analysis, not established fact.

Blame should not be the default response to user mistakes. Users still have a role: they should take basic care, such as pausing before acting on urgent requests. But the main responsibility belongs to organizations and security professionals, because they control the design. Three changes would make a real difference:

  1. Make stolen credentials less useful. Phishing-resistant sign-in methods, such as passkeys or hardware security keys, mean that even a tricked user cannot hand over a working login.
  2. Protect high-risk processes. Help desk password resets should require strong identity verification, so one convincing phone call is not enough.
  3. Treat mistakes as lessons, not offenses. If employees fear punishment, they hide errors, and the organization loses precious hours in responding. A no-blame reporting culture lets problems be contained sooner.

This approach is reasonable because it does not depend on people being perfect. In any large organization, someone will eventually make a mistake. A well-designed system assumes this and limits the damage.

A question to consider

If a system stays secure only as long as no one ever makes a mistake, whose failure is it when someone finally does?

References

  • Verizon. (2024). 2024 Data Breach Investigations Report.
  • Adams, A., & Sasse, M. A. (1999). Users are not the enemy. Communications of the ACM, 42(12), 40–46.
  • Whitten, A., & Tygar, J. D. (1999). Why Johnny can't encrypt. Proceedings of the 8th USENIX Security Symposium.
  • Republic of Indonesia. (2022). Undang-Undang №27 Tahun 2022 tentang Pelindungan Data Pribadi.
  • ACM. (2018). ACM Code of Ethics and Professional Conduct.