The Human-Centered Cybersecurity Gap

In the cybersecurity space, there is a growing recognition that most cybersecurity breaches trace back to human error rather than a technological vulnerability. Industry reports, including Verizon’s annual Data Breach Investigations Report, find that a majority of breaches involve a human element. A firewall can’t stop an authorized employee from typing their password into a fake login page. Encryption can’t stop someone from clicking a malicious link disguised as a routine email from IT. This manipulation of human technology users raises a problem in the cybersecurity policy space, since such policy often focuses on optimizing technological systems, rather than preventing the humans who use them from being exploited.

The 2016 breach of the Democratic National Committee (DNC) is a clear illustration of how this plays out in practice. In the breach, hackers from a Russian military intelligence unit known as “Fancy Bear,” sent spear-phishing emails to DNC and Clinton campaign officials that mimicked legitimate security alerts. Unlike general phishing campaigns that use generic bulk emails posing as trusted entities to collect sensitive information like log-ins or credit card numbers, spear-phishing campaigns target a specific person or organization and add an element of personalization, often making them harder to catch. In 2016, DNC officials who clicked the links were directed to spoofed login pages that mimicked their own and entered their real credentials, handing attackers direct access to internal email systems. No encryption was broken and no firewall was breached. A trusted user was simply deceived into opening the door.

Although the DNC and the Clinton campaign are private organizations, federal employees face the same kind of attack, and often hold access to far more sensitive systems. Federal employees are therefore attractive targets for cybersecurity attacks because they might hold access to confidential information while operating under the same everyday pressures as any other employee: high email volume, time pressure, and messages designed to look routine or urgent. A 2026 cybersecurity report found that phishing attempts against the government rose 50% in 2025, to 138.5 million, making the government the third-most targeted industry.

Why Some Want Stronger Behavior-Focused Requirements

The case for strengthening federal requirements over human-centered cybersecurity rests heavily on the data. Mimecast’s State of Human Risk 2025 report found that human error, including insider threats, credential misuse, and simple mistakes, contributed to 95% of data breaches in 2024. That was true even though 87% of organizations surveyed said they train employees to spot attacks at least once a quarter. Similarly, a 2025 study by researchers at UC San Diego and the University of Chicago found no evidence that annual security training reduced employees’ phishing failures. Proponents of strengthening human-centered cybersecurity requirements point to this as evidence of the ineffectiveness of the status quo. When it comes to the federal employees, this ineffectiveness can pose a national security threat.

Proponents of stricter mandates argue that human-focused provisions in federal law are hollow in practice. Even though Federal Information Security Modernization Act (FISMA) includes a cybersecurity training requirement for federal employees, it has been described as a “checkbox” exercise, something employees complete once a year to satisfy a compliance requirement rather than a program that meaningfully changes behavior. Indeed, research from 2019 found that the benefits of one-time employee training decay quickly, while frequent, contextual phishing simulations with immediate feedback tend to produce more durable behavior change. This has caused proponents to argue for amendments to FISMA or changes to internal rules, with the goal of increasing the baseline training requirements for all federal staff to include more than a one-time annual training.

Concerns About Adding New Behavior-Focused Requirements

Opponents of new mandates contend that enough human-centered cybersecurity policy already exists, and that adding more will put an administrative burden on already-underesourced agencies. FISMA already requires federal agencies to run and document an information security program each year, and agencies with access to classified information have also been required to run insider threat programs since Executive Order 13587 signed in 2011. For critics, this presence of several federal mandates means that the problem is not a policy gap, but rather an enforcement gap.

In 2022, The Government Accountability Office found that the two-level rating scale used to evaluate agencies’ information security programs as “effective” or “not effective” was too imprecise to show meaningful differences between agencies, and that unclear guidance led inspectors general to apply it inconsistently. Opponents of new training mandates argue that the government should focus on improving the evaluation and flagging process for existing programs before requiring entirely new ones. 

On the other hand, some cybersecurity commentators argue against human-focused cybersecurity mandates entirely, arguing that focusing on individual behavior risks obscuring institutional failures, understaffing, and punitive cultures that discourage incident reporting. This view draws on “just culture,” a principle from safety science that separates honest mistakes from reckless behavior. This view treats a user’s mistake as a symptom of a broader system failure rather than an isolated personal fault, and warns that blame-the-user policy responses let organizations avoid harder structural fixes.

Looking Ahead 

There is broad agreement, across government, industry, and the research community, that human behavior plays a major role in cybersecurity breaches, which can put national security at risk. The disagreement is over what to do about it: whether the answer is new or strengthened legal provisions targeting behavior directly, or better enforcement and evaluation of the training and insider-threat requirements that already exist on the books. How policymakers answer that question will shape whether agencies focus on writing new behavioral requirements or on strengthening the ones already in place.

Frequently Asked Questions