Stop Blaming Humans: Rethinking Security Culture with John Scott

Summary

The discussion argues that cybersecurity should stop treating people as the “weakest link.” People make mistakes, but those mistakes often arise from the systems, incentives, processes, workload, and conditions around them. Security improves when organizations design for human behavior, encourage people to report problems, and connect security to the organization’s purpose.

Main ideas

• People remain central even as technology becomes more automated. Automation does not remove human responsibility: people design, deploy, and oversee systems, and organizations remain accountable for their outcomes.
• “People are the weakest link” is an oversimplification. John Scott says security statistics—such as claims that a large share of breaches involve human error—are often misquoted or used without context. Human error may be the visible endpoint of deeper problems, including poor design, planning, or procedures.
• Errors need to be understood, not merely blamed. Scott draws on human-factors research to distinguish different kinds of error. A typo or missed warning may call for a different response than a knowledge gap, a skipped procedural step, or a distraction caused by competing demands.
• Context affects risk. The discussion’s example of taxi drivers illustrates why raw incident counts can mislead: drivers in busy city areas may have more minor accidents because they face more hazards, while drivers with fewer incidents in rural settings may struggle when placed in a high-risk environment. Similarly, departments with heavier email workloads or particular job requirements may face different phishing exposure.
• Security should support the organization’s mission. At the Bank of England, security messaging was tied to the organization’s role as a trusted guardian of the country’s financial stability and assets. Scott’s lesson is to connect security to what the organization already values, rather than presenting it as a separate demand.
• Trust and a supportive response matter. If employees fear punishment for reporting mistakes, they may hide incidents. Leaders should make it safe to raise concerns and treat early reporting as useful information.
• Cybersecurity should not be framed as warfare. Scott objects to the “cyber warrior” identity, arguing that security is better understood as essential organizational hygiene. Security teams can still take pride in their work by connecting it to the people and services their organization supports.
• Organizations should reduce the consequences of mistakes. If one click can bring down a company, the problem is not simply the person who clicked; it is also how the organization is designed and protected. Security should not depend on every person making the perfect choice every time.

Practical guidance discussed

Align security with the organization’s purpose

• Identify what the organization exists to do and whom it serves.
• Explain how protecting data, systems, and services helps fulfill that mission.
• Build on existing values and trusted cultural norms rather than trying to impose a separate “security culture.”

Investigate errors before prescribing training

• Ask what conditions led to the incident.
• Determine whether it involved distraction, a perceptual mistake, a skipped step, insufficient knowledge, or another factor.
• Use training when there is a genuine knowledge or skill gap; address workload, processes, design, and environment when those are the cause.

Design phishing programs around the desired behavior

• Prioritize teaching employees how to report suspicious messages, not merely how to avoid clicking.
• Treat reporting as a positive contribution: it takes time and can provide information that technical controls do not.
• Track reporting, including cases where someone clicks and then reports the message.
• Use phishing simulations to reinforce reporting behavior, not as proof that employees can reliably identify real attacks. Scott says research has not established a correlation between success on simulated phishing and detection of real phishing.
• Avoid deceptive tests that damage trust or train people to distrust legitimate organizational messages. Separate the goals of penetration testing from those of awareness and culture programs.

Use a systems view of risk

• Consider how technical controls, individual decisions, and organizational processes combine. Scott refers to the Swiss cheese model, in which an incident occurs when weaknesses across multiple layers align.
• Account for differences in roles, workloads, and exposure instead of judging people by unadjusted incident counts.
• Make it easier to report mistakes promptly and respond constructively.

Use the cultural web to guide change

Scott recommends working on all six levers of Johnson and Scholes’ cultural web together and aligning them with the organization’s purpose:

1. Organizational structure
2. Power structures — who has influence
3. Control structures — including policies and oversight
4. Recognition and rewards
5. Rituals and routines — how work is actually done
6. Symbols and stories — what the organization communicates and celebrates

Speakers and sources mentioned

Speakers

• John Scott — cybersecurity culture and human-risk specialist; guest.
• Kieran Martin — host.
• James Lyne — host. The subtitles render his surname inconsistently (“Line”/“Lyne”).

Named people, organizations, reports, and examples discussed

• James Reason — researcher on human error and safety.
• Verizon Data Breach Investigations Report (DBIR) — discussed in relation to claims about human involvement in breaches.
• IBM — mentioned in connection with an earlier human-factor breach statistic.
• Bank of England, Mark Carney, and Will Brandon — discussed in connection with the bank’s security changes and leadership culture.
• CESG’s “10 Steps to Cyber Security” and the UK National Cyber Security Centre (NCSC).
• Chris Elliott and Royal Bank of Scotland (RBS) — cited in an example involving HR’s use of PDF attachments and phishing tests.
• Kerry, a former NCSC colleague — quoted on the idea that if one email click can destroy a company, the organization’s design is also at fault.
• Johnson and Scholes’ “cultural web” — the six-part framework Scott recommends for culture change.
• An unnamed former military commander and the podcast “The General and the Journalist” — referenced in the opening discussion of human responsibility for autonomous systems.
• A 1950s New York taxi-company case — used to illustrate how work context can distort comparisons of incident rates.
• Dwight from The Office — invoked as a cautionary comparison for overly aggressive security exercises.