What Practitioners Actually Think About Human Risk

Where this comes from

Cloud Security Office Hours is a free, open Zoom that runs every Friday. Practitioners drop in, someone asks a question, the room works through it, and every session gets a published recap. The human side of security is mentioned in passing in more than twenty recaps. This page draws on the sixteen where it was worked through, from July 2024 to November 2026, including one in May 2026 given over to it entirely and a guest talk in August 2026 built on behavioral data from about 290,000 employees.

This is not a survey and not a consensus document. It is what people said to peers rather than to a camera. No attendee is named apart from a guest who presented publicly. Where sessions contradicted each other, both views are here. The site's human risk reference page covers how the attacks arrive, the signals you already have, and how to build a program; this page covers what practitioners said to each other about it.

Blame the user, or design around them?

The framing that recurs in these sessions was put plainly in the May 15, 2026 session: attackers exploit human trust and behavior, so people are an essential part of the solution rather than merely the problem. The example offered was a business email compromise in which a comptroller wired a million euros on the strength of a single email, which makes the point that human judgment is part of the control set whether or not anyone designed it that way.

The January 30, 2026 session had already questioned a much-repeated number in this area. One member objected to the claim that 90 percent of breaches are caused by human error being repeated without evidence, and in the debate that followed another argued that the useful response is to minimize the impact of the errors people will make rather than to blame them for making them.

Design was the alternative on offer. In the May 15 session one attendee used the image of a bridge: engineer security systems to be resilient instead of blaming users when they fail. Another argued that established business processes act as compensating controls, so the defense does not rest on technical measures alone. A third observed that the shift to microservices and specialized systems has made security harder to simplify for the people using it.

The same point turned up in smaller settings. In the July 31, 2026 session, advising a small law firm on its choice of email provider, participants agreed that technical controls alone cannot prevent business email compromise and that strong processes and user training are essential. The June 26, 2026 session covered tailgating, badging, laptop locks and home offices, and its theme was that security awareness has to be teachable and livable: guidance people can follow, without unrealistic policies and without making them paranoid.

Attacks aimed at trust

Every attack discussed in these sessions worked on a person first, whatever tooling came after. The June 19, 2026 session looked at a phishing-as-a-service kit that automates Microsoft 365 account compromise for roughly $250 a month, including scanning compromised mailboxes for wire-transfer opportunities and sending contextual replies to victims. The room's reading cut both ways: kits like this lower the barrier for attackers, and the volume they produce can also make campaigns easier to detect. Social engineering was named as the common denominator.

In the July 10, 2026 session, AI came up as a way to scale what phishing already does. One attendee explained that AI can scan for vulnerable targets and customize campaigns, making mass phishing more targeted and efficient. The same attendee was careful about the next step: autonomous follow-up replies to victims are possible, but they had not tested that and regarded it as still emerging.

Being visible makes you a target. The March 6, 2026 session heard from a member who receives targeted phishing as a public figure in security. The advice for anyone speaking at conferences was to be careful about sharing personal information, to remember that asking not to be recorded is an option, and to weigh the risks of speaking publicly against the benefits. The same session turned to intuition: one member described relying on a quick instinctive read of whether someone is trustworthy, and another advised being protective and watchful at social events, particularly with younger team members.

The oldest session on this page is a reminder of how far a pretext still gets someone in person. In the July 12, 2024 session, a member who runs physical security assessments described the team getting into two branches of a company by posing as prospective renters, working through the difficulties of long-range RFID tools, and cloning an access card. The member also described the approach to a building secured with RFID cards and a PIN, and the warning message the team left for that building's security staff.

The November 6, 2026 session added the most expensive example on the page. Walking through the theft from Binance, one attendee described the way in as basic social engineering, malware-laden downloads and a job application scam, leading to a theft of about $6.3 billion. The site's Binance kill chain reconstructs it from the exchange's own findings.

Awareness training, in its narrow form

When awareness training came up, the discussion was about its shape. The January 16, 2026 session worked through a member's project to map awareness content to MITRE tactics, techniques and procedures in order to define complete coverage. The room's view was that this might be backwards: decide what business value the training has to deliver and what level of coverage is acceptable first, then build toward it. Two attendees pressed the point that training has to start from what its audience needs rather than from technical security concepts.

The same session described the format the room favored: short, targeted video briefings that nudge people toward a specific action, such as updating an operating system or turning on multi-factor authentication, instead of one-off lengthy sessions. Training has to be relevant and contextual for each group of users. Gamification and behavioral psychology came up as ways to make the material engaging.

Fear-based messaging drew skepticism. In the May 2, 2025 session, one attendee argued that fear can motivate but leads to fatigue and lost effectiveness when overused, and proposed moving from a culture of fear to a culture of risk in which ownership of each risk is clearly assigned. The group's conclusion was that a balanced approach, combining compliance, risk management and targeted awareness, is likely to work better than relying on fear alone. The May 15, 2026 session came at it from the communication side: explaining risk to non-technical people works best when it starts from what the audience already knows and builds up, weighing emotion and authority alongside logic, rather than leaning on fear.

The basics still came up. In the May 15 session two members debated whether security failures come from mismatched incentives or from a lack of basic education, and agreed that making secure choices easier and teaching fundamentals such as two-factor authentication and password management would move the needle. Another observed that simplified consumer technology has quietly eroded digital literacy among younger workers, widening the gap between personal and professional security habits. The concern reaches past the office: the November 28, 2025 session discussed the security problems older relatives face, starting from a near miss with a scammer on a messaging app.

Role is a first draft

The most data-heavy session on this page was the August 28, 2026 guest talk by Stryker, "The Meeple Problem". Her argument was that security programs reduce each employee to a single variable, usually job title or seniority, and then treat that first draft as final. Role is a reasonable starting hypothesis for access controls; acting on it without testing it is the mistake. She gave three reasons the shortcut persists: access is supposed to follow function, so role-level rules look defensible; compliance frameworks describe role-based controls and training, so role becomes the variable whenever something has to clear a checkbox; and for much of the field's history a list of people and job titles was close to the only data available.

Her data came from the AI behavior study she led at her employer at the time, covering about 290,000 people across 32 customer environments over roughly three months of 2026. Only 34 percent of employees were detectably AI-enabled, against roughly half in surveys, and she put the gap down to AI features switched on inside software that was already approved. Employees in that AI-enabled group held their technical controls better, with fewer data-loss alerts and better MFA enrollment, while their volitional behaviors, such as unsafe browsing and overdue compliance training, looked worse; she was careful to call that pattern correlation rather than causation. Split by role, the spread across groups was wide, with some doing materially worse and others, finance among them, notably better.

On executives, she showed a survey she had run at a previous employer in which 98 percent of executives said they supported security mandates, while meaningful shares of the same respondents admitted accessing files they did not need, clicking phishing links, and sending money in response to one. In her own analysis of delivered and clicked phishing messages, from an in-house threat intelligence role, seniority correlated neither with who clicked nor with how sophisticated the lure was. Tenure did show up in her phishing simulation analysis: the newest hires failed most often, followed by people one to four years in, which she put down to familiarity breeding contempt rather than inexperience.

Her recommendations followed from that. Executives warrant a dedicated security function, with their support staff trained for the threats aimed at them, hands-on help installing a password manager, and MFA that is actually enforced; the prompt for that last point was a public post describing an IT team that exempted an executive from MFA altogether. Beyond role, she suggested testing variables such as recent layoffs and leadership changes, remote versus on-site work, and seasonality, since people are more vulnerable at the holidays, at tax time and around elections. Her strongest recommendation was to pair signals that usually live in separate tools, such as an EDR's unsafe-browsing alerts and a measure of AI use, and treat the result as threat hunting applied to people.

The week before, previewing the same research in the August 21, 2026 session, she pointed to lawyers as a group with particularly high rates of risky behavior, which she tied to how much of their work is email and document handling. The site's human risk page turns the talk into a working method.

Insiders: mistakes and pressure more than malice

The insider threat discussions on this page dwelt more on mistakes and pressure than on malice. In the January 30, 2026 session, two members agreed that while insider threats are a significant concern, the root cause is often cultural and incentive problems rather than bad intent. One suggested reframing the motive around external pressures instead of assuming malice, another stressed balancing security controls with trust in employees, and a third argued that awareness training should focus on unintentional insiders. The same session also heard the example of a contractor who disabled logging systems.

The May 2, 2025 session, discussing a rise in internal threats reported in the Verizon Data Breach Investigations Report, particularly in healthcare, broke insiders into accidental, ignorant and malicious actors.

The May 15, 2026 session moved the question up the organization chart. One member cited a survey finding that 49 percent of C-suite executives had requested a security bypass despite backing the security mission. Another pushed back that the sharper problem is middle management, describing team leads who discouraged reporting a GitHub credential exposure to leadership for fear of the consequences. The group agreed that a blameless environment, where people feel safe reporting, is essential.

When people are the threat to each other

One session took the human side somewhere less expected. The March 20, 2026 guest talk was on the behavioral science of online harassment. Introducing it, the session's host acknowledged that harassment is not cloud security on its face, but argued that the same science explains community behavior, CSOH's own included, and that its mechanisms are what the community tries to invert to keep its own space positive.

The speaker, a digital investigator with a background in behavioral science, walked through why crowds behave worse than individuals. The SIDE model holds that anonymity does not erase identity but shifts it to the group, so it amplifies whichever group norm dominates; in a 1979 study, the costume people were given changed whether they behaved aggressively or caringly. Online disinhibition adds layers of permission, from anonymity and invisibility to the sense of writing to an imagined person rather than a real one, and the reward circuitry that social platforms engage makes moral pile-ons self-reinforcing.

The part closest to this site's usual subject was AI. The talk described AI-generated sexual imagery as a step change, because it has collapsed the skill barrier that used to keep that kind of abuse rare, and closed on a gap: preventative work aimed at aggressors is still largely missing, and most programs focus on victims and on pressing platforms for design changes. The question-and-answer part of the session was not recorded, so the room's response is not on record.

Moderation came up from the practitioner side in the March 6, 2026 session, where a member who helps run an online hacker community described the kinds of threat actor a community has to plan for, accidental insiders among them, and why community guidelines and moderation matter.

Where the room disagrees

These are live disagreements, not strawmen. None of them were settled.

Teach people, or take the decision away?

The November 6, 2026 session put two positions side by side over the Binance theft: one attendee argued for a balance between complex systems and user education, while another held that a financial system moving billions should have no human access to production under normal circumstances. The second position takes the person out of the decision rather than training them for it. The May 22, 2026 session, on AI agent skills, had leaned toward the people for a different reason: the scanning technology is too immature to rely on, so protecting users, who are open to social engineering, matters more, and one attendee suggested teaching people to recognize patterns and rely on reputation signals. The same group agreed that education alone is not enough against increasingly sophisticated threats.

Incentives or education?

In the May 15, 2026 session two members argued over whether security failures come mainly from mismatched incentives or from a lack of basic education. They agreed on both remedies, easier secure choices and better fundamentals; the recap does not record them settling which cause is larger. Elsewhere in the session, another member floated software liability as a lever to push security earlier into development, an incentive answer to the same question.

Are executives the weak point, or just the target?

The executive figures in the August 28, 2026 talk drew pushback. One attendee noted the obvious confounder, that leadership has easier access to sensitive files to begin with, and the speaker agreed her survey could not separate the executive variable from the access variable. The host asked whether executives click more because the attacks aimed at them are more sophisticated; her answer was that this is partly true but not enough to explain it, since her own analysis found no correlation between seniority and the sophistication of the lure. The May 15, 2026 session had already split along a different line: executives requesting bypasses on one side, middle managers discouraging reports on the other.

How much can the behavior data say?

The recap of the August 28, 2026 talk notes that the group pushed back throughout on what the data could support, which was largely the point. Several attendees suggested the AI-enabled group's better technical controls reflected more technical people rather than anything about AI, which is why the speaker split the data by role. One asked whether AI users' heavier web traffic inflated their unsafe-browsing numbers; she shared the suspicion but could not confirm it, since she measured AI use through file uploads rather than directly. Another found the link to overdue compliance training odd, and she agreed it was strange rather than explaining it away. When finance came out ahead, one attendee suggested finance staff were simply better at hiding it. She called that a hypothesis rather than a finding and offered her own: finance is regulated, invested in, and required to take extended leave while its work is inspected.

FAQ

Is this an official position of Cloud Security Office Hours?

No. It is a synthesis of what attendees said on the live Friday call across sixteen sessions. CSOH is vendor-neutral and takes no house position on awareness training, phishing simulation, or any vendor or product. Where attendees disagreed, both sides are reported rather than reconciled, and opinions are labeled as opinions.

Why are no individual attendees named?

The Friday session is open to anyone, but it is a conversation, not a publication. People think out loud, change their minds, and talk about their employers informally. Attributing opinions to named individuals would change what people are willing to say. Guest speakers whose talks are published on the presentations page are named, because presenting is a public act.

How were these sessions selected?

They are the recaps between July 2024 and November 2026 in which social engineering, phishing, security awareness, or insider behavior was discussed in enough depth to draw on, rather than mentioned in passing. Every claim on this page links to the recap it came from, so any reader can check the source.

Why does a cloud security page include a talk on online harassment?

Because the session made the case for it. The behavioral science behind online pile-ons (anonymity, group identity, and the reward of punishing someone) explains why people behave differently online than in person, and the host who introduced the talk said those mechanisms are what CSOH tries to invert in its own community. It is reported here as one session's argument, not as a claim that harassment is a cloud security problem.

Can I join the Friday session?

Yes. It runs every Friday, it is free, there is no pitch, and there is no requirement to speak. Details are on the sessions page, and every past session has a published recap.