All news with #human risk management tag

🧠 New survey shows cybersecurity roles are causing widespread stress and burnout. Object First polled 500 IT and security professionals and found 84% feel uncomfortably stressed and 78% fear being personally blamed after incidents. The pressure is pushing many to seek new jobs, worsening staffing shortages and increasing organizational risk. Recommended actions include building a blame-free culture, reducing alert noise, and investing in mental-health and resilience resources.

🛡️ ISC2’s 2025 Cybersecurity Workforce Study of 16,029 professionals finds that skills shortages have overtaken headcount as the primary concern for security teams. Budget constraints leave 33% of respondents unable to adequately staff and 29% unable to afford skilled hires, while 88% reported at least one incident linked to skills gaps. The report highlights rapidly accelerating AI adoption—69% are at some adoption stage—and stresses capability development, targeted training, and realistic workload expectations over simple headcount increases.

🔐 Organizations often assume stricter, more complex controls automatically increase security. The article identifies five common UX-driven mistakes — poor security mindset, one-size-fits-all policies, confusing complexity with protection, reliance on legacy security questions, and misplaced faith in biometrics — that can degrade defenses. Experts Yehudah Sunshine, Joseph Steinberg and April McBroom recommend practical measures such as targeted training, contextual controls, password managers, multiple-choice knowledge checks, and behavioral biometrics. Their guidance emphasizes reducing friction, encouraging honest reporting of errors, and tailoring security to user roles to improve both usability and protection.

🔑 Renee Guttmann and other senior cyber leaders explain when professionals need mentorship versus executive coaching. At a September ISSA LA meeting, Guttmann distinguished mentoring as a one-on-one transfer of real-world experience and coaching as focused work on skills like executive presence. Speakers pointed to formal programs, networking, and industry groups as primary sources for guidance. Together, mentors and coaches help bridge technical foundations and board-level business acumen.

🧠 The democratization of advanced attack capabilities means cybersecurity leaders must rethink talent strategies now. Ann Johnson argues the primary vulnerability in an AI-transformed landscape is human: teams must combine technical expertise with cognitive diversity to interrogate and adapt to probabilistic AI outputs. Organizations should change hiring, onboarding, retention, and continuous upskilling to create resilient, future-ready security teams.

🛡️ usecure has appointed Kevin Lancaster as a Non-Executive Director to accelerate its North American channel expansion. Lancaster, founder of ID Agent and former head of Channel Program, brings deep channel experience and a proven track record of scaling channel-first security and SaaS businesses. He will work with the board and executive team to help usecure become the leading human risk management solution for MSPs, supporting growth across distribution partners and more than 1,800 MSP partners worldwide.

🔐 IT security often meets resistance when guidelines clash with everyday work pressures, causing employees to view measures as obstructive and to bypass them. The article advocates empathetic policy engineering: perform stakeholder analysis, design user-centered policies, and pilot changes with early adopters. Communicate with respect—use tactical empathy, collaborative 'help me to help you' dialogues, and realistic, scenario-based training to boost acceptance and embed secure practices.

🛡️ Cybersecurity work creates a relentless, always-on pressure that erodes mental health, driving sleep loss, anxiety and burnout. The piece outlines how constant alerts, moral responsibility for failures and siloed teams amplify errors and organizational risk. It calls for concrete changes—from individual boundaries and therapy to organizational psychological safety—and industry shifts such as integrating wellness into ISO and NIST frameworks.

⚠️ Functional security leaders are increasingly disengaging due to heavy workloads, limited autonomy, and stalled career progression, creating a direct resilience risk for CISOs and the broader enterprise. The piece cites ISACA data showing rising stress and widespread understaffing and includes perspectives from Carole Lee Hobson, Brandyn Fisher, and Monika Malik. Recommended actions include clear promotion rubrics and executive sponsorship, consolidated tooling with a quarterly kill-switch, and metrics tied to prevention and risk contribution.

🔒 Surveys and first‑person accounts reveal persistent inclusion gaps for cyber professionals with disabilities and neurodivergence. UK research (Decrypting Diversity 2021) and Deloitte’s Disability Inclusion @ Work 2024 show many report barriers to progression and frequent denial of accommodations. Three practitioners — a security awareness leader, a former cyber risk analyst and a commercial sales manager — describe bias, resilience and concrete steps for leaders: ask rather than assume, build empathy, offer flexibility and provide structural supports.

🔍 Organizations are facing a growing threat from applicants who pose as legitimate job seekers but are in fact operatives tied to overseas actor networks. Recent cases — including a July 2024 incident at KnowBe4 and longer running campaigns tracked as WageMole and DeceptiveDevelopment — show perpetrators use stolen identities, deepfakes and remote infrastructure to gain employment. The article outlines practical detection cues for recruitment teams and containment steps to limit insider risk.

🔐 Cyber Awareness Month highlights the persistent cybersecurity skills shortage and the opportunities it creates for new entrants and experienced professionals. The 2025 Cybersecurity Skills Gap Report documents a global shortfall of more than 4.7 million roles and identifies high demand for data, cloud, network and AI security expertise. Employers increasingly favor certifications (65%) over degrees, opening practical pathways for career changers, veterans, and adjacent IT or business professionals. Investing in upskilling, governance, and awareness programs can reduce breach risk and improve retention.

🔍 The 2025 Insider Risk Report finds insider-driven data loss is widespread and costly, with 77% of organizations affected and many incidents stemming from human error or compromised accounts rather than malice. It warns that traditional DLP often lacks behavioral context and visibility across endpoints, SaaS, and GenAI. The report urges adoption of behavior-aware, AI-ready platforms and five practical practices to reduce false positives and prevent data loss.

🔒 Phishing remains a pervasive threat—IBM attributes roughly 15% of data breaches to these attacks—yet standard training approaches are delivering limited protection. Recent studies cited in the article show annual awareness modules and embedded simulated-phish interventions often fail to change user behavior or secure genuine engagement, with many users closing training pages outright. Security leaders are advised to treat training as one element of a broader risk-reduction strategy that pairs behavioral design, clear escalation steps, measurable metrics, incentives, and technical controls such as two-factor authentication and improved phishing detection.

👪 The early teen years are pivotal for digital development, and trust between parents and teens matters more than any single setting. Tools like Family Link and YouTube’s supervised experience are valuable, but parents juggling multiple children, apps and devices need simpler solutions—AI assistants could configure age- and app-specific controls. Rather than blanket bans, the piece calls for thoughtful restrictions developed with parents, schools and communities alongside independent digital literacy standards.

🔍 A reader recounts a sophisticated phone scam in which callers posed as bank employees and provided plausible details to build trust. The scammers supplied case numbers and 'cancellation codes,' then transferred the victim to a staged supervisor named Mike Wallace to legitimize their story. Even security-aware individuals can be deceived; the anecdote illustrates how social engineering exploits procedural expectations and authority. Independently verify any unexpected bank contact via official channels before taking action.

🔒 Organizations face persistent cybersecurity staffing and budget gaps, with ISACA finding 65% of firms report unfilled positions. Hiring timelines remain long—38% say entry-level roles take three to six months to fill and 39% report similar delays for non-entry roles—while half of organizations struggle to retain talent. Only 56% believe their board prioritizes cybersecurity, and 53% view budgets as underfunded. ISACA urges faster investment in holistically trained, hands-on cyber workforces to keep pace with evolving threats.

🛡️ Coherence is framed as the operational backbone for insider-risk programs, stressing shared meaning and alignment rather than surveillance alone. The author argues most insider incidents stem from two vectors — malicious intent and human error — both amplified by semantic drift. Building coherence requires aligning messaging across HR, communications, legal, and security, training for narrative fidelity, equipping line managers with rituals and lexicons, and creating feedback channels that surface drift before behavioral anomalies.

🔒 A YouGov survey commissioned by Initiative Sicher Handeln finds many younger internet users — the so-called Digital Natives — struggle to spot common phishing signals. Nearly half of Gen Z (49%) do not recognise unsolicited attachments as suspicious, and fewer notice impersonal salutations, spelling errors, or bogus urgency. The online poll (Sept 8–10, 2025; 2,044 German adults) prompts the Stop, Question, Protect appeal.

🔍Teamwork, problem-solving and analytical thinking now outrank core technical skills in entry-level cybersecurity hiring, according to an ISC2 study of 929 hiring managers across the US, UK, Canada, Germany, India and Japan. The report finds AI is reshaping priorities: managers favour human strengths that AI can't duplicate while routine monitoring is increasingly automated. Experts warn that overreliance on certifications and broken entry pipelines exclude capable candidates, prompting vendors and employers to broaden recruitment through apprenticeships, neurodiverse hiring and outreach to career changers.