Keynote Presentation Blinded by “the weakest link” A New Perspective on Human Risk Masha Sedova

### Overview In this keynote presentation, Masha Sedova addresses one of cybersecurity's most persistent challenges: human risk. Rather than viewing employees dismissively as the "weakest link" or "problem between the keyboard and the chair," Sedova argues that security teams must stop relying on compliance-driven, one-size-fits-all annual training. Instead, organizations should treat the human element as a critical layer in the Swiss cheese model of defense by applying data analytics, psychology, and behavioral science to measure and actively influence security decisions.

### Key Topics - **Beyond Security Awareness:** Awareness focuses merely on knowledge, but knowledge alone does not change behavior (citing studies such as LastPass showing poor password habits despite security awareness). Human risk is defined by the observable decisions employees make every day. - **Security Debt and Enterprise-Wide Impact:** Risky choices—such as a developer shipping code without security reviews to meet a deadline—introduce security debt. Over time, accumulated debt across infrastructure, product security, and access control leads to security incidents. - **Measuring Observable Behaviors vs. Underlying Mindsets:** Risk consists of impact (role and access permissions) and likelihood (user behavior and track record). Sedova illustrates how security tools already log employee behaviors (e.g., endpoint protection stopping unauthorized executable downloads) that reveal likelihood. - **Influencing Behavior via Behavioral Science:** Applying Dr. B.J. Fogg's behavioral model, an action requires motivation, ability, and a prompt/trigger. Practitioners can improve security by either increasing ability (making tasks easier) or boosting motivation.

### Technical Details & Frameworks - **Measurement Data Sources:** Security logs from endpoint protection, password managers, identity/MFA platforms, and web filtering reveal observable actions. For underlying mindset, beliefs, and values (the submerged part of the iceberg), Sedova references research from the Corporate Executive Board and recommends tools such as the Creative Commons-licensed Security Force Survey. - **Increasing Ability:** Organizations should reduce friction for secure behavior by introducing password managers instead of expecting complex memorization, one-click phishing report buttons instead of manual email forwarding with headers, and automated security scanning tools for developers. - **Motivational Levers:** - *Social Proof:* Demonstrating peer behavior significantly drives adoption (e.g., Facebook and Georgia Tech research showed highlighting friends using MFA made users 1.36 times more likely to enable it; "celebrity social proof" using executive adoption reached 80% password manager adoption in six months). - *Gamification:* Leveraging game mechanics such as security strength scorecards, department leaderboards for SLA adherence, and streak counters (e.g., "days since last successful fish"). - *Positive Reinforcement:* Moving away from negative reinforcement (e.g., mandatory training or account lockout) toward celebrating and recognizing employees who report suspicious activity or exhibit strong security practices.

### Takeaways Human risk directly affects every security domain, from incident response and compliance to product security and red teaming. Security teams must move away from the "department of no" mindset and instead leverage existing security telemetry to measure individual risk likelihood, reduce friction for good practices, and use positive behavioral science interventions to turn employees into effective security champions.