Your staff aren’t the weakest link. Stop telling them they are.

There’s a phrase my industry loves, and I’d happily never hear it again. “People are the weakest link.” It turns up in conference talks, in sales decks, in the first slide of the yearly training video. I think it’s wrong, I think it’s lazy, and I think it makes businesses less safe. The idea that staff are the weakest link in cyber security has had a very long run, and it’s time we retired it.

Where the blame usually lands

Read almost any write-up of a cyber attack and you’ll find the same sentence somewhere near the top. “An employee clicked a link.” Story over. One person, one mistake, and everyone else gets to feel a bit better about themselves.

Now ask the questions that sentence skips. Why did that email reach them at all? Why did one click on one laptop give an attacker the run of the building? Why did that account have access to everything? Why wasn’t there a second check on a payment that size? Why did nobody notice for three weeks?

None of those are questions about the person who clicked. They’re questions about how the business was set up, and the people who set it up are rarely the ones named in the write-up.

Look at what goes wrong in practice

We wrote recently about an organisation where ransomware got in through a test account created in 2012 with the password “Password1”. Nobody on reception clicked anything. An account that should have been deleted a decade earlier was still sitting there, and nobody owned the job of tidying it up.

That pattern is far more common than the careless employee of legend. Old accounts. Missing updates. Admin rights handed out because it was quicker. No multi-factor authentication on the one system that mattered. These are decisions, or the absence of decisions, made well above the person who ends up taking the blame.

When a click really is the way in, it’s still worth being honest about the odds. Attackers send convincing emails all day, every day. Your team has to get it right every single time, while also doing their actual jobs. If your whole defence depends on a busy person never making a mistake, the weak part is the design.

If one click can sink your business, the problem was never the person who clicked.

Ashley Adkins, fromIT

What the phrase does to people

Words matter here. Tell a group of adults that they are the weakest link and see how keen they are to help you. You’ve told them security is something done to them, by people who think they’re a liability.

It gets worse when training is built around catching them out. Send a fake phishing email, count who clicks, put the clickers on a course. People learn the lesson you’re really teaching, which is that mistakes get punished. So they keep quiet. They don’t mention the odd email they nearly fell for, or the link they did click and then thought better of.

That silence costs more than any click. When something has gone wrong, an hour’s head start is worth a great deal, and you only get it if the person who noticed feels safe saying so. I would much rather a team reported ten false alarms a week than had a perfect phishing test score and a habit of saying nothing.

People are the bit that works

I’d go further. Think about how a near miss usually stays a near miss. A finance assistant thinks the new bank details look off and rings the supplier. A receptionist doesn’t like the sound of the caller claiming to be from IT. A manager wonders why a colleague is emailing at 3am.

No filter catches those. A person does, using judgement that software still can’t match. Your team is the only part of your security that can notice something is odd without being told what odd looks like. Calling that a weakness is a strange way to treat your best sensor.

So who is the weakest link?

If we must have one, I’d nominate the things nobody is embarrassed about. The account nobody closed. The update nobody chased. The supplier nobody asked. The budget conversation that got put off for another year. The assumption that security is IT’s job, when it’s a job for whoever runs the business.

That last one is uncomfortable, and I say it kindly. If you’re the owner or the director, you set what gets time and money. Your team can only be as careful as the setup you give them allows.

What I’d do instead

1. Design for the click. Assume someone will click one day and make sure it can’t take everything down. Multi-factor authentication, sensible access, updates and backups do that.
2. Take the judgement calls away where you can. A passkey won’t sign in to a fake page, so nobody has to spot the fake. A second approval on payments means one person can’t be tricked alone.
3. Thank people for reporting. Every time, including when it turns out to be nothing.
4. Change what you measure. Count how many people told you about the test email. It says more than how many clicked.
5. Train little and often, and be kind about it. Five minutes a month that treats people like adults beats an hour a year that treats them like suspects.
6. Drop the phrase. From your slides, your policies and your own head.

Training still matters. I built a free course because I believe that. But I built it for people I think of as the first to notice when something’s wrong, and I wrote it that way.

The next time a supplier, a consultant or a slide deck tells you your people are the weakest link, I’d ask them a question back. Weakest compared with what? Then have a look at that list of old accounts.