Skip to content

Topic: human-risk

An organisation chart of a security team: 49 people working on technology and a single person responsible for the human side of cybersecurity
awarenessYour CISO-to-Awareness Ratio Is Broken. It's Sabotaging Your Defense

Boards spend most of their cyber time on technology. One number from the 2026 SANS Security Awareness & Culture Report works surprisingly well as a management indicator: a cybersecurity staffing ratio of at least one human-focused professional for every ten technical ones.

An employee shows a colleague from the SOC the suspicious message she just reported on her phone, under the headline From Employee Alert to SOC Action
awarenessWe Finally Have a Flawless Security Culture Action Plan

The SANS 2026 security culture action plan is barely about content. A CEO and board member on why that means rewriting your awareness strategy and bringing the SOC closer to employees.

Poster "See Something. Say Something.": woman at a laptop beside SANS 2026 top-5 human risks, #5 failing to report circled
bdeThe 5 Biggest Human Risks in Cybersecurity - and Why #5 Is Ignored

In the 2026 SANS Security Awareness & Culture Report, more than 1,700 practitioners named the risks they are focusing on, and social engineering came out on top at 77%. The fifth risk on the list gets no section of its own, and that is exactly the one I want to talk about.

A warehouse employee checks a suspicious message on his phone while a signal labelled Employee Signal Sent reaches a colleague at a security workstation
bdeWhy the Employee Has to Become Part of the Security Stack

AI is pushing cyber defense to machine speed, but the answer is not to remove people from the equation. It is to treat the human layer — the judgment, decisions and reports of employees — as part of the security stack.

Screenshot of itbusiness.ch: article "Cyberabwehr beginnt beim Verhalten" with a close-up photo of a blue eye
pressBehavioral Defense Engineering: Cyberdise in itbusiness.ch

Swiss IT publication itbusiness.ch has featured Cyberdise, and the headline says it all: cyber defense begins with behavior. Its June 2026 article argues that security awareness training alone no longer protects organizations.

Feature Image
bdeThe Next Giant Leap: Why It Is Time to Redefine Human Cybersecurity

Cyberdise is moving from traditional security awareness to Behavioral Defense Engineering (BDE). Employees already know phishing is dangerous, yet under the pressure of daily business they still click: the issue is not a lack of knowledge, it is a behavioral gap.

Title card "3 Reasons Why your employees are hacked in 2026": notes naming the main reasons (technical deficiencies, lack of knowledge, behavioral patterns) and the three things employees must master (recognize phishing mails, use secure passwords, read internet addresses)
human-riskThe Three Reasons Why Employees Get Hacked

Nearly half of all successful cyberattacks start with a negligent employee. Search engines will tell you it comes down to phishing, weak passwords and careless data handling. Look closer and all three say the same thing: this is about people.

Graphic "Behavior-Oriented Security Awareness" with six principles, from realistic conditions and measuring actions to habits
human-riskWhat is Behavior-Oriented Cybersecurity Awareness?

Behavior-oriented awareness measures success by observable change in risk behavior, not by knowledge completion, positive feedback scores or course consumption. It treats employees as human decision systems – not as information storage units.