When creating or refining a cyber security strategy, most organizations still default to a technology-first mindset. Historically, treating cyber security as an IT problem has always been a logical starting point because the entire discipline originally grew out of protecting and managing technology itself and, for decades, tools were the only practical way to defend an organization.
Today, however, the situation has changed significantly. Of course, technology remains essential, but a general over-reliance on tools has led many organizations to layer solutions without the foundations to support them.
The result is that, despite many years of ubiquitous technology investment, people remain a considerable vulnerability and, therefore, high-priority targets for threat actors – with various recent high-profile attacks exploiting humans rather than technologies. Addressing the underlying issues depends on the approach businesses take to three pillars: people, processes, and technology. Unless these are fully addressed and effectively integrated, weaknesses in one become magnified across the entire ecosystem. Without the right balance, organizations end up with tech they cannot configure, processes they do not follow, and people who remain the primary attack target.
Pillar one: People
From the perspective of a threat actor, modern security tools, processes, and the widespread use of encryption have made their task much more challenging. In contrast, exploiting human vulnerabilities can be a more viable route for gaining access to networks and data.
Despite this, organizations rarely put people first in their strategies; the bulk of spending still goes on technology, leaving human risk under-addressed. Although many organizations discuss security awareness training, it is often reduced to annual, ineffective sessions that teach little and fail to create lasting behavioural change.
Underinvestment in skilled cyber security professionals also remains a critical problem. Organizations want experienced staff, but many are unwilling to pay market value, resulting in capability gaps and tools that are poorly configured or underused.
True people-led security relies on building a culture where checking emails, verifying sender domains, and spotting anomalies become instinctive behaviours, in the same way that most people routinely – and without having to think about it – lock their house and car. Given the current level of risk and the severe impact that a breach can have, many business leaders would be well-advised to reassess their approach to adopting a people-first security culture.
Pillar two: Processes
Adding to the overall challenge is the fact that many organizations lack effective or consistent processes, which prevents their technology from working as intended.
For example, consider a scenario where a company purchases a new security tool designed to enhance detection and response capabilities. The IT team is responsible for deploying it, but there is no documented process describing how it should be configured, maintained, or monitored.
As a result, each engineer sets it up slightly differently and, over time, updates are applied inconsistently, alerts are routed to different locations and some departments receive stronger protection than others. When an incident occurs, the tool is technically in place, but the inconsistent configuration means that key events were never flagged. When reviewing the incident, leadership believes the technology failed, but the real issue was the absence of a standard, repeatable process for deploying and managing the tool.
What should be happening is that organizations establish clear, consistent, processes so that technology is configured and managed the same way across the organization. These processes should be created and maintained by people with the right skills and experience, rather than delegating them to underqualified or overstretched IT staff.
Another major benefit of having effective processes in place is that they can also drive technology choices, rather than buying tools first and figuring out how to implement them later. Collectively, this approach provides a solid foundation for the wider security environment, supporting resilience, including how the organization detects, responds to, and recovers from incidents.
Pillar three: Technology
It goes without saying that effective security technology is crucial, but organizations need to move away from an approach which reacts to a breach by buying more tech to plug the gap. Today, technology plays its strongest role when it contributes to a recoverable and resilient posture, rather than being viewed as the primary line of defence.
Indeed, because direct exploitation of technology is now much harder, the impact of security tools depends far more on the environment they operate in, including the organization’s maturity and supporting processes. Security tools also need infrastructure designed to support them at scale; if the underlying architecture cannot handle the load, the tools can weaken the security environment instead of strengthening it.
Ultimately, technology choices should follow a clear understanding of organizational risk and capability, rather than being driven by market noise or reactions to industry breaches. If we accept that 100% prevention is no longer realistic, the emphasis should shift towards implementing tech that enables rapid detection, response, and recovery. Organizations in this situation are much better placed to mitigate the risks they face and avoid the massive levels of disruption and expense seen so regularly on a global scale.
The author
JP Cavanna is Director of Cyber Security, Six Degrees
