Human Factors in Cybersecurity: From Human Error to Socio-Technical Resilience

Abstract

This paper examines human factors in cybersecurity as structural drivers of cyber risk rather than as residual deviations from otherwise secure technical systems. Although cybersecurity discourse still often describes users as the weakest link, contemporary research shows that breaches are more accurately produced through the interaction of cognitive limits, behavioural tendencies, interface design, organisational climate and adversarial manipulation of context. The paper aims to analyse the main cognitive, behavioural and organisational human factors that intensify cyber vulnerability and to formulate mitigation strategies that reduce risk without undermining legitimate work practices. Methodologically, the study adopts a critical integrative literature review that synthesises peer-reviewed research published between 2018 and 2025 together with foundational work in human error theory and behavioural decision-making. The analysis is organised around seven domains: human error, cognitive bias, phishing susceptibility, authentication behaviour, organisational security climate, training effectiveness and human-centred design. The review demonstrates that users do not fail simply because they are careless. Slips, lapses and mistakes are amplified by fatigue, divided attention, ambiguous interfaces, time pressure and contradictory productivity incentives. Phishing succeeds not only because messages are deceptive, but because recipients interpret cues through work context and fast, heuristic processing. Authentication failures likewise arise from the security-usability tradeoff that encourages password reuse, approval fatigue and informal workarounds. At the organisational level, leadership visibility, procedural justice, policy congruence and peer norms improve voluntary compliance more reliably than fear-based messaging alone. The paper argues that resilient cybersecurity requires a shift from a blame-oriented paradigm to a socio-technical model that treats users as adaptive actors who must be supported by secure systems, credible governance and continuous learning. It concludes that the strongest approach combines human-risk assessment, phishing-resistant authentication, repeated context-aware training, forgiving interfaces, behavioural metrics and no-blame reporting. CZU: 005.331:004.056; JEL: D91, M15, O33