You can wall off your server rooms, buy the glossy ticketed cyber insurance, and hang cybersecurity posters in the breakroom, but a determined attacker doesn’t need your crown jewels. They need a person. One click. One bad habit. One overlooked bit of human trust between the keyboard and payday. If you want real security, you stop pretending threats live only in the data center and start treating the human being as both the first line of defense and, unless trained, the easiest exploit.
The central truth
Security budgets chase shiny tools; breaches chase human error. Phishing, social engineering, poor device hygiene, weak oversight of third parties, and blind spots in threat modeling are where adversaries live. Threats are social, psychological, physical, and technical. If you keep thinking it’ll all be solved by a new product, you will be breached, and you’ll deserve it.
What companies must do (and fast)
1. Start with threat modeling that includes people
Threat modeling isn’t just diagrams of APIs and firewalls. It must include the human attack surface, roles, access patterns, incentives, pressure points, and out-of-band communication channels. Map who can approve wire transfers, who receives VIP invites, and who uses personal devices for work. Assume adversaries will study your org chart and LinkedIn. Model those attack paths.
Actionable: run tabletop exercises where the adversary is social engineering the CFO, the recruiter, and the facilities manager, not just the web server. Put a human-focused adversary in the attack thread.
2. Continuous, adversary-informed pentesting and red-teaming
Pen tests that stop at vulnerability scanners are theater. You need integrated red teams that blend technical exploitation with social engineering and physical testing, run as close to real attackers as policy and law allow. Use results to harden processes, not just code.
Actionable: schedule combined assessments (technical + social + physical) at least annually, with quarterly focused social-engineering simulations. Ensure remediation is tracked like any other critical incident.
3. Measure and weaponize phishing simulations ethically
Simulations must be realistic, varied, and tied to learning. After the bait is taken, don’t punish, educate. Provide immediate micro-lessons that explain the red flags the target missed. Track improvement at the team and role level, not the individual humiliation scoreboard.
Actionable: run repeated phishing campaigns with different vectors (SMS, voice, LinkedIn) and follow every simulated compromise with a mandatory, role-specific training module.
4. Bring in speakers who scare and teach, like me
There is value in speakers who don’t sugarcoat. Speakers who combine field experience, storytelling, and practical mitigation create cultural shock, a necessary first step. A talk from someone who’s been on the road, broken into organizations, and seen human exploitation close-up wakes people up faster than a slide deck.
Actionable: schedule provocative, real-world keynote sessions quarterly. Follow up with team workshops that translate fear into policies and personal behaviors.
5. Enforce device and identity hygiene at the individual level
Authentication is your friend. Multi-factor is the baseline. Device management must be enforced: hardware-backed keys, device attestation, secure boot on corporate devices, and strict separation policies for bring-your-own-device (BYOD). Don’t offer a vague “we trust you” policy. Enforceable saves lives.
Actionable: require hardware MFA for privileged access, and roll out an MDM policy that segments corporate data from personal apps.
6. Integrate mental models with incentives
Humans respond to incentives. Reward secure behavior. Penalize risky behavior only when deliberate or reckless (not when someone is simply uninformed). Use leaderboards for teams, not public shaming. Tie secure behavior to performance metrics and recognition.
Actionable: give small rewards for reporting phishing, rapid patch compliance, and participation in secure design reviews.
What employees must do (and why it matters)
Be suspicious by default
Trust is a liability when you’re online. Verify requests for actions, especially financial or sensitive ones, by a secondary channel. Train yourself to check indicators beyond display names and logos: sender metadata, URL hostnames, and unusual timing or urgency.
Protect your physical and digital identity
Treat your credentials like implanted hardware, because in a sense, they are. Use separate accounts for personal and work, enable hardware MFA, and don’t reuse passwords. Watch for shoulder surfers and beware of public charging stations. Your body is an endpoint as well.
Report, don’t hide
If you clicked, report it immediately. Speed matters more than pride. Fast containment saves reputations and livelihoods.
Threat modeling: the human edition
Threat modeling must answer questions beyond code:
- Who has the power to move money, change payroll, or access PII?
- Who is likely to be targeted for personal manipulation (HR, executive assistants, finance)?
- What external signals (social media posts, conference schedules) reveal opportunities?
- How do work-from-home patterns change trust boundaries?
Model the day-in-the-life of employees: calendar invites that look legitimate, fake contractors offering urgent help, pretexting via SMS after hours. If you don’t model that, you’re modeling nothing.
Offensive testing — ethical, relentless, measurable
I’m blunt: if your defenders aren’t regularly losing to simulated attackers, they aren’t being tested hard enough. A good red team doesn’t just find bugs; it finds broken assumptions and lazy human processes. After a test, hand over not just technical fixes but playbooks for how to detect and respond to the same social vectors.
Do not: release attack crafting details to non-security staff. Teach detection and response, not exploitation techniques.
Training & culture: beyond the checkbox
Training works when it’s continuous, contextual, and non-punitive. Mix modalities: microlearning pushed to mobile, live table-top sessions, immersive simulations (voice phishing, physical tailgating), and leadership Q&As. Make security a visible leadership priority, when the CEO rolls up sleeves and attends training, the rest follow.
Include personal stories. The best wake-up calls are human: a tale of an attacker who used empathy to get access, or of an employee who stopped a breach because they asked one question. Stories stick where policy memos don’t.
Examples:
- The Conference Pretext: A “vendor” befriends an admin at a conference, offers a USB drive with slides, and later uses credentials gleaned from casual chat. The fix: never accept storage devices, verify vendor identity through procurement channels, and limit admin access when traveling.
- The Payroll Ruse: An attacker targets HR with a fake legal subpoena that appears urgent. The fix: verification workflows, second-channel confirmations, and a legal vetting process that includes contactable phone numbers.
- The Implanted Key (metaphor, not blueprint): You’re more than your laptop. Your badge, your home router, your social posts — they’re all keys. Secure each as you would a private implant: with attention, maintenance, and hardware-based protections.
Roadmap for implementation (90/180/365 day plan)
First 90 days
- Map human risk vectors and run a tabletop for executive-level social attacks.
- Deploy mandatory hardware MFA for privileged roles.
- Launch baseline phishing campaign with microlearning follow-ups.
Next 180 days
- Engage a red team for combined social/technical assessment.
- Roll out role-specific secure workflows for finance, HR, and IT.
- Begin quarterly external speaker series and internal story-driven sessions.
By 365 days
- Institutionalize secure behavior metrics into performance reviews.
- Mature detection capabilities to identify social-engineering indicators.
- Repeat testing cycle; adapt threat models with real incident data.
Final word: The hard truth
You can buy armor, but humans still bleed. The companies that win in the next decade will be the ones that treat people not as liabilities to be lectured, but as endpoints to be hardened, cognitively, procedurally, and culturally. This requires ugly conversations, loud leaders, and real practice under pressure.
If you want me in the room, I’ll tell the stories that make people flinch, because when they flinch, they learn. When they learn, they change. And when they change, a breach becomes a near miss instead of a headline.
Security is a human problem. Solve that, and you win.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat and ex-1% motorcycle club member with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.