Keynote Presentation Blinded by “the weakest link” A New Perspective on Human Risk
summary
Claim: human risk is the largest unsolved security problem and is measurable using existing logs and behavioral signals rather than generic training. Past phishing clicks predict future clicks (Dr. Caputo 2015), and a Georgia Tech / Facebook experiment shows 1.36× MFA uptake when peers are shown using it. Practical fixes: deploy password managers, add a one‑click reporting button, score people by role plus likelihood, and use social proof, gamification and positive reinforcement. Elevate Security is an example platform that ties these measurements to interventions.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 6:10Mashas Background
- 8:08Human Risk
- 15:03Awareness vs Action
- 15:53What is Human Risk
- 17:58The Story of Clara
- 20:48The Human Risk
- 23:18When it goes well
- 26:18How do we affect change
- 27:48Measuring human risk
- 31:03Can we answer today
- 32:03Past predictors
- 36:18Impact vs likelihood
- 38:18Corporate Executive Board study
- 40:03Security Force Survey
- 41:48How to get people to make more thoughtful security decisions
- 48:43Social proof
- 53:18Gamification
- 58:14Positive Reinforcement
related talks
26mThe Risky Business of Risk Illiteracy (Sean Juroviesky)
40mLeveraging Human Risk Data to Strengthen Cyber Resiliency
41mHuman Vulnerability Management and Assessment in the Age of Zero Trust
27mBlunting the Phisher's Spear: A Risk-Based Approach...
33mDefending the human network
30mSurfing the Motivation Wave to Create Security Behavior Change
51mSecurity's Holy Grail: Predicting Attacks Before They Happen
53mRisk Profiles: Why Some Employees Attract Danger and Others Dodge It