Briefing
The Human Firewall was never real
How attackers exploit psychological triggers, why security awareness training keeps failing, and what to do about it. Written by Jayson E. Street, who has walked into banks and government facilities on five continents without getting stopped.
Why the triggers attackers use are features of human behavior, not bugs
Three field cases, and what each taught about how people actually get breached
Why scope-limited, point-in-time social engineering tests mislead
The three Es framework: education, empowerment and enforcement
Free download
Not once through a technical exploit.
In more than two decades of breaking into banks, insurers, hospitals and government facilities, Jayson E. Street has never once succeeded because of a technical exploit. Every breach came down to understanding how the human mind works when the person being targeted didn’t.
He has got in while staff were running up-to-date awareness programs and had passed phishing simulations the month before. If your program relies on click rates as proof of resilience, that’s the gap to take to your next security review.
This paper explains the psychological triggers attackers exploit, why awareness training and scope-limited testing keep failing, and the three-part approach that actually changes behavior.
A firewall follows rules. People don’t.
A firewall doesn’t get tired, feel guilty or want to be helpful. People do, and the subconscious runs most of their day. Attackers rely less on fear than on comfort, reciprocity and the wish to be useful.
These triggers are how human cooperation works, so you can’t train them out. You can teach people to recognize when they’re being triggered on purpose.
Training that only works at a desk doesn’t transfer.
Most awareness training teaches a short list of warning signs in work-specific contexts. The instinct that spots a phishing email doesn’t carry over to a stranger standing at your desk.
Teaching situational awareness through real-world scams people could face personally builds instincts that travel with them into the office.
The test is never the goal.
A point-in-time test tells you whether you were vulnerable to specific techniques on a specific day, and the results rarely reach the executives who make the decisions.
In one engagement, an organization that had once let a tester walk its floors unchallenged caught him in every section a year later. Leadership had explained why the policy mattered and given staff permission to be wrong.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security programme
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.