A large part of security practice asks employees to remember instructions and behave correctly under time pressure. This pillar studies what happens when that expectation is replaced with technical arrangements that make the safe action the default.
The working principle
If a control depends on somebody remembering a training slide from six months ago, assume it eventually fails, and design accordingly. Training remains useful where human judgment is genuinely unavoidable. It should not be the primary control where technology can prevent or detect the failure.
The problem is in the design. Blaming the person who clicked fixes nothing because someone else will click next time.
The left side asks a person to remember the safe action under pressure. The right side makes that action the system default.
Substitutes for memory
Each moves a remembered task into the system. They will not help equally, so the effect of each still needs to be measured.
- Phishing-resistant authentication
-
Hardware-backed and origin-bound credentials remove the class of failure where a convincing page collects a code. This is the clearest example of design beating vigilance.
- Just-in-time and least privilege
-
Access that exists only while it is needed shrinks the blast radius of any single compromise without asking anyone to remember to log out of an admin role.
- Automatic credential and secret detection
-
Scanning and revocation paths that assume secrets will be committed, pasted, and logged, because they will be.
- Fail-closed defaults
-
Systems that stop rather than continue when a check cannot be completed, with an explicit approval path for the exception.
- Risk-based authentication and session revocation
-
Re-verification and automatic session termination triggered by observed conditions rather than by a user decision.
- Allowlisting and sandboxing
-
Constraining what can execute and where attachments open, so a mistaken action has a bounded consequence.
Behaviour is measurable, attendance is not
Training completion rates are an attendance record. The measurable alternatives are behavioural: reporting rate for suspicious messages, time from receipt to report, credential submission rate under simulation, and the share of staff for whom a successful phish would produce no usable credential at all.
The last of those is the most interesting, because it is a property of the authentication design rather than of the people.
What would prove us wrong?
The pillar claims that training alone provides limited resilience without technical controls.
-
Evidence that a specific training approach materially and durably reduces successful attacks in organisations with comparable technical controls.
-
Results where removing memory-dependent controls produced complacency that raised exposure elsewhere.
-
Data showing that phishing-resistant authentication shifts attackers to paths that are more damaging rather than less, leaving total loss unchanged.