For more than two decades, businesses have invested substantially in security awareness programs aimed at transforming employees into a "human firewall." Nonetheless, phishing attacks, credential theft, and social engineering continue to occur at an alarming rate. If awareness training works, why do users continue to make the same security mistakes?

This session questions the human firewall notion and investigates whether the issue is not with users, but with how security programs are structured. Drawing on human factors research, behavioral psychology, and real-world cybersecurity examples, the session investigates how cognitive overload, time constraints, decision fatigue, and conflicting workplace objectives influence security-related choices.

Rather than expecting faultless behavior from fallible individuals, attendees will discover how organizations can create security systems, procedures, and cultures that can withstand human error. The presentation provides a realistic, human-centered approach to cybersecurity that goes beyond blame and awareness metrics to design security around how people think, work, and behave.

Whether you are a security practitioner, management, developer, or researcher, this presentation will challenge long-held assumptions and deliver actionable insights into developing more effective and realistic security tactics.