Cybersecurity’s Blind Spot: Why Human Behavior is Every CISO’s Business

When a major breach makes headlines, the impact ripples far beyond the individuals whose data has been compromised. It shakes consumer trust, triggers urgent internal questions from staff, and lands squarely on the shoulders of the CISO.  And although cybersecurity leaders have long been focused on preventing and responding to attacks, the missing piece in many programs isn’t technological. It’s behavioral.

We have reached a pivotal moment in the data security conversation. Despite record-breaking investments in cybersecurity tools, the most vulnerable part of the equation remains underprioritized – the human element.

So, what does that mean for the modern CISO?

It requires shifting some of the focus from firewalls and frameworks to something less quantifiable but equally critical: a deep understanding of how people think, feel, and respond to risk.

Perception vs. Reality: The Consumer Confidence Gap

In April, we released the results of the Identity & Cybersecurity Concerns (ICC) Survey, a recent nationwide survey of U.S. adults, that revealed a telling contradiction. While 87 percent of people say they feel secure using internet-connected devices, nearly the same percentage – 85 percent – are also worried about being hacked, and 88 percent are concerned about password compromises.

This disconnect is more than just cognitive dissonance. It’s a signal to cybersecurity leaders that traditional security awareness efforts are not resonating. Despite widespread messaging around strong passwords and cyber hygiene, only three in ten respondents said they follow all recommended data protection practices. In other words, consumers may feel confident, but most are not taking important personal steps that could significantly strengthen their protection.

This gap presents both a challenge and an opportunity for CISOs. The challenge is that many security programs are built on the assumption that users will act rationally and consistently follow best practices. In reality, evidence shows that this is rarely the case. This misalignment weakens even the most sophisticated of defenses – and highlights a need for a more human-centric approach to cybersecurity.

And herein lies the opportunity. CISOs can reassess how they evaluate their security programs and deliver cybersecurity. Are those programs designed primarily to protect systems, or to support the people who rely on them? This means going beyond technical controls and compliance checklists to consider the lived experience of users, how they perceive risk, what drives their decisions, and where they encounter friction or confusion.

The Human Behavior Challenge

The issue is not a lack of concern on behalf of the consumer (or your users). The survey found that 91 percent are worried about the use of artificial intelligence in cyberattacks. More than half say they feel only somewhat secure while using their devices, suggesting that anxiety lingers beneath the surface. Despite this apprehension and the mounting threats to their identity, inaction abounds.

The reasons vary, from unclear guidance to alert fatigue, to the perception that cyber protection is too complex. These barriers to behavior change are often underestimated by cybersecurity teams who assume that logic and policy alone are enough to drive compliance. But security is not just a technical challenge; it’s a psychological one.

People do not always make rational decisions, especially when it comes to abstract or invisible threats like identity theft or account takeovers. They may acknowledge the risk but still reuse passwords. They may hear understand the gravity of a breach but do not take steps to monitor their accounts.

When organizational security programs fail to acknowledge how real people behave, even the strongest technological defenses can be weakened from within.

Indeed, as a CISO, it’s important to recognize that employees are people first, and their personal habits carry over into the workplace. That’s why the broader consumer data we’re discussing is more than just market insight; it’s a mirror of employee behavior and, by extension, organizational risk. Promoting secure habits in their personal life – like offering identity protection as an employee benefit – reinforces a culture of security that protects both the individual and the enterprise. What strengthens people, strengthens the organization.

The Emotional Toll of Breaches

Despite common narratives of increasing consumer apathy in the wake of repeated breaches, our survey results tell a different story. A staggering 94% of respondents said they would be concerned if they received a notification that their sensitive information was involved in a data breach, with 75% saying they’d be extremely or very concerned.

This matters – a lot. Consumers aren’t tuning out, and they care greatly about their personal security. Breaches still trigger strong emotional reactions.

As a CISO, it’s important not to view breaches as an unfortunate setback; they are experienced as deeply personal violations, and they can either rebuild or permanently fracture trust. CISOs must recognize the emotional toll behind the breach and design their strategies accordingly. Technical remediation must be paired with empathetic communication, clear next steps, and real support to help people feel safe again. In short, organizations that treat breach response as a human experience (and not just a technical exercise) will be the ones who preserve loyalty in the long term.

What CISOs Can Do Differently

There is no one-size-fits-all solution, but there are ways to begin building a more human-centered cybersecurity strategy. Here are a few ideas:

• Reframe security education around emotion, not just logic. People are more likely to remember and act on stories than statistics. Tie guidance to real-life scenarios and outcomes.
• Treat post-incident response like customer service. Go beyond technical containment. Make it easy to understand and be emotionally supportive.
• Focus on moments of vulnerability. Identify when customers are most exposed and proactively offer protection and guidance.
• Measure the human experience. Track not just technical recovery, but how users feel, how long their recovery takes, and whether they are likely to trust the organization again.

A Human-Centered Future for Security

CISOs are not only responsible for defending infrastructure. They are also responsible for safeguarding the human experience that lives within it. The future of cybersecurity depends not just on smarter tools, but on more empathetic strategies.

Protecting people means understanding how they behave, how they feel, and how they respond when things go wrong. Closing the experience gap is not just good practice; it is essential leadership.

About the Author

As CEO of Global Identity and Cyber Protection Services at Iris® Powered by Generali (the Company), Paige Schaffer leads sales & marketing strategy and revenue growth initiatives, managing operations as well global expansion. Leveraging her subject matter expertise of 15+ years in identity & cyber protection and restoration services, particularly as they apply to B2B2C software-as-a service, she was the visionary behind the behind the creation and evolution of Iris’ innovative identity & cyber protection services. Under her guidance, Iris has secured multiple multimillion-dollar contracts with Fortune 500 companies, and Ms. Schaffer has directly sold new business and negotiated extended contract lengths, thereby maximizing revenue streams for the Company. Iris Powered by Generali’s website https://www.irisidentityprotection.com/