Human-Centred Cybersecurity: What Does It Actually Mean?

There is a familiar expression in cybersecurity that has become so widely accepted it is rarely questioned: humans are the weakest link. It appears in conference presentations, security awareness campaigns and discussions about the latest data breaches, usually accompanied by examples of employees clicking suspicious links, choosing weak passwords or inadvertently exposing sensitive information.

The implication is that technology is generally reliable, while the people using it are unpredictable and prone to mistakes. Consequently, much of the industry's response has focused on changing human behaviour through training, warnings, policies and increasingly restrictive security controls. Yet this way of thinking overlooks an uncomfortable possibility: perhaps some of the problems attributed to human error are actually failures in how security systems have been designed.

Consider an employee who must navigate several authentication processes before beginning their working day, a small business owner confronted with a security dashboard full of unfamiliar terminology, or a customer who cannot access their bank account because the verification process assumes they own a particular type of smartphone. These are not necessarily examples of people refusing to take security seriously. They may be examples of security technology that has been developed without sufficient understanding of the circumstances in which people are expected to use it.

This is where human-centred design becomes important. Although the term is increasingly used across the technology industry, its meaning is often reduced to making products easier to navigate or interfaces more visually appealing. In reality, it represents a much more substantial change in how organisations approach the development and delivery of technology, requiring them to understand the needs, abilities, limitations and working environments of the people who will ultimately depend on their products.

For cybersecurity businesses, that change has implications extending well beyond product design. It influences how companies conduct research, develop security controls, engage with customers, measure effectiveness and ultimately determine whether their technology is achieving what it was intended to do.

What human-centred design really means

Human-centred design is not a new concept, nor is it something the cybersecurity industry needs to invent for itself. The principles have been established through decades of research into ergonomics, usability and the relationship between people and technology. The international standard ISO 9241-210 provides a framework for human-centred design, emphasising an understanding of users and their environments, their involvement throughout development, and the continuous evaluation and improvement of systems based on evidence.¹

Applied to cybersecurity, these principles challenge a common approach in which technical requirements are established first and the experience of the user is considered afterwards. A company might begin by identifying a security threat, developing a control to address it and then designing an interface through which customers are expected to operate that control. Human-centred design asks organisations to begin earlier, by understanding who those customers are, what they are trying to accomplish and the circumstances in which security decisions are made.²

The distinction matters because security is rarely the primary activity that most people are trying to perform. A nurse working in a hospital is focused on caring for patients, a small business owner is concerned with running a business, and an individual accessing an online banking service simply wants to manage their finances. Cybersecurity is essential to protecting those activities, but when security controls become unnecessarily complicated or disruptive, people may struggle to use them effectively or look for ways around them.

A human-centred approach does not suggest that security requirements should be weakened whenever they create inconvenience. Instead, it recognises that the effectiveness of a security control depends partly on whether people can realistically follow it. A technically sophisticated system that repeatedly produces confusion, exclusion or insecure workarounds may be less effective in practice than its specifications suggest.

It is also important to distinguish between designing technology for people and designing it with them. Cybersecurity companies often employ talented designers, engineers and researchers who make decisions based on their understanding of customer needs. However, professional expertise is not a substitute for involving the people who will actually use a product, particularly when those people have different experiences, abilities or working conditions from the teams developing it.

A company designing a security platform for small businesses, for example, might assume that customers want comprehensive dashboards, detailed technical reports and extensive configuration options. Yet conversations with small business owners could reveal that many simply want to understand whether their organisation is protected, which problems require attention and what action they should take. The difference between those assumptions can fundamentally change the direction of product development.

Meaningful participation therefore needs to begin before the most important decisions have already been made. It should continue through prototyping, testing, deployment and subsequent updates, with organisations prepared to change their original assumptions when the evidence suggests they were wrong.

When technically secure becomes practically unusable

The relationship between usability and security is particularly visible in authentication, where the industry has made significant technical progress but implementation can still create considerable difficulties for users.

Multi-factor authentication is widely recognised as an important protection against account compromise, and phishing-resistant authentication methods offer stronger safeguards against certain forms of attack.³ However, the experience of using these systems can vary enormously depending on how they are introduced, explained and supported.

An organisation might implement a technically sound authentication process while overlooking employees who do not have company-issued smartphones, customers who struggle with particular accessibility requirements or people who need to recover access after losing a device. If these situations have not been considered during development, the result may be an increase in support requests, frustrated users and attempts to bypass the intended process.

The same challenge appears in security warnings, which are frequently designed around the assumption that presenting information is sufficient to influence behaviour. In practice, people encounter numerous notifications, alerts and requests for confirmation throughout the day. Research into warning fatigue has demonstrated that repeated or poorly designed warnings can lose their effectiveness as users become accustomed to dismissing them.⁶

For cybersecurity companies, this raises questions about what their products are actually achieving. An organisation might report that a warning appeared on screen, an authentication control was enabled or a security policy was accepted, but none of those measurements necessarily establishes whether the user understood the information or was able to respond appropriately.

Human-centred design encourages companies to examine what happens beyond the technical implementation. Can users distinguish important warnings from routine notifications? Do they understand the consequences of the choices presented to them? Can they recover from mistakes without creating additional security risks? Most importantly, does the system support the behaviour it is intended to encourage?

These questions are not peripheral to cybersecurity. They are directly related to whether security controls provide effective protection in real-world conditions.

Turning the principle into business practice

For cybersecurity businesses interested in adopting human-centred design, the first practical change is to make user research a meaningful part of product development rather than an occasional exercise undertaken to validate decisions that have already been made.

This begins with identifying the people who will interact with a product, including those whose needs may not be immediately obvious. A security service purchased by an IT director may ultimately be used by employees across several departments, each with different responsibilities and levels of technical confidence. Similarly, a product designed for consumers may be used by older adults, people with disabilities or households in which devices are shared between family members.

Understanding these differences requires more than collecting customer satisfaction scores or asking users whether they like a particular interface. Businesses need to observe how people complete tasks, identify where difficulties occur and understand the practical pressures that influence their decisions. Interviews, usability testing, field observations and participatory workshops can all contribute to this process, provided the findings are allowed to influence the design itself.

The next step is to reconsider how products are evaluated. Cybersecurity companies understandably invest considerable effort in measuring technical performance, including detection rates, response times and the effectiveness of protective controls. Those measurements remain essential, but they should be accompanied by evidence of how successfully people can use the technology.

For example, a business might examine whether customers can correctly interpret an alert, how long it takes them to complete a security task, how frequently they require assistance and whether particular processes encourage insecure workarounds. Testing should also include realistic scenarios rather than relying exclusively on controlled demonstrations in which participants already know what they are expected to do.

Accessibility deserves particular attention because it is frequently treated as a separate compliance requirement rather than an integral part of security design. Authentication processes, account recovery procedures, notifications and support channels must be usable by people with different physical, sensory and cognitive abilities. A system that prevents legitimate users from accessing essential services is not demonstrating effective security simply because it has successfully restricted access.

Established guidance, including the Web Content Accessibility Guidelines, provides a useful foundation,⁴ but businesses should also involve people with disabilities in testing and evaluation. Meeting a technical accessibility standard is valuable, although it cannot replace understanding how a service performs for people in practice.

Another important consideration is the relationship between cybersecurity vendors and the organisations purchasing their products. Human-centred design should not end when a product is sold, because deployment introduces a new set of circumstances that may differ substantially from those anticipated during development. Businesses should therefore establish ways to gather feedback from customers after implementation, identify recurring difficulties and incorporate that information into future improvements.

This may require changes to internal incentives. Product teams are often rewarded for delivering new features, meeting release schedules and increasing sales, while the benefits of reducing complexity or improving usability can be harder to demonstrate. If human-centred design is to become more than a marketing phrase, organisations need to recognise these activities as meaningful contributions to product quality and business performance.

The commercial case for putting people at the centre

There is a tendency to present human-centred design primarily as an ethical responsibility, and there are good reasons for doing so. Technology companies have a responsibility to consider the consequences of the systems they develop, particularly when those systems influence access to essential services or the protection of sensitive information.

However, there is also a commercial argument that cybersecurity businesses should take seriously. Products that customers struggle to understand may require extensive support, encounter resistance during deployment or fail to deliver their intended value. Complicated configuration processes can increase implementation costs, while unclear alerts and poorly designed workflows can consume time that customers would otherwise spend on their core activities.

A company that understands these difficulties has opportunities to improve its products and differentiate itself in an increasingly competitive market. Rather than competing exclusively on the number of features offered or the sophistication of underlying technology, businesses can demonstrate that their products are effective in the environments where customers actually use them.

That distinction is particularly relevant to small and medium-sized enterprises, many of which do not have dedicated cybersecurity teams. A technically advanced product may offer limited practical value if its operation requires expertise that the customer does not possess. Designing around those realities can help vendors develop services that are easier to deploy, understand and maintain without compromising the protections they provide.

There is also a question of trust. Customers are increasingly asked to rely on cybersecurity providers to protect important parts of their businesses and personal lives, yet they may have limited visibility into how products are developed or why particular design decisions have been made. Companies that can demonstrate meaningful user involvement, transparent testing and a willingness to respond to feedback have an opportunity to establish credibility through evidence rather than broad claims about being customer-focused.

Of course, human-centred design does not guarantee commercial success, and user preferences cannot be the sole basis for every security decision. Businesses must still account for technical constraints, regulatory obligations, threat intelligence and risks that users may not fully understand. The value of the approach lies in bringing those considerations together rather than allowing any single perspective to determine the outcome.

Moving beyond the weakest link

Perhaps the most significant change required is cultural rather than technical. The cybersecurity industry has spent years encouraging organisations to improve human behaviour, often through awareness campaigns that emphasise the consequences of mistakes. While education remains important, treating people primarily as a source of risk can obscure the responsibility of organisations to design systems that account for predictable human behaviour.

When employees repeatedly struggle with a security process, the response should not automatically be another training session. Businesses should also investigate whether the instructions are understandable, whether the task is unnecessarily complicated and whether the process fits the conditions in which people are expected to complete it.

This does not remove individual responsibility or suggest that every security failure can be attributed to poor design. People make mistakes, and attackers deliberately exploit trust, urgency and distraction. Nevertheless, those realities are precisely why security systems should be developed with an understanding of how people behave, rather than an expectation that users will always respond as designers intended.

The principle is closely related to the wider movement towards secure-by-design technology, which encourages manufacturers to take greater responsibility for the security of their products rather than transferring the burden to customers.⁵ Human-centred design complements that approach by asking whether the protections being developed are practical, accessible and effective for the people who depend on them.

For businesses, putting these ideas into practice requires more than appointing a user experience specialist or introducing a new design framework. It means giving users a meaningful role in development, recognising usability and accessibility as security considerations, and being prepared to reconsider products when evidence shows that they are not working as intended.

A different question for the industry

Cybersecurity has developed into a sophisticated global industry, supported by extraordinary advances in research, engineering and threat detection. Yet as technology becomes more complex, the distance between those who build security systems and those expected to use them can become increasingly difficult to bridge.

Human-centred design offers a way to address that distance, provided the industry is willing to treat it as a genuine change in practice rather than another phrase to include in product descriptions and conference presentations.

For cybersecurity businesses, the challenge is not simply to make existing products more attractive or easier to navigate. It is to understand the people affected by their technology, involve them in decisions, and measure success through the protection those systems actually provide in everyday circumstances.

That requires businesses to recognise that technical expertise, however important, does not automatically provide an understanding of every environment in which a product will be used. It also requires accepting that some of the most valuable improvements may come from listening to people who know very little about cybersecurity but understand perfectly well the challenges they encounter when trying to use it.

The industry has become remarkably effective at identifying vulnerabilities in software, networks and infrastructure. Applying the same level of attention to the assumptions behind its own products could prove equally valuable.

Ultimately, human-centred cybersecurity is not about choosing between people and technology. It is about recognising that the effectiveness of one depends on understanding the other.

And perhaps the most useful question a cybersecurity company can ask is not simply whether its technology is capable of protecting people, but whether those people have had a meaningful say in how that protection is designed.