Human Decision Making As A Security Risk

Most security controls assume a human will eventually make a reasonable choice. This remains an active area of research.

Notwerking mitigates human decision risk through training, reminders, access reviews and Si Ber appearing silently in doorways.

Human decision making remains essential to modern security programmes because fully automated systems still require someone to approve the exception, ignore the warning or click the link in the first place.

Common risk indicators include:

• Urgent requests containing the word “quickly”
• Attachments named final-final-approved-latest
• Access reviews completed during meetings
• Password resets requested immediately after policy training
• Users describing production as “probably fine”

Recommended mitigations include clear escalation paths, least-privilege access, visible audit trails and security controls that do not rely entirely on someone remembering a slide from onboarding.

Where human judgement is unavoidable, Notwerking recommends pairing it with logging, peer review and a delay long enough for Si Ber to ask why.