The Human Factor in Digital Risk, Kate Brett Goldman, CEO & Founder, Cybermaniacs

### Overview In this talk presented at CornCon, Kate Goldman (CEO & Founder of Cybermaniacs) discusses the evolving landscape of digital risk and human risk management within organizations. She critiques the traditional framing of employees as "the human firewall" or "the weakest link," arguing instead that human risk must be treated as an inherent part of organizational architecture and measured through behavioral science and organizational anthropology. With shifting regulatory expectations and increasing board-level liability, she highlights the urgent necessity to patch the "human operating system" rather than relying on ineffective annual compliance training.

### Key Topics - **Cyber Risk as Business and Digital Risk**: Referencing Jen Easterly's congressional testimony, Goldman points out the macro-level strategic transition recognizing that cyber risk is fundamental business risk. Any disruption in people, process, or technology introduces digital risk. - **Regulatory Pressures and Board Liability**: Citing the Cyber Safety Review Board’s report on Microsoft—which explicitly called Microsoft's security culture "inadequate and requires a complete overhaul"—and new SEC disclosure and oversight rules, Goldman emphasizes that boards are becoming personally and professionally liable for cybersecurity due diligence and risk governance. - **The Budget and Incident Disparity**: Despite Verizon data breach report figures showing 68% to 87% of security incidents originating from a human cause over the last decade, organizations spend only roughly 2% ($4.5 billion of an estimated $220 billion total cybersecurity spend) addressing the human layer. - **Critique of the "Human Firewall"**: Expecting regular employees to serve as defensive firewalls against sophisticated cyber adversaries is unrealistic. Employees are natural endpoints who are placed into inherently risky contexts with powerful technology without proper preparation or scoping.

### Technical Details - **Human Factor Taxonomy**: Goldman defines human-factored digital risk as any action or inaction related to data, information, or technology by a human that directly or indirectly causes or risks harm. She categorizes human factors based on the direction of intention: - *Unintentional*: Mistakes, lapses, slips, lack of alignment, missing onboarding, or unaddressed tool navigation gaps. - *Intentional*: Policy violations, malicious insider actions, fraud, sabotage, theft, and vandalism. - **Anthropological Measurement Framework**: Borrowing concepts from industrial and airline safety (such as root cause analysis discussed in Charles Perrow's *Normal Accidents*), Goldman outlines three core organizational dimensions to assess: - *Structure*: Evaluating whether decision-making and organization are flat/horizontal or vertical/hierarchical. - *Adaptability*: Measuring the organization's agility, responsiveness to change, or risk aversion. - *Interdependence*: Assessing collectivism versus individualism in incentives and teamwork. - **Enabling Cultural Factors**: A mature culture requires leadership prioritization, appropriate resources, group cohesion (notably in mergers and acquisitions), psychological safety to report issues without fear of reprisal, and individual locus of control (fostering personal agency over fatalism). - **Pitfalls and Dysfunction**: Goldman identifies common cultural blockers to remediation, such as unclear risk tolerance from executive management, fear of delivering bad news, apathy, and overconfidence in IT/security teams.

### Takeaways - Stop blaming humans as the weakest link; instead, objectively measure and scan for vulnerabilities in the human operating system using behavioral science. - Build an empowered safety culture characterized by collective risk responsibility, concordance (employee engagement/caring), and high responsiveness/resilience. - Align cybersecurity oversight with clear corporate risk tolerance, moving beyond surface-level self-attestation checklists and superficial awareness metrics toward rigorous, top-down and bottom-up cultural assessment.