The Click Was Never the Real Failure
Jeni and I were discussing cybersecurity with a client recently when she recalled something that happened at DWM. Our business manager clicked a malicious link as she was heading out the door at the end of the day. She had twenty five years in the industry and was as sharp as anyone Jeni had worked with. She knew immediately what had happened and told someone within minutes. That detail matters. This was not someone who had never encountered a phishing email, or a junior employee finding their feet. It was an experienced person having an ordinary human moment: tired, rushing, and thinking about getting home. There is something reassuring about a cybersecurity story with an obvious villain. Someone was careless, someone should have known better, and someone needs more training. It gives us a neat explanation and an apparently straightforward fix: tell people to pay more attention, send another awareness email, and carry on. Except the underlying problem has not necessarily changed. If the business is still relying on a person noticing every suspicious message, every time, then the same vulnerability remains. We have just expressed our disappointment more clearly.
Nick Clift
8/31/20262 min read
Jeni and I were discussing cybersecurity with a client recently when she recalled something that happened at DWM. Our business manager clicked a malicious link as she was heading out the door at the end of the day. She had twenty five years in the industry and was as sharp as anyone Jeni had worked with.
She knew immediately what had happened and told someone within minutes. That detail matters. This was not someone who had never encountered a phishing email, or a junior employee finding their feet. It was an experienced person having an ordinary human moment: tired, rushing, and thinking about getting home.
There is something reassuring about a cybersecurity story with an obvious villain. Someone was careless, someone should have known better, and someone needs more training. It gives us a neat explanation and an apparently straightforward fix: tell people to pay more attention, send another awareness email, and carry on.
Except the underlying problem has not necessarily changed. If the business is still relying on a person noticing every suspicious message, every time, then the same vulnerability remains. We have just expressed our disappointment more clearly.
People do not become a reliable security control simply because we have reminded them to concentrate. They still get tired, juggle competing priorities, and make mistakes while doing work they understand perfectly well.
Awareness training belongs in a sensible cybersecurity approach. People need to understand the risks and know what to do when something does not look right. But training cannot carry the whole plan. A more useful question is what happens when somebody clicks despite the training.
What has already filtered the email before it reaches them? What limits access if credentials are compromised, and what helps someone notice that something unusual is happening? Then there is recovery. A plan that has been written is a start; a plan that has been tested gives the business a different level of understanding.
Layers matter because no individual layer should have to be perfect. Email filtering, MFA, monitoring, and tested recovery all have a part to play. The aim is not to pretend a click will never happen, but to avoid making that click the moment on which the whole business depends.
Our business manager reported what had happened quickly. It would be easy to skip past that part of the story and focus entirely on the mistake, but I think that would miss something important. When something goes wrong, we want people to speak up while there is still an opportunity to respond.
If reporting a mistake becomes an invitation to public embarrassment, we should not be surprised when the next person hesitates. Accountability matters, and so does creating an environment where people can tell the truth about what happened. Those things are not opposites.
This connects to my role at Morphability and the conversations I have about operational maturity. Mature operations account for the reality of the people doing the work, rather than depending on ideal behaviour. If a process only works when everyone is perfectly attentive, it may be time to look at the process.
As MSPs, we can help clients move beyond “How do we make our staff stop making mistakes?” and ask, “How do we protect the business when a mistake happens?” That is a more realistic question, and a more useful one.
The click was not evidence that an experienced person suddenly stopped caring. It was evidence that experience does not remove the need for protection around the person. If your cyber plan still rests heavily on “just be careful”, perhaps it is time to talk about what is doing the protecting when careful is not quite enough.