One of my friends, Greg van der Gaast, tells this great story that perfectly illustrates one of the biggest challenges we face in cybersecurity today. It goes something like this...

"Imagine someone who loves coffee. They have a fantastic coffee shop just steps from their home, serving the best lattes and espressos in town. But instead of strolling over to enjoy this local gem, they hop in their car and drive miles away for an average cup from a chain café. Why? Not because the coffee is better, but because they love cars and driving so much more—it’s their joy, their comfort zone, and safe space."

This simple analogy speaks volumes about how cybersecurity operates today. Instead of focusing on accessible, impactful solutions like cybersecurity human risk management (CHRM), we gravitate toward shiny new technologies: tools and systems that feel exciting, measurable, and comfortably within our domain of expertise. While these technological investments are valuable, they’re not enough to solve the fundamental problem – most cyber risks come from humans! Much like driving to a chain café, this approach might feel familiar, but it often delivers underwhelming results.

To achieve true resilience in cybersecurity, we need to break out of this tech-first mindset. Greg’s coffee story pushes us to think differently. It’s not about the excitement of the drive or the allure of the car but about returning to what truly delivers value: the human side of cybersecurity. Leadership, culture, and CHRM need to become the core focus if we’re to build a sustainable and secure framework for the future.

Cybersecurity professionals, like Greg’s car-loving coffee enthusiast, often find comfort in technology. Tools like Generative AI, advanced encryption systems, quantum computing, and automated threat detection are thrilling to evaluate, offering dashboards full of data and the tantalizing promise of cutting-edge solutions. Technology feels tangible, and it gives us a sense of control in a rapidly evolving threat landscape.

But just like the coffee drinker who bypasses their local shop, our focus on technology often distracts us from what’s most important. The hard truth is that technology alone can’t fix the root causes of cyber risk. Whether it’s a mis-click on a phishing email, poor password management, acting on a deepfake, or a misconfiguration, human error accounts for most breaches.

These are challenges that require more than just a flashy new tool to overcome. They require addressing the people behind the processes.

Greg’s analogy has a direct lesson for us in cybersecurity: just as the best coffee is right outside the door in his scenario, the most impactful cybersecurity solution for organizations is already available to them - it’s their people! When we invest in cybersecurity human risk management, we build stronger foundations that improve resilience across the board.

Here’s how human-centered strategies can transform cybersecurity:

Strong leadership is the foundation for a successful cybersecurity strategy. Leaders must set the tone, providing vision, fostering accountability, and - as Greg might put it - ensuring we "park the car and start walking toward what really matters." A leadership culture that emphasizes psychological safety enables teams to ask questions, admit mistakes, and innovate confidently. Without such commitment at the leadership level, it’s impossible to truly address deeper, human-related cybersecurity risks.

Leadership sets the tone, but organizational culture turns cybersecurity into a collective habit. A strong culture integrates security into the organization’s DNA, helping everyone from entry-level employees to executives become active participants in defense.

The problem is that many organizations treat culture-building as an afterthought. They rely on compliance-driven security awareness training that barely scratches the surface. A meaningful security culture is only possible through engagement, diversity, and collaboration. When everyone in an organization feels responsible for cybersecurity, its security posture improves exponentially.

Another reason we focus on technology is that it feels like the straightforward answer to overwhelming complexity. Hundreds of dashboards, endless alerts, and a flood of metrics, however, create decision paralysis within cybersecurity teams. Paradoxically, tools that are implemented with the intention of providing simple solutions to complex problems often end up further complicating them.

A human-focused approach to cybersecurity human risk management emphasizes clarity and focus. Fewer, more targeted metrics allow teams to home in on what truly matters, empowering them to act decisively without being overwhelmed by noise. By simplifying processes, we can improve outcomes while reducing stress on cybersecurity professionals.

Technology absolutely has a role in cybersecurity, but it should amplify human efforts, not serve as a substitute for them. When we start with a foundation of leadership, culture, and people-focused processes, technology becomes exponentially more effective. It’s the complement, not the crutch.

Greg’s coffee lover isn’t making the best choice - they’re operating inside their comfort zone. Similarly, cybersecurity professionals often stay in the familiar realm of tech solutions, avoiding the more challenging territory of human risk management. But real change happens only when we address these foundational issues. By investing in people-first strategies, organizations can finally achieve the resilience they’ve long been chasing through technology alone.

It’s time to ask ourselves a hard question. Are we driving miles for an average cup of coffee, or are we ready to step outside our comfort zone and grab the great one waiting on our doorstep?

The strongest cybersecurity strategies don’t rely on the latest tools. They depend on the strongest foundations - leadership, culture, and people. If you’re still stuck in the tech-comfort zone, now is the time to step into a new way of thinking.

Greg’s story reminds us that better results are closer than we think. Walk to the coffee shop. Build a foundation around cybersecurity human risk management. And create a safer, more resilient future for your organization.

If you’re ready to shift your focus to people and put human risk management at the center of your cybersecurity strategy, we’re here to help.