Human risk management is reshaping public sector cyber resilience

At a glance

What this is: This whitepaper says public sector cyber resilience is being undermined by human-focused attacks, fragmented tooling and staffing strain.

Why it matters: It matters to IAM and security practitioners because human behaviour, authentication friction and visibility gaps now shape resilience as much as perimeter or endpoint controls.

Context

Public sector security teams are dealing with a governance problem as much as a threat problem: attacks increasingly target the human layer, while fragmented tooling and limited staffing make consistent response harder to sustain. In that environment, point controls can look strong on paper but still fail operationally.

The identity angle is direct. Phishing, credential theft and MFA fatigue exploit authentication trust, while visibility gaps make it harder to coordinate IAM, email security and access governance across agencies, schools and service providers. That is why human risk management is best understood as a resilience model, not just another awareness programme.

Key questions

Q: How should security teams reduce phishing risk in MFA without creating more user friction?

A: Use phishing-resistant authentication for the highest-risk access first, then phase out phishable factors such as SMS, email links, and push approvals. Bind access to a device or cryptographic key, and keep fallback paths tightly controlled. The goal is not zero friction at any cost. It is to move friction away from the attacker and toward the rare recovery case.

Q: Why does fragmentation create compliance risk in public sector security?

A: Fragmentation makes it harder to prove control because logs, policies, and access decisions sit in separate systems. Regulators and auditors need a coherent chain of evidence, not a manual reconstruction. When identity context is missing from the audit path, the organisation can detect events but struggle to demonstrate governance.

Q: What breaks when staffing shortages meet rising human-driven attacks?

A: Manual triage breaks first. Short-staffed teams cannot consistently investigate every suspicious login, message, or user report, so cases age out before they are contained. That is why public sector programmes need standardised response paths that reduce the number of handoffs and decisions analysts must make.

Q: How do IAM and email security work together against business email compromise?

A: IAM controls who can authenticate, while email security helps detect the social engineering that tries to drive that authentication or a fraudulent action. Together, they reduce the chance that a trusted user interaction becomes unauthorised access. Neither control works well in isolation when attackers target the human layer.

Technical breakdown

Why phishing, BEC and MFA fatigue defeat isolated controls

Phishing, business email compromise and MFA fatigue work because they exploit trust across multiple control layers, not because one setting is weak. A user can be tricked into approving access, handing over credentials, or acting on a fraudulent request even when perimeter and endpoint tools remain active. In public sector environments, the issue is compounded by high-volume communications and many semi-connected systems. The result is an attack path that moves from message to identity to action before traditional controls fully react.

Practical implication: treat authentication and user action as a single risk surface, not separate problems.

How tool sprawl creates blind spots in human risk management

Tool sprawl fragments the signals needed to see whether a person, mailbox or account is being manipulated. One product may catch a malicious message, another may record a suspicious login, and a third may flag policy exceptions, but if those signals do not converge, the organisation only sees fragments. Human risk management is essentially a correlation problem: it links behaviour, access and exposure so teams can prioritise the accounts and users most likely to be targeted next.

Practical implication: unify telemetry around users, mailboxes and authentication events so response can be risk-based.

Why staffing shortages turn resilience into an operating model issue

When teams are short-staffed, security failure often comes from process gaps rather than missing technology. Alerts pile up, investigations slow down, and compliance work competes with incident response. Public sector organisations therefore need controls that reduce manual handling and limit the number of places analysts must look. Human risk management fits this need when it standardises signals and response paths across email, identity and policy enforcement instead of adding another isolated dashboard.

Practical implication: design controls that reduce analyst workload and shorten triage paths across the identity stack.

Threat narrative

Attacker objective: The attacker wants trusted access that can be used for fraud, account abuse or broader compromise without triggering immediate detection.

1. Entry begins with phishing or social engineering that reaches users through email and related collaboration channels.
2. Credential theft or MFA fatigue then converts that interaction into authenticated access or a trusted action by the victim.
3. The attacker uses the resulting account access or false approval to move into business email compromise or other internal abuse.
4. Impact is theft, fraud, or operational disruption, with resilience weakened further when response is slowed by fragmented tooling.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Cisco Yanluowang breach 2022: A password synced to a personal Google account plus vishing and MFA fatigue opened Cisco's VPN; the attacker then abused machine accounts.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Human risk management is becoming a control plane for public sector resilience. The article reflects a reality we see across identity-heavy environments: the risk is no longer just whether a user clicks, but whether the organisation can detect, correlate and act on that click quickly enough. Public sector teams need to think in terms of behavioural exposure, not just awareness training. The practitioner conclusion is simple: resilience now depends on joining identity, email and response signals into one operating model.

Tool sprawl is now a governance failure, not only an efficiency problem. When phishing, login anomalies and policy exceptions sit in separate systems, teams cannot build a reliable picture of human risk. That gap matters because fragmented visibility creates delayed response and inconsistent accountability. The practitioner conclusion is to treat signal integration as a control objective, not a nice-to-have.

Staffing shortages expose the limits of control-by-exception. Public sector programmes often assume analysts can manually reconcile alerts, but that assumption breaks under volume and holiday coverage. Human risk management changes the governance question from 'what tools do we own?' to 'what decisions can we standardise and automate?' The practitioner conclusion is to reduce manual triage wherever identity-driven abuse is likely.

Identity trust is the real attack surface in public sector environments. Phishing and MFA fatigue are not simply social engineering issues; they are failures in how organisations validate that a request, approval or login is genuinely authorised. That makes the topic relevant to IAM and workforce identity as well as awareness. The practitioner conclusion is to align human-risk controls with authentication policy and access governance, not isolate them in security training.

Human risk management creates the named concept the sector needs: human-layer resilience. This is the idea that public sector cyber resilience depends on how well an organisation can absorb manipulation of people, credentials and approvals without losing operational continuity. The practical implication is that detection, access control and response must all be designed around the human layer, because that is where attackers are concentrating effort.

What this signals

Human-layer resilience is now a programme design issue. Public sector defenders should assume that attacks will arrive as a mix of social engineering, credential pressure and workflow abuse, not as neat single-stage intrusions. The practical response is to design controls around the user journey, so authentication, message filtering and investigation logic reinforce each other instead of operating separately.

The real gap is correlation, not awareness. Awareness still matters, but it cannot compensate for disconnected telemetry and slow escalation paths. Teams should prepare for the possibility that a trusted approval, a risky sign-in and a suspicious email are the same incident seen from different tools.

Identity governance has to absorb human risk signals. When public sector organisations align identity, email and response workflows, they create a more durable control surface for citizen data, student information and service continuity. That alignment is where resilience becomes measurable rather than aspirational.

For practitioners

• Map high-risk human attack paths Identify where phishing, BEC, credential theft and MFA fatigue converge on the same users, mailboxes or approvals.
• Correlate identity and email telemetry Bring login signals, message risk and access exceptions into one view so analysts can see patterns across tools.
• Prioritise high-exposure accounts Rank users and shared mailboxes by their likelihood of being targeted and the business impact of a compromised approval.
• Reduce manual triage steps Standardise response paths for suspicious messages, risky sign-ins and policy violations so staffing gaps do not stall containment.
• Tie awareness to enforcement Connect user training to email filtering, MFA prompts and access governance so behaviour change is backed by control changes.

Key takeaways

• Public sector cyber resilience is being strained by attacks that target people, approvals and credentials at the same time.
• Fragmented tooling and staffing shortages make it harder to see when a human-focused attack is moving from message to account abuse.
• The strongest response is an integrated human risk model that connects identity, email and response controls into one operating approach.

Key terms

• Human Risk Management: The practice of managing how people interact with security controls, especially under pressure, distraction, or deception. It combines training, policy, and friction management so identity systems are still usable enough that users do not bypass them in day-to-day work.
• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Human-Layer Resilience: The ability of an organisation to absorb manipulation of users, approvals and credentials without losing service continuity or trust. It depends on correlating identity, email and response signals so people-centric attacks can be detected and contained quickly.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course to strengthen how your programme handles identity governance across human and non-human access.