Topic starter
02/08/2026 11:30 am
TL;DR: Public sector organisations face phishing, business email compromise, credential theft and MFA fatigue as the human layer becomes the primary attack surface, according to Knowbe4. Fragmented tools and staffing shortages make resilience depend on unified human risk management, not isolated controls.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper Securing the Public Sector at Scale: How Unified Human Risk Management Drives Cyber Resilience”.
Key questions
Q: How should security teams reduce phishing risk in MFA without creating more user friction?
A: Use phishing-resistant authentication for the highest-risk access first, then phase out phishable factors such as SMS, email links, and push approvals.
Q: Why does fragmentation create compliance risk in public sector security?
A: Fragmentation makes it harder to prove control because logs, policies, and access decisions sit in separate systems.
Q: What breaks when staffing shortages meet rising human-driven attacks?
A: Manual triage breaks first.
Practitioner guidance
- Map high-risk human attack paths Identify where phishing, BEC, credential theft and MFA fatigue converge on the same users, mailboxes or approvals.
- Correlate identity and email telemetry Bring login signals, message risk and access exceptions into one view so analysts can see patterns across tools.
- Prioritise high-exposure accounts Rank users and shared mailboxes by their likelihood of being targeted and the business impact of a compromised approval.
Bottom line: Public sector cyber resilience is being strained by attacks that target people, approvals and credentials at the same time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:45 pm
Human risk management is becoming a control plane for public sector resilience. The article reflects a reality we see across identity-heavy environments: the risk is no longer just whether a user clicks, but whether the organisation can detect, correlate and act on that click quickly enough. Public sector teams need to think in terms of behavioural exposure, not just awareness training. The practitioner conclusion is simple: resilience now depends on joining identity, email and response signals into one operating model.
A question worth separating out:
Q: How do IAM and email security work together against business email compromise?
A: IAM controls who can authenticate, while email security helps detect the social engineering that tries to drive that authentication or a fraudulent action. Together, they reduce the chance that a trusted user interaction becomes unauthorised access. Neither control works well in isolation when attackers target the human layer.
👉 Read our full editorial: Human risk management is reshaping public sector cyber resilience