People-Centric Cybersecurity Program

Expanded Definition

A people-centric cybersecurity program is broader than awareness training and narrower than a general culture initiative. It treats employees, contractors, and their work context as part of the control environment, meaning security decisions are shaped by role, task, device, data sensitivity, and timing. That makes it an operating model, not a campaign. In practice, it blends governance, identity and access controls, behavioral signals, and feedback loops so teams can reduce human error without assuming that more training alone will change outcomes. This is consistent with the idea that security must adapt to how work actually gets done, which is also reflected in guidance from CISA cyber threat advisories when people are targeted through social engineering, phishing, and business process abuse.

Definitions vary across vendors on whether the term should cover only employee behavior or also HR, legal, and organisational design. At NHI Management Group, the practical distinction is simple: if the program can change access, workflow friction, coaching, and escalation based on risk, it is people-centric; if it only delivers messages, it is not. The most common misapplication is equating people-centric security with annual awareness training, which occurs when organisations measure completion rates instead of reducing risky decisions in real workflows.

Examples and Use Cases

Implementing a people-centric cybersecurity program rigorously often introduces governance and measurement overhead, requiring organisations to weigh tailored controls against simpler but less effective blanket policies.

• Phishing-resistant access paths are prioritised for finance and executive assistants, while lower-risk teams receive different guardrails based on actual exposure and business need.
• Security coaching is triggered by repeated risky actions, such as approving unfamiliar MFA prompts or sharing data outside approved channels, rather than by generic reminders alone.
• Policy exceptions are reviewed with context, so a sales team travelling internationally can receive temporary access controls that are tighter in some areas and more flexible in others.
• Operational learning loops connect incident findings to training content, workflow changes, and access redesign, using real events rather than static awareness material.
• Threat intelligence is translated into human-facing scenarios, including business email compromise and deepfake-enabled fraud, informed by sources such as the Anthropic first AI-orchestrated cyber espionage campaign report and the MITRE ATLAS adversarial AI threat matrix where AI-driven manipulation is relevant.

These use cases show that the program is not about making people the weak link, but about designing controls around realistic decision points.

Why It Matters for Security Teams

Security teams need this model because many high-impact incidents start with a human decision that was predictable in context, not reckless in isolation. A people-centric program helps reduce alert fatigue, improves control adoption, and makes access and workflow design more resilient to social engineering, privilege misuse, and process abuse. It also creates a cleaner bridge between identity governance and day-to-day security operations, especially when non-human systems, delegated approvals, or agentic workflows depend on humans to authorize actions. That makes the model relevant to NHI governance as well, because human oversight often becomes the last meaningful checkpoint before secrets, credentials, or privileged actions are issued.

The most effective programs focus on measurable outcomes such as fewer unsafe approvals, better reporting of suspicious activity, and tighter exception handling, rather than on participation metrics alone. Organisations typically encounter the real cost of a weak program only after a phishing compromise, fraud event, or access misuse investigation, at which point people-centric cybersecurity becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How should security teams build an AI cybersecurity awareness program for employees who use generative AI tools every day?
• How do organisations know if a cybersecurity behavior change program is actually working?
• How should security teams turn cybersecurity awareness month into a year-round human risk program?
• How should security teams implement data-centric cybersecurity in critical infrastructure environments?