Human firewall: turning employees into a line of defence

A human firewall means employees who can recognise an attack that got past technical defences and instinctively report it. The image is appealing: after the network firewall, a final barrier made of attentive people. Taken literally, it is also misleading, because a person does not filter like a machine. Here is what the idea covers, what the data and research say, and how to turn it into a real defence.

A technical firewall allows or blocks each flow according to rules. The human firewall plays a different role: detect and alert. An employee who doubts an email, refuses an urgent payment request or calls IT support on the usual number rather than the one in the message stops an attack the tools missed. The term therefore covers three things: individual reflexes, a collective culture where people report without fear, and the programme that sustains them.

It builds on security awareness training, its main tool, and on the rules set by the acceptable use policy. In NIST CSF 2.0, it sits in the awareness and training category of Protect, but also in Detect and Respond: a report is a sensor.

Attackers go through people because it is often easier than breaking into a system. Three independent sources agree:

On top of classic phishing come CEO fraud, fake supplier bank detail changes and, increasingly, AI-generated messages and voices that are more convincing and error-free. A ransomware attack very often starts with credentials stolen this way.

Taken literally, the image makes security depend on everyone's vigilance, and puts the blame on whoever clicks. Several respected voices warn against this:

• Bruce Schneier, in his essay “Stop Trying to Fix the User” (2016), argues that users are asked to do counterintuitive things because systems are badly designed, and that security should work regardless of what people do.
• Research: a University of California San Diego team followed more than 19,500 employees of a large healthcare organisation over eight months and ten simulated campaigns. It found no significant link between recent annual training and falling for phishing, and training shown right after a click reduced that risk by only about 2% (research paper).
• The UK NCSC notes in “The trouble with phishing” that you can get any click rate you want by tuning message difficulty, and that a culture of fear makes people hide mistakes. The UK research centre CREST adds that simulations designed to “catch people out” turn the security team into the enemy (“Phishing your staff”).

The lesson is not to drop awareness, but to change the goal: aim less for zero clicks and more for fast reporting, and build processes that hold when someone makes a mistake.

1. One-click reporting. A button in the mail client or a single address, a quick reply from the security team and a thank-you every time, including false alarms. That is what lets you pull a message from every inbox within minutes.
2. A no-blame culture. The cyber security culture principles published by the NCSC in 2025 stress openness (being able to talk about a mistake without fear), leadership by example, social norms and clear rules. Someone who admits to clicking should be thanked, not punished.
3. Targeted training. Exposed roles (finance, payroll, executive assistants, procurement, administrators) get scenarios specific to their jobs: bank detail changes, CEO fraud, fake support. Everyone else gets short, regular messages rather than a yearly module.
4. Realistic, announced exercises. Simulations whose principle is known, with no lures on sensitive topics, followed by an immediate explanation; and crisis exercises for management.
5. A link to the response team. Every report feeds incident management: the employee becomes a sensor, and the feedback they receive keeps the reflex alive.

A strong human firewall relies on processes that make mistakes less costly. Several measures in the French cybersecurity agency's IT hygiene guide point this way (authentication, limited rights, patching, backups); business procedures do the rest:

The same logic underpins zero trust: never assume access is legitimate because it comes from inside or from a known account.

The revised NIST SP 800-50 (2024) recommends measuring a programme's effect on behaviour, not just completion. Four indicators are enough to start:

• reporting rate for suspicious messages, real or simulated;
• time to first report after receipt: it determines how many people are protected;
• reports-to-clicks ratio on the same campaign, more telling than clicks alone;
• incidents prevented or contained thanks to a report, told to management with an example.

Present them as trends in the security dashboard run by the CISO.

For entities covered by NIS 2, this programme partly meets the cyber hygiene and training requirements of Article 21 and the management training set out in the directive. To track these measures and their evidence alongside other requirements, Phinasoft's compliance campaigns module assesses each entity against the same list.