We’ve all heard the mantra that ‘humans are the weakest link’ in any organisation’s cybersecurity defences, but with the rise of AI-powered exploits and increasingly sophisticated attacks, it’s no longer fair — or effective — to blame individuals for succumbing to attacks.

Yes, cyber training and education continue to play a huge role in an organisation’s broader cyber defence regime, but the human element has been touted as the greatest point of weakness for too long. With generative AI technology making exploits such as phishing email campaigns more convincing and scalable, a more constructive approach is needed.

But how can businesses secure the human attack vector without putting all the responsibility on individuals? They need to work out how to build walls that protect business networks without victim blaming — especially in the age of remote and hybrid work. Here’s the thing, avoiding a cyber attack shouldn’t be the main goal, minimising cyber risk should be.

With that in mind, a more holistic approach is needed to pin down weak points in organisational defences. Only then can businesses begin to adequately address the range and volume of attacks being launched by today’s cybercriminals.

Fortunately, there are things businesses can do to shift the focus from individuals and instead implement a more centralised and systematic approach to cybersecurity, one that provides a secure grounding for employees to feel empowered as they go about their business while doing a better job of protecting corporate systems.

Here are some key measures companies can take to shift the focus from the individual to the whole business as a single, unified front against potential attackers:

Build a Strong Security Culture

Shifting away from a focus on the individual doesn’t mean ignoring the value of the human element, which remains essential. So, it’s important to create the right setting for a healthy security culture to ensure everyone can be on the same page when it comes to protecting themselves and the organisation.

One way to create a sound setting for a strong security culture is to reframe the idea of identity and the importance of protecting it. Rather than attempting to train employees to spot each and every potential threat, it may be best to simply teach team members the value of personal identity information, particularly their credentials, to cyber criminals and the steps to take to avoid damaging actions from their loss. This is likely to result in better social media hygiene, a more cautious approach to information sharing, and ultimately individual ownership of an action plan when the worst happens and credentials are lost.

Adopt a Risk-based Approach

In today’s threat landscape, taking a risk-based approach to security generally proves more effective than a compliance-based approach. This means that businesses go beyond box ticking exercises, instead implementing mechanisms that can identify the relevant risk. Only then can risk be mitigated before it gets out of control, making it more manageable.

Beyond simply identifying risk, adopting the risk-oriented zero trust approach helps to ensure that access is validated and continuously monitored for suspicious activity to prevent cybercriminals from using legitimate credentials to move undetected across the network. Zero trust isn’t a specific technology, rather it is an architectural approach for network security that assumes every transaction, entity and identity is untrusted until trust is established.

Centralise Security Functions

It’s often tricky to know what’s going on across corporate networks, especially when people are working from home. But although a workforce may be distributed, a centralised approach to security can provide greater oversight and risk management than a distributed cyber security approach. Why? Because it can simplify security operations, which makes for better visibility.

Specifically, with a platform-based approach, security teams have a better chance of gaining comprehensive visibility across the attack surface and can establish processes to protect initial attack vectors. A unified platform also gives IT and security teams a way to easily connect and translate business-wide communications to effectively cover team members, wherever they may be in the organisation’s distributed network and broader attack surface.

Partner with Cyber Experts

Having a hotshot cyber security team with the right skill set is one way to help ensure an organisation’s security posture up to scratch. However, with the ongoing skills shortage in this area, both locally and further afield, it may be hard for organisations to get the specific skills they need internally to establish internal cyber functions such as the all-important security operations centre (SOC). This is where managed services come in.

Businesses can turn to managed service providers or managed security service providers to become their outsourced experts, hired to help with immediate and long-term security needs. SOC-as-a-service, for instance, is a relatively new managed security service model sometimes attached to a broader platform offering, that can take pressure off individuals to spot and deal with potential threats, further empowering employees to confidently go about their business.

The weakest link in an organisation’s cyber security defences is no longer a single person, it is the organisational support, enabled by measures such as those highlighted above, that can empower an individual to make the best decision in any given situation and avoid the worst possible outcome should an innocent mistake occur.

With the right setting, processes, security model, technology and external support, companies can keep their people and their systems safe and productive, helping them shift mentally from a place of fear to a place of confidence.