The risk does not lie in the systems. It lies in our habits.

Organisations invest in tools but remain vulnerable. The greatest risk lies in people’s day-to-day behaviour. Because habits trump systems.

June 4, 2026 · 5 min

An organisation can have the best security tools on the market and still be highly vulnerable. This is not a fault of the tools themselves: the biggest risk lies not in what you buy, but in what people do every day.

The shortcut taken a thousand times

The risk rarely stems from a spectacular attack. It stems from the shortcut taken a thousand times without consequence, from a reused password, from a security check skipped in a rush, from data shared carelessly. These are habits, not events. And habits cannot be changed by a tool.

No system can protect against behaviour that circumvents it every day simply for the sake of convenience.

Why tools alone are not enough

Every safety measure relies on people using it as intended. But when under pressure, people take shortcuts. They bypass checks that slow them down, ignore warnings that get in the way, and disable safeguards that get in the way. The measure is there, but habit renders it ineffective.

Changing habits

Reducing risk means tackling it at its source: in our everyday behaviour. This isn’t achieved by attending a course once a year, but by cultivating habits over time, in real-life situations, and monitoring whether they change. Tools are necessary, but they are only half the defence. The other half lies in people’s habits.

That is why simply completing a course does not reduce the risk, whereas a change in behaviour – once adopted and maintained – does.