1979 called. They already figured it out.

You still think cybersecurity is a modern industry? It's 2 o'clock in the morning, September 2023. A helpdesk operator at a Las Vegas casino gets a call. Male voice, calm, says he lost MFA access. She does exactly what she was trained to do: resets his credentials. Ten minutes later, ALPHV/Scattered Spider is inside MGM. Nine days later, MGM is 100 million dollars lighter and 30 percent of its systems are still down. The public post-mortem: "the employee should have caught it." That is the sentence I want to talk about. Not because it is wrong, though it is, but because it is the blame our industry keeps defaulting to. And it is the blame that keeps people quiet the next time they see something strange. We're not the only ones dealing with this blame urge. However, we are the only ones still giving in to it. After numerous incidents, aviation stopped saying "pilot error" in 1979 and rebuilt the systems pilots operate in. Healthcare stopped firing surgeons and started fixing the environment they work in. Road safety abandoned "pay more attention" in the nineties and started designing survivable failure into every intersection. All of them cut fatalities by double digits. We like to call cybersecurity a modern field. Frontier. Cutting-edge. Next-gen. But when it comes to the human factor we are still doing what airlines were doing forty years ago and hospitals thirty years ago. We are still telling Hans from accounting he fell for it. I will show you what happens in a human brain when we apply blame publicly, why it breaks organisational detection, and what a small number of companies are starting to do about it. And if at the end you still want to blame someone, at least you will know what it is really costing you. In aviation, they redesigned their system. In cybersecurity, we still blame the people. It's about time we catch up!