{"id":175130,"date":"2026-01-06T20:43:00","date_gmt":"2026-01-07T01:43:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/01\/06\/cybersecurity-still-fails-at-the-click\/"},"modified":"2026-01-07T00:40:12","modified_gmt":"2026-01-07T05:40:12","slug":"cybersecurity-still-fails-at-the-click","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/01\/06\/cybersecurity-still-fails-at-the-click\/","title":{"rendered":"Cybersecurity still fails at the click"},"content":{"rendered":"<p><a href=\"https:\/\/govinsider.asia\/intl-en\/article\/cybersecurity-still-fails-at-the-click\">Cybersecurity still fails at the click<\/a><\/p>\n<p><a href=\"https:\/\/govinsider.asia\/intl-en\/article\/cybersecurity-still-fails-at-the-click\">https:\/\/govinsider.asia\/intl-en\/article\/cybersecurity-still-fails-at-the-click<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-01-06 20:43:00<\/a><\/p>\n<p>Source Domain: <a href=\"govinsider.asia\">govinsider.asia<\/a><\/p>\n<p>Author: <a href=\"\"><\/a><\/p>\n<p> Using an unordered list, summarize the following article with between 4 and 8 key points. Governments around the world have invested heavily in cybersecurity infrastructure &#8211; from zero-trust architectures to\u00a0artificial\u00a0intelligence (AI)-driven threat detection.\u00a0<br \/>\nYet phishing and social engineering remain the most common entry points for breaches.\u00a0<br \/>\n\u00a0<\/p>\n<p>The reason is simple. Most attacks\u00a0don\u2019t\u00a0target\u00a0systems;\u00a0they\u202ftarget human decision-making:\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>These are not failures of training or diligence. They are the result of how the\u202fhuman brain makes decisions under pressure.\u00a0<br \/>\n\u00a0<\/p>\n<p>Cybersecurity programmes assume rational behaviour\u00a0&#8211; that staff will carefully read messages, evaluate risks logically, and follow procedures consistently.\u00a0<\/p>\n<p>\u00a0\u00a0<\/p>\n<p>But neuroscience suggests otherwise. Our brain\u00a0operates\u00a0using two interacting systems:\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>Under stress, time pressure, or cognitive overload, the fast system dominates. And\u00a0phishing attacks succeed because they trigger this system before analytical thinking can engage.\u00a0<\/p>\n<p>What\u00a0happens\u00a0when a\u00a0phishing\u00a0email\u00a0arrives\u00a0<br \/>\n\u00a0<\/p>\n<p>When an email appears, the brain does not first ask,\u202f\u201cIs this legitimate?\u201d\u00a0It asks:\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>Attackers, therefore, design messages to exploit these instinctive evaluations.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>This aligns with behavioural research captured in the\u202fmodel of\u00a0phishing\u00a0susceptibility, which shows that vulnerability arises from the interaction of\u202fsituation, emotion, and personality.\u00a0<\/p>\n<p>Context\u00a0shapes\u00a0attention\u00a0<br \/>\n\u00a0<\/p>\n<p>Public\u00a0sector\u00a0officers\u00a0operate\u00a0in environments characterised by\u00a0high email volumes, tight deadlines, multiple reporting lines, and strong hierarchical norms.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>Justin Fong: Effective cyber resilience requires habits that align with how the brain works.\u00a0<\/p>\n<p>Cognitive science shows that attention is a limited resource, and when workload increases, the brain prioritises speed over scrutiny.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>Capitalising on this vulnerability, phishing emails are\u00a0deliberately\u00a0timed\u00a0during\u00a0reporting cycles, near financial or compliance deadlines, and before holidays or system cut-offs.\u00a0<br \/>\n\u00a0<\/p>\n<p>In these contexts, clicking is not irrational. It is predictable.\u00a0<\/p>\n<p>Feelings\u00a0precede\u00a0logic\u00a0<br \/>\n\u00a0<\/p>\n<p>Emotions play\u00a0a central role\u00a0in decision-making.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>They are reflex and hence act faster than conscious reasoning and guide behaviour before logic intervenes.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>Social engineering, therefore, relies on a small set of emotional triggers:\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>Once emotion is triggered, the brain seeks resolution through action. This explains why even experienced and well-trained officers can make mistakes under pressure.\u00a0<\/p>\n<p>Strengths\u00a0can\u00a0become\u00a0vulnerabilities\u00a0<br \/>\n\u00a0<\/p>\n<p>Individual traits influence which emotional triggers are most effective.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>Conscientious officers feel pressure to comply correctly, helpful officers feel compelled to\u00a0assist, and curious officers are drawn to\u00a0new information.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>These are strengths in public service, not weaknesses. However, attackers deliberately exploit them.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>The\u00a0implication is important as improving cyber resilience is not about \u201cfixing\u201d people\u00a0but about\u202fdesigning cultures that account for human variability.\u00a0<\/p>\n<p>Why\u00a0awareness\u00a0training\u00a0alone\u00a0falls\u00a0short\u00a0<br \/>\n\u00a0<\/p>\n<p>Most cybersecurity training focuses on recognition. Spot suspicious links,\u00a0identify\u00a0unusual senders, and look for technical red flags.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>While these are necessary, this assumes that the analytical brain is active\u00a0at the moment\u00a0of decision.\u00a0In reality,\u00a0as\u00a0we have spoken,\u00a0under pressure, it often is not.\u00a0<br \/>\n\u00a0<\/p>\n<p>What is missing is a\u202fbehavioural interruption\u00a0&#8211; a\u00a0mechanism that slows decision-making long enough for analysis to occur.\u00a0<\/p>\n<p>A\u00a0practical\u00a0behavioural\u00a0control:\u00a0spot,\u00a0pause.\u00a0verify\u00a0<br \/>\n\u00a0<\/p>\n<p>Effective cyber resilience requires habits that align with how the brain works.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>The\u00a0Spot-Pause-Verify\u202fframework\u00a0provides\u00a0such a mechanism:\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>This short pause re-engages analytical thinking and interrupts impulsive action. It functions as a cognitive control rather than a technical one.\u00a0<\/p>\n<p>Leadership\u00a0matters\u00a0<br \/>\n\u00a0<\/p>\n<p>In government, cybersecurity is fundamentally about\u202ftrust\u202fin systems, institutions, and public data.\u00a0Leaders shape the conditions under which decisions are made:\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>A culture that prioritises speed over verification increases risk.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>A culture that penalises mistakes discourages early reporting.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>Cyber resilience,\u00a0therefore,\u00a0extends beyond IT controls into\u202fgovernance, leadership, and organisational design.\u00a0<br \/>\n\u00a0<\/p>\n<p>Every cyber incident begins\u00a0in the\u00a0moment\u00a0a decision is made under pressure.\u00a0Understanding the science behind that moment is critical.\u00a0<br \/>\n\u00a0<\/p>\n<p>Cybersecurity does not fail because people are weak.\u00a0It fails when systems ignore\u202fhow people make decisions.\u00a0\u00a0<br \/>\n\u00a0<\/p>\n<p>Governments that recognise this will be better positioned to protect not just their systems, but the trust the public\u00a0depends on.\u00a0<br \/>\n\u00a0<\/p>\n<p>&#8212;&#8212;&#8212;&#8212;&#8212;-\u00a0<br \/>\n\u00a0<\/p>\n<p>The author is a former military security officer and senior communications leader with over 30 years of experience. He helps organisations strengthen their human\u00a0firewall\u00a0by transforming employees from the weakest link in cybersecurity to the first line of defence. He has previously worked for the Singapore Armed Forces, Prime Minister\u2019s Office, and A*STAR, leading crisis response teams, advising political office holders, and building communication strategies that work under pressure.\u00a0<\/p>\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity still fails at the click https:\/\/govinsider.asia\/intl-en\/article\/cybersecurity-still-fails-at-the-click Publish Date: 2026-01-06 20:43:00 Source Domain: govinsider.asia Author:&#8230;<\/p>\n","protected":false},"author":1,"featured_media":175131,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"http:\/\/govinsider.asia\/uploads\/2026\/1\/Phishing-1767749628609-w300.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,24,31,25,27],"class_list":["post-175130","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-cybersecurity","tag-exploit","tag-phishing","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/175130"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=175130"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/175130\/revisions"}],"predecessor-version":[{"id":175132,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/175130\/revisions\/175132"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/175131"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=175130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=175130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=175130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}