Expensive Firewall, Still Got Hacked? Here's Why.

You can have an expensive firewall.

Add EDR. WAF. IDS/IPS. MFA. Zero Trust. SIEM. Every security control you can think of.

Then someone clicks the wrong link.

Or enters their password into a phishing site.

Or sends a sensitive document to the wrong person.

Or uploads company data to a service they should not be using.

Suddenly, a security problem that cannot simply be patched appears:

the human factor.

Human factor does not mean "users are the problem"

The term human factor in cybersecurity is often misunderstood.

It does not mean every incident happens because an employee was careless.

It certainly does not mean humans are the only cause of breaches.

Real-world attacks are usually a combination of:

People + Process + Technology.

People can be targeted.

People can make mistakes.

Their credentials can be stolen.

And poorly designed systems can turn a small mistake into a major security incident.

So instead of simply asking:

"Why did the user click the link?"

A better question is:

Why could one click cause so much damage?

The numbers are worth looking at

The Verizon Data Breach Investigations Report (DBIR) continues to show that the human element plays a significant role in breaches.

The 2025 DBIR reported human involvement in roughly 60% of breaches analysed. The categories included credential abuse, social actions, errors and interaction with malware.

The 2026 DBIR reported a non-intentional human element in 62% of breaches. At the same time, vulnerability exploitation had become the largest initial access vector in the report, accounting for 31% of breaches.

That distinction matters.

It would be too simplistic to say:

"Humans are the biggest threat."

Cybersecurity is not a competition between people, hardware and software.

Today's attack surface is much more complicated than that.

Attackers do not always need to exploit your server

Imagine an organisation with fully patched servers.

The firewall is properly configured.

Endpoints have EDR.

MFA is mandatory.

Then an attacker sends an employee a message:

"Your account requires verification."

The link leads to a fake login page.

The employee enters their credentials.

The attacker now has something potentially more useful than an exploit:

legitimate access.

This is one reason social engineering remains effective.

CISA describes phishing as a form of social engineering in which attackers impersonate trusted entities to trick people into providing sensitive information or access.

A firewall cannot determine whether someone is entering their password into a legitimate login page or a convincing fake.

That is the problem.

Good security controls can still lose to stolen credentials

MFA helps.

A lot.

CISA recommends MFA because it can make account takeover significantly harder even when passwords have been compromised through phishing or other methods.

But MFA is not a reason to stop thinking about security.

Attackers can target authentication flows, session tokens, account recovery processes and the people operating them.

That is why mature security architecture does not depend on a single control.

It uses multiple layers.

Defense in depth.

OPSEC creates another, quieter problem

Sometimes an attacker does not need to find a vulnerability.

They just need information.

• Employee names.
• Job titles.
• Email patterns.
• Technology stacks.
• Subdomains.
• Vendors.
• Screenshots of internal dashboards.
• Git repositories.
• Documentation that was never supposed to be public.

Individually, these details may not look dangerous.

Together, they can give an attacker a surprisingly detailed picture of an organisation.

That is where operational security (OPSEC) matters.

The less unnecessary information an organisation exposes, the harder it becomes for attackers to map the environment and build convincing attacks.

Insider threat does not always mean a malicious employee

Another common misconception is that an insider threat means someone inside the organisation deliberately wants to steal data.

Not necessarily.

Consider three scenarios:

Malicious insider

Someone deliberately abuses their access.

Compromised account

An employee's account has been taken over by an attacker.

Accidental insider

An employee makes a mistake without intending to cause harm.

All three can result in serious consequences.

That is why access control, least privilege, monitoring and audit logging matter.

Not because employees are inherently untrustworthy.

Because security architecture should not depend on trust alone.

So what should we actually do?

The answer is not:

"Train users until they never make mistakes."

That is unrealistic.

People get tired.

People get distracted.

People make mistakes.

Attackers know this.

Good security engineering assumes that mistakes will eventually happen.

That means:

• Use MFA, preferably phishing-resistant authentication where appropriate.
• Apply least privilege so compromised accounts have limited reach.
• Segment critical systems and networks.
• Never store secrets in source code.
• Use proper secret management.
• Monitor authentication and unusual access patterns.
• Patch known and actively exploited vulnerabilities.
• Limit sensitive data access by role.
• Give employees a safe way to report phishing without blaming them.
• Test incident response instead of treating the plan as documentation.

And most importantly:

Build systems that can survive human mistakes.

Security is not about finding someone to blame

If an employee falls for phishing, it is easy to ask:

"Why did they click?"

A security engineer should ask more questions.

Why could the stolen credential still be used?

Was MFA strong enough?

Did the account have excessive privileges?

Was the unusual login detected?

Could the attacker access critical systems from that account?

Could sensitive data be exfiltrated easily?

And when the employee realised they had made a mistake, did the organisation have a process that allowed them to report it quickly?

That is the difference between blaming users and engineering for failure.

The firewall still matters

None of this means firewalls, EDR, WAF, patching or vulnerability management are unimportant.

They are critical parts of a defensive architecture.

In fact, the 2026 DBIR found that vulnerability exploitation had become the largest initial access vector in its dataset, accounting for 31% of breaches.

The lesson is not to choose between:

security technology and human security.

You need both.

Technology should reduce the opportunity for human mistakes.

Processes should limit the impact when mistakes happen.

And people should have the tools, training and visibility needed to make safer decisions.

Bottom line

Cybersecurity is not about building systems that assume everyone will always be careful.

It is about building systems that remain secure when someone makes a mistake.

So the next time you see an organisation with an expensive firewall, do not automatically assume it is secure.

Ask a more interesting question:

What happens when someone behind that firewall makes a mistake?

Because an attacker does not always need to break through the door.

Sometimes, they just need to wait for someone to open it.

---

Sources

• Verizon, 2026 Data Breach Investigations Report — breach patterns, human element and initial access vectors.
• Verizon, 2025 Data Breach Investigations Report — human element involvement in breaches (prior-year figure as reported in the 2026 edition).
• CISA, Avoiding Social Engineering and Phishing Attacks — phishing and social engineering.
• CISA, More than a Password — the role of MFA in protecting compromised credentials.

Sources

• Verizon: 2026 Data Breach Investigations Report
• CISA: Avoiding Social Engineering and Phishing Attacks
• CISA: More than a Password (MFA)