Human-Centred Cybersecurity

Cybersecurity is not solely about technical vulnerabilities. People interpret and adapt technology, organisations develop practices to manage security risks, and attackers exploit both technical and social conditions. When security mechanisms do not function as intended, the consequences can be far-reaching. At the same time, emerging technologies create new opportunities for manipulation, misuse and digital harm.

Human-centred cybersecurity examines how security and privacy are shaped by the interaction between people, technology and organisations. At RISE, we combine perspectives from human-computer interaction, cybersecurity, design, and behavioural and social sciences to understand how security problems arise, how people are affected, and how digital systems can be designed to better address both risks and their consequences.

When security does not work as intended

Security mechanisms do not always function as intended. How people understand technology, the organisational conditions in which it is used, and how security measures fit into everyday working practices all influence how vulnerabilities arise and how incidents are managed.

An employee may be deceived into installing malicious software on their work computer during a fraudulent recruitment process, inadvertently giving attackers access to the organisation’s internal systems. Similarly, security training and instructions may be provided in a language or format that is not accessible or inclusive to everyone, making it difficult for some employees to understand and follow security guidance. A security system may be technically well designed but still create problems if people do not understand its warnings or perceive it as an obstacle to their work. Such situations demonstrate why cybersecurity needs to be understood within its social and organisational context.

Our research examines how people perceive and manage security risks, how they interact with protective mechanisms, and how individuals and organisations respond when incidents occur. We also investigate how experiences from security incidents can inform the development of more effective security practices and technical solutions.

This knowledge can help organisations identify barriers to secure behaviour, improve incident response, and develop security solutions that work under real-world conditions.

Emerging technologies, new forms of attack and misuse

Generative AI, extended reality, smart glasses, drones and robots are changing how people interact with digital systems and the security risks that arise. As technologies combine sensors, automation and access to physical and digital environments, they create new opportunities to collect information, influence systems and exploit vulnerabilities.

For example, an AI assistant may be manipulated through instructions hidden in the information it processes, while smart glasses may collect sensitive information about people who are unaware of, or have not consented to, such data collection. These situations illustrate how new threats can emerge through the interaction between technical capabilities, human behaviour and the environments in which technologies are used.

Our research examines how vulnerabilities and harmful behaviours emerge and evolve in relation to emerging technologies. We investigate adversarial interactions, the manipulation of AI systems, privacy risks associated with sensor technologies, and the misuse of autonomous and wearable systems. We also explore human-centred methods for identifying and analysing these risks, including adversarial testing and red teaming.

By examining how technologies can be used, manipulated and misused, we help organisations identify risks that might otherwise be overlooked and develop more considered safeguards when adopting emerging technologies.

When security affects people differently

Security measures do not always protect everyone equally. How technologies are designed and used can affect accessibility, autonomy, consent, and people’s ability to understand and control digital systems.

For example, an authentication solution that requires access to a personal mobile phone may create barriers for people who do not own such a device or cannot use it in the expected way. Similarly, monitoring and data collection introduced to improve security may also compromise personal privacy.

Our research examines how security technologies and practices affect different people and stakeholders. We investigate usable and inclusive security, conflicting needs and interests, and how technical and organisational decisions influence people’s ability to act and make choices. These issues become particularly important when digital technologies are used across the boundaries between workplaces, homes and public environments.

By highlighting the circumstances and needs of different users, as well as the potential consequences of security measures, we help organisations develop solutions that are more accessible, understandable and responsible.

How we can help

At RISE, we integrate human-centred perspectives into cybersecurity research and innovation. We combine expertise in human-computer interaction, cybersecurity, design, and behavioural and social sciences to investigate security challenges that arise through the interaction between people, technology and organisations.

We collaborate with industry, the public sector and research organisations to develop knowledge, methods and solutions in human-centred cybersecurity. Depending on an organisation’s needs and the challenges it faces, collaboration may include:

• User studies and evaluation: Investigating how people understand, use and are affected by security solutions, and identifying barriers to usable and inclusive security.
• Incident analysis: Examining the human and organisational aspects of cybersecurity incidents to understand how they arise, how they are managed, and how they affect people and organisations.
• Adversarial testing and red teaming: Exploring how emerging technologies, such as AI-based systems, can be manipulated or misused through human interaction.
• Research and innovation projects: Working with organisations to investigate emerging security challenges and develop human-centred methods and approaches.

Would you like to better understand how human, technical and organisational factors influence cybersecurity in your organisation? Contact us to discuss your challenges and opportunities for collaboration.