<!-- Built by Alex / Substack article -->
The Human Element: Cybersecurity's Weakest Link
Why the Pursuit of Absolute Security is a Myth
Open originalEvery time we make a contactless payment with our phone, we trust a complex security system to protect our money. But how secure are we, really?
While modern payment systems are remarkably robust, there is always the possibility of a Rogue POS or using a rogue third-party wallet app for payments.
Those cases might be extreme, but they do exist. The idea of absolute cybersecurity — a world where no system can be breached and no data can be stolen — is tempting, yet in practice, perfect cybersecurity is unattainable.
As technology evolves and the number of connected devices grows, so do the threats that aim to exploit their vulnerabilities. These weaknesses can be either technical, software or human error. Every new product can keep us safe until… it doesn’t.
Cybersecurity is, therefore, a never-ending race between defence and attack. While absolute protection may be impossible, this continuous competition drives innovation.
Let’s look at a practical example of this innovation: payments.
Physical debit/credit cards: This method relies on static information, including the card number, expiry date, and CVV, which can be easily intercepted or copied.
Apple/Google Pay: In contrast, these technologies rely on dynamic information, such as tokenisation and biometric authentication. The real card number is never stored or transmitted; instead, a unique digital token is created for each transaction.
Still, even Apple Pay is not immune. Human threats, like social engineering or phishing, or fake sites, can still expose users to risk. Of course, the same applies to using a physical card.
If you are curious about how Apple/Google Pay works, I recommend reading this post by ByteBytoGo. It has many visualisations and explains the whole process perfectly.
The Weakest Link
As I mentioned before, both using physical cards and modern payment methods can fall short due to human error. No matter how sophisticated our technology becomes, it is still operated by people. Human vulnerability is the gateway for many of the most successful attacks.
While we can patch software, we can’t easily patch human psychology. An accidental threat, like clicking on a malicious link out of fatigue, or a deliberate one from a disgruntled employee, can have devastating consequences. Social engineering techniques that exploit human trust often prove more effective than breaking complex algorithms.
Can we bypass the human factor?
If we remove humans from the picture and isolate a system, we can achieve ultimate cybersecurity, but at what cost?
Let’s imagine this scenario: You have some confidential information in your laptop, and you want ultimate security. You can remove its access to any network, remove its battery, lock it in a safe and throw away the key. You have now successfully made your laptop useless.
Ultimate security, while in theory can be achieved, is a balancing act. The right approach is not to search for an invulnerable system, but to practice risk management: identifying potential threats, strengthening vulnerabilities, and, above all, prioritising continuous education and vigilance.
And to answer my question, no humans can’t be taken out of the equation! Humans give both the value in the item and create the threats.
So, why is absolute security impossible?
The chase for perfect security will always fall short for a few key reasons:
Complexity Breeds Exposure: Modern systems combine hardware, software, third-party libraries, and cloud services. Each layer introduces its own potential vulnerabilities.
Humans Remain the Wild Card: Accidental mistakes and deliberate deception make people a persistent and unpredictable weak link.
Attackers Innovate: As defensive tools improve, adversaries evolve, using AI, automation, and novel tactics to find new weaknesses.
The pursuit of absolute security may be a paradox, but it forces us to become smarter and more resilient. The key isn’t building an unbreakable wall, but fostering a culture of continuous education, vigilance, and proactive risk management.
Let’s Connect!
🐦 X/Twitter : alex_kazos
💼 LinkedIn: alex-kazos
👨🏻💻 GitHub: alex-kazos