The Human Factor in Information Security: Challenges and Prospects for Georgian Organizations

The Human Factor in Information Security: Challenges and Prospects for Georgian Organizations

### Abstract

In today’s digital world, most security breaches are not caused by complex technical failures but by human actions. Carelessness, lack of awareness, falling for phishing, or even intentional misuse often open the door for attackers. This article explores the human side of information security in Georgian organizations, looking at both public and private sectors. It introduces a practical five-pillar model to reduce human-related risks and offers realistic recommendations for HR, leaders, and policymakers in Georgia.

### The Scale of the Problem

According to the Verizon 2024 Data Breach Investigations Report (DBIR), the human element played a role in 68% of breaches. This includes people making mistakes (like sending sensitive files to the wrong person) or falling victim to social engineering attacks such as phishing.

Insider threats remain a serious concern too. The 2024 Insider Threat Report shows that many organizations still struggle with both unintentional and malicious actions by their own people.

In Georgia, this challenge is especially relevant. The country has been rapidly digitizing its public services and private businesses. The new Personal Data Protection Law (effective March 2024) brings Georgia closer to EU standards, with stricter rules, higher fines, and requirements for Data Protection Officers. However, technology alone cannot solve everything — people remain the weakest (and most important) link.

### Why the Human Factor Matters in Georgia

Georgian organizations face unique challenges:

- Limited cybersecurity awareness — Many employees in public institutions and smaller private companies still view security as “IT’s problem.”

- Rapid digital transformation — More remote work, cloud services, and online government portals increase exposure.

- Resource constraints — Smaller organizations often lack dedicated security teams and proper training budgets.

- Insider risks — Low salaries in some sectors and high staff turnover can increase the chance of intentional data leaks.

Social engineering remains highly effective here, just like globally. Attackers exploit trust, urgency, and lack of verification.

### Five-Pillar Model for Reducing Human Risk

I propose a simple, integrated framework tailored for Georgian organizations:

1. Security Culture

Build an environment where security is everyone’s responsibility, not just the IT department’s. This involves values, attitudes, and daily behaviors.

2. Training and Awareness

Move beyond boring annual lectures. Use practical, regular training with simulations (phishing tests), real-life examples, and short micro-learning modules.

3. Behavioral Governance

Implement clear policies, access controls (least privilege), monitoring with privacy respect, and fair incident response processes that encourage reporting without punishment.

4. Leadership Commitment

Leaders must lead by example. When the director ignores security rules, employees will too. Visible support from top management is essential.

5. Regulatory Compliance

Align with Georgia’s new data protection law and national cybersecurity strategy. Treat compliance as a foundation, not the final goal.

These five pillars work best when implemented together, not in isolation.

### Practical Recommendations

#### For HR Professionals:

- Include cybersecurity awareness in onboarding and performance evaluations.

- Work with IT to run regular phishing simulations and reward good reporting behavior.

- Develop clear insider threat policies with psychological support programs.

#### For Organizational Leaders:

- Allocate proper budget for security awareness (even 1-2% of IT budget helps).

- Participate in training sessions personally.

- Create a “no-blame” culture for reporting suspicious incidents.

#### For Policymakers and Public Sector:

- Expand training programs through the LEPL Cyber Security Bureau and other agencies.

- Support small and medium businesses with free or subsidized awareness tools and templates.

- Update the National Cybersecurity Strategy to put stronger emphasis on the human factor.

### Positive Outlook (Prospects)

Georgia has real opportunities. The new data protection law is a big step forward. Young people are tech-savvy, and there is growing interest in cybersecurity careers. Organizations that invest in their people today will gain significant advantages in trust, compliance, and resilience.

Shifting from “human-as-problem” to “human-as-solution” (as researchers Zimmermann and Renaud suggest) is the key mindset change we need.

### Conclusion

Technology evolves fast, but humans remain at the center of both risk and protection. For Georgian organizations — whether in public administration, banking, healthcare, or small businesses — building a strong security culture is no longer optional.

At AI Loop Tech, we believe that empowering people with knowledge and the right environment is one of the most cost-effective ways to strengthen national cybersecurity.

The future belongs to organizations that treat their employees not as the weakest link, but as the strongest line of defense.