Human error is a leading cause of cybersecurity breaches, yet inconsistent reporting due to a lack of structured frameworks hinders mitigation. Analysis of five major 2024 cybersecurity reports (Verizon DBIR, IBM, ENISA, Microsoft, Global CISO Survey) reveals how human error is characterized and quantified. Significant inconsistencies, gaps, and ambiguities are identified in classifying “human error” across these sources. Current industry reporting lacks a standardized taxonomy, hampering comparison and effective mitigation strategy development. Drawing on established frameworks (e.g., HFACS, Swiss Cheese Model), integrating a formal human factors classification system into reporting is proposed to improve clarity and actionability. The need for an integrated systemic framework is underscored, calling for industry adoption of standardized human error classification to enable more effective cybersecurity strategies.
KhawT. Y.AmranA.TeohA. P. (2024). Building a thematic framework of cybersecurity: A systematic literature review approach. Journal of Systems and Information Technology, 26(2), 234–256. https://doi.org/10.1108/jsit-07-2023-0132
NoblesC. (2022). Investigating cloud computing misconfiguration errors using the human factors analysis and classification system. Science Bulletin, 27(1), 59–66. https://doi.org/10.2478/bsaft-2022-0007
8.
NoblesC.BurrellD. (2024). Exploring the variability of human factors definitions in cybersecurity literature. MWAIS 2024 Proceedings, Peoria, IL, USA. https://aisel.aisnet.org/mwais2024/28
9.
OltramariA.HenshelD. S.CainsM.HoffmanB. (2015). Towards a human factors ontology for cyber security. Semantic Technologies for Intelligence, Defense, and Security. https://api.semanticscholar.org/CorpusID:18074878
10.
PolliniA.CallariT. C.TedeschiA.RuscioD.SaveL.ChiarugiF.GuerriD. (2022). Leveraging human factors in cybersecurity: An integrated methodological approach. Cognition Technology & Work, 24(2), 371–390. https://doi.org/10.1007/s10111-021-00683-y
11.
PollockT. (2017). Reducing human error in cyber security using the human factors analysis classification system (HFACS). 2017 KSU Conference on Cybersecurity Education, Research and Practice, Kennesaw, GA, USA. https://digitalcommons.kennesaw.edu/ccerp/2017/research/2
RahmanT.RohanR.PalD.KanthamanonP. (2021). Human factors in cybersecurity: A scoping review. The 12th International Conference on Advances in Information Technology, Bangkok, Thailand, 1–11. https://doi.org/10.1145/3468784.3468789
14.
ReasonJ. (Ed.). (1990). Human Error (1st ed.). Cambridge University Press.
15.
ReasonJ. (1995). Understanding adverse events: Human factors. Quality & Safety in Health Care, 4(2), 80–89. https://doi.org/10.1136/qshc.4.2.80
RohanR.PapasratornB.ChutimaskulW.HautamäkiJ.FunilkulS.PalD. (2023). Enhancing cybersecurity resilience: A comprehensive analysis of human factors and security practices aligned with the NIST cybersecurity framework. Proceedings of the 13th International Conference on Advances in Information Technology, Bangkok, Thailand, 1–16. https://doi.org/10.1145/3628454.3629472
18.
ShappellS. A.WiegmannD. A. (2000). The human factors analysis and classification system—HFACS (No. DOT/FAA/AM00/7). Federal Aviation Administration. https://commons.erau.edu/publication/737/
VacziD.TothLauferE.SzadeczkyT. (2020). Fuzzybased cybersecurity risk analysis of the human factor from the perspective of classified information leakage. 2020 IEEE 18th International Symposium on Intelligent Systems and Informatics (SISY), Subotica, Serbia, 000113–000118. https://doi.org/10.1109/SISY50555.2020.9217053
ZimmermannV.SchöniL.SchalteggerT.AmbuehlB.KniepsM.EbertN. (2024). Human-centered cybersecurity revisited: From enemies to partners. Communications of the ACM, 67, 72–81. https://doi.org/10.1145/36656655
