A Human Firewall, Defined
A human firewall is the layer of defence formed by people. It is a workforce trained to recognise social engineering, pause on unusual requests, verify them through a known channel and report anything suspicious. Where technical controls filter machines, the human firewall covers the judgement calls that software cannot make for you.
The reason this matters is simple. Attackers increasingly aim at people rather than systems because a convincing message or phone call can walk straight past a firewall and an antivirus. In Verizon’s 2026 Data Breach Investigations Report the human element featured in 62% of breaches, up slightly on the year before and has not dropped below 60% in five years
Why Attackers Target the Human Layer
Software has become harder to break so attackers take the easier route. Rather than find a flaw in a system, they manipulate the person who already has legitimate access. This is social engineering, the use of urgency, authority and trust to make someone act against their own interest.
Three shifts have made the human layer the softest target. Remote and hybrid work spread the attack surface across home networks and personal devices. Generative AI now writes fluent, personalised lures at scale, and Verizon’s 2026 report notes the volume of AI-assisted text in malicious emails has roughly doubled. Attackers have also moved beyond the inbox to phone calls and text messages, where people tend to be less guarded.
Attacks a Human Firewall Has to Stop
The human firewall defends against a family of social-engineering techniques. The names differ but the pattern holds with a human asked to click, pay, tell or allow.
- Phishing: Mass fraudulent emails that harvest credentials or deliver malware. Phishing and spoofing was the single most reported cybercrime to the FBI in 2024.
- Spear phishing: A targeted message built from research on the individual, far harder to dismiss than bulk phishing.
- Vishing: Voice phishing by phone. Verizon’s 2026 data found phone-based attacks succeed at a higher rate than email.
- Smishing: Phishing by text message often a fake delivery notice or bank alert carrying a link.
- Business email compromise: A spoofed or hijacked email that requests a payment or a change of bank details, aimed at finance teams.
- Pretexting: An invented backstory such as a caller posing as IT or a supplier used to extract access or information.
- MFA fatigue: Repeated login prompts pushed to a victim until they approve one just to make the alerts stop.
- Baiting and tailgating: A dropped USB stick or a friendly follow through a secure door where curiosity or politeness opens the way.
The Business Impact of a Weak Human Layer
When the human layer fails the costs are not abstract. They show up as stolen funds, downtime, regulatory penalties and lost trust.
Direct fraud is the clearest cost. Business email compromise alone caused 2.77 billion dollars of reported losses across 21,442 complaints in the FBI’s 2024 figures making it the second costliest category in the report. These are wire transfers authorised by real employees who believed the request was genuine.
Downtime and recovery can dwarf the fraud itself. After its 2023 breach which began with a single phone call to the help desk, MGM Resorts reported a negative impact of around 100 million dollars in one quarter in its filing with the SEC.
Then there is the law. Under the Swedish Cybersäkerhetslagen and the EU NIS2 Directive, security awareness training is a required measure and a board-level duty with fines reaching into the millions for essential entities. A human-layer failure is now a compliance failure too.
Real-World Cases
These cases are not about exotic hacking. In each one an attacker reached a person and that person did something reasonable-looking that opened the door.
The Google and Facebook Invoice Fraud
Between 2013 and 2015 a Lithuanian national, Evaldas Rimasauskas, registered a company in Latvia using the name of Quanta Computer, a hardware supplier both Google and Facebook used. His team sent invoices and payment instructions that looked routine.
Accounts-payable staff at two of the most technical companies in the world paid them. More than 100 million dollars moved to accounts abroad before the fraud was caught according to the US Department of Justice. Both firms later recovered most of the money.
The control that defeats this is a payment rule, not a smarter inbox. Any change to a supplier’s bank details and any unusual payment request is verified by calling a contact you already hold before money moves.
The MGM Resorts Help Desk Call
In September 2023 attackers looked up an MGM Resorts employee on LinkedIn, then phoned the company’s IT help desk posing as that person. They asked for a password and multi-factor reset and the help desk complied.
That single call led to ransomware across MGM’s systems and days of disruption to casinos and hotels. The company reported a negative impact of around 100 million dollars for the quarter in its SEC filing. A joint CISA and FBI advisory later documented the help desk impersonation technique.
Here the fix is a stricter identity check at the help desk. Before any password or MFA reset especially for a privileged account, the agent confirms the caller through an approved, out-of-band method rather than trusting the story.
The Twitter Account Takeover
Over 14 and 15 July 2020, callers claiming to be Twitter IT phoned staff about a VPN problem and steered them to a look-alike login page. The captured passwords let the attackers into internal tools.
They compromised 130 accounts and posted a cryptocurrency scam from 45 of them, taking around 118,000 dollars in bitcoin as the New York Department of Financial Services set out in its report. More than a thousand employees had access to those internal tools at the time.
Two things would have blunted this. Phishing-resistant multi-factor authentication makes a password typed into a fake page useless, and limiting who can reach sensitive tools shrinks the number of people worth targeting.
The Human Firewall and Compliance
Training your people is no longer only good practice. Across the regimes that apply to Swedish and EU organisations, the human layer is written into the law.
NIS2 and the Swedish Cybersäkerhetslagen
The EU NIS2 Directive names security awareness training as a required measure under Article 21 and under Article 20 it makes the management body responsible for approving and overseeing security measures. Supervisory authorities can hold board members personally accountable.
Sweden transposed NIS2 into national law as the Cybersäkerhetslagen (SFS 2025:1506), in force on 15 January 2026. Fines reach up to 10 million euro or 2% of global turnover for essential entities. You can read more on our NIS2 compliance in Sweden page.
GDPR and DORA
GDPR Article 33 requires notifying the Swedish authority, IMY, of a personal-data breach within 72 hours and many such breaches begin with a phished employee. For financial entities, DORA Article 17 sets ICT incident-management duties supervised by Finansinspektionen. In both, a workforce that spots and reports early is what makes those deadlines achievable.
Reporting Deadlines Depend on Your People
Under Cybersäkerhetslagen the clock is tight. An early warning goes to MCF (formerly MSB) within 24 hours, a full notification within 72 hours and a final report within one month. You cannot report what no one noticed so fast human reporting is the first link in the chain.
How to Spot an Attack
Most social engineering shares a handful of tells. Teaching people to feel these in the moment is more useful than any single rule.
- Urgency and pressure: A demand to act now before you have a chance to check anything.
- Authority: A request that leans on a senior name or an outside body to discourage questions.
- An unusual channel or request: A chief executive texting about gift cards or a supplier changing bank details by email.
- A mismatch: A display name that does not match the address, a look-alike domain or an odd link destination.
- Secrecy: Being told to keep the request quiet or to skip the normal process.
Be honest about the limits. Modern lures can be clean, personalised and free of the old spelling mistakes and AI makes them better each year. Verizon’s own research found that awareness training did not reliably reduce the rate at which people click. Spotting attacks matters, but it is not a guarantee which is why the next section leans on process and technology as much as alertness.
How to Build a Human Firewall
A human firewall is built through steady habits across people, process and technology reinforced often enough that they hold under pressure.
People: Make security awareness training continuous and role-aware and run regular phishing simulations so staff practice on safe examples rather than live attacks.
Process: Write the verification rules down so payments, bank-detail changes and password resets each require a check through a second, known channel.
Technology: Give people tools that reduce the cost of a mistake from phishing-resistant multi-factor authentication to least-privilege access and easy one-click reporting.
The controls that matter most are straightforward.
- Verify any payment or change of bank details by calling a number you already hold, never a number in the message.
- Treat urgent, unusual requests as suspect even when the name or logo looks right.
- Report suspected phishing straight away and make reporting a one-click, no-blame action.
- Enforce phishing-resistant multi-factor authentication on email, VPN and admin tools.
- Verify identity at the help desk before any password or MFA reset especially for privileged accounts.
- Limit access to sensitive systems to the people who genuinely need it.
- Rehearse with phishing simulations and track whether reporting improves over time.
Your technology will keep improving and so will the attacks. The organisations that hold up are the ones that make verification a reflex and reporting a habit. Keep practising both and that is what turns a workforce into a human firewall.
