Maybe it's not a triangle. Maybe it's a circle.?

For decades, security professionals have referred to people as the weakest link.

At first glance, the argument seems logical. Human error contributes to phishing incidents, misconfigurations, weak passwords, and many other security challenges.

But is that really the full story?

When major incidents occur, technology and processes provide support, but it is people who ultimately make the difference.

• People communicate.
• People make decisions.
• People respond under pressure.
• People adapt when plans no longer fit reality.
• Technology enables capabilities.
• Processes provide consistency.
• People connect both.

Without people, processes become paperwork. Without people, technology becomes little more than hardware and software. The real value emerges when people understand, operate, improve, and continuously adapt both.

This perspective was reinforced by recent reflections from cyber incidents such as those shared by Odido and the Dutch Institute for Vulnerability Disclosure (DIVD). The lessons learned highlighted the importance of transparency, collaboration, leadership, and resilience during a crisis.

Perhaps people are not the weakest link after all.

Perhaps they are the strongest connector between process and technology.

The traditional security triangle of People, Process, and Technology remains highly relevant. Yet rather than viewing people as a vulnerability, organizations should consider them an essential enabler of resilience.

• Technology enables.
• Processes guide.
• People connect.

Together, they create resilient organizations.

What do you think?

Are people truly the weakest link in security, or are they the strongest connector between process and technology?