The business case for human-centric security research

The security industry is saturated with content and research highlighting the latest technological advances, from cloud-based alarm management to biometric authentication tools. And while these innovations are vital to safeguarding businesses and assets, one critical factor remains conspicuously absent from the conversation: people. 

The human element - the End Users, operators, decision-makers, and everyone in between - is often relegated to the periphery of security research. Why? It's not for lack of importance. Understanding the people behind the systems is arguably more important than understanding the systems themselves.  

However, in a field driven by technological complexity, people and their behaviors can feel too nuanced and variable to quantify and analyze effectively. This blind spot could be costing the industry more than it realizes. 

The challenges of researching human factors 

Unlike hardware specifications or software capabilities, human behaviour is messy, unpredictable, and deeply contextual. And because the security market spans global organizations with vastly different needs, understanding the human drivers behind trends is even more complex. For example, a small business prioritizing theft prevention has little in common with a government agency securing classified information - or so it seems at first glance. The challenge lies in capturing the common threads. What motivates these organizations to adopt security solutions? How do human elements like trust, training, or perception impact the effectiveness of those solutions? And how do the core human behaviours you'll find in every workplace impact the future of our industry's solutions?  

Another hurdle is the diverse personas influencing buying decisions. Increasingly, security solutions aren't always purchased by security professionals. Decision-makers and influencers now include IT managers, facilities leaders, HR departments, and sustainability officers. Each brings unique priorities and challenges, further complicating the creation of human-centric security systems. 

Moreover, it's difficult to research users who are often invisible to decision-making: the employees who use access control systems daily or the security guards managing on-the-ground operations. Their experiences are rarely captured in the high-level analyses that dominate industry reports. How does a lack of proper training affect their ability to maximize the value of their systems? What friction points in their day-to-day tasks create vulnerabilities? These questions are critical but often go unasked. 

Why human factors deserve more attention 

Neglecting the human side of security can have significant consequences. Poorly understood user needs lead to misaligned solutions, creating inefficiencies and even security gaps. A system that's too complicated for users to navigate or fails to account for different use cases across verticals could render even the best technology ineffective. 

Focusing on human factors also opens new opportunities for differentiation. Organizations that understand their customers on a deeper level - their pain points, behaviours, and motivations - are better positioned to create tailored solutions and stand out in a competitive market. This understanding can be a game-changer as security becomes more about prevention than reaction. More importantly, understanding customers fosters trust, which research consistently identifies as one of the most critical influences in choosing a security partner. 

Moving toward human-centric security research 

How can the industry shift its focus to prioritise people? First, security professionals and researchers should invest in creating detailed personas of the End Users interacting with their products. This includes everyone from the C-suite decision-maker to the security guard on the ground. Mapping out their needs, pain points, and behaviours provides a more comprehensive foundation for product development. Additionally, expanding research methods beyond traditional market analysis is key. Qualitative approaches like interviews, beta testing, and even creating user communities can uncover insights that numbers alone cannot, revealing usability gaps and areas for improvement. 

There's also opportunity within our industry's challenges. We may serve an increasingly broad and diverse range of organizations, but by identifying their common threads, we can uncover new learnings. For example, what's effective in healthcare security may inspire innovation in retail or education. Cross-vertical research partnerships could uncover universal truths about human behaviour in security contexts. A human-centric approach doesn't end with product development. Continuous education and user support are critical to ensuring technologies are used as intended. This might involve creating more intuitive interfaces, offering comprehensive onboarding, or providing ongoing resource access. 

What questions should we be asking? 

As we look to the future, the security industry must ask itself how we can better understand the people we're designing for. What methods can we use to ensure their needs and experiences are front and centre in our research? And how do we reconcile the tension between the universal and the specific, capturing the diversity of human behaviour while identifying the commonalities that unite us all? 

The answers to these questions won't just shape the next generation of security solutions - they'll define the industry's ability to meet the evolving demands of its customers. People are the linchpin of every system, the drivers of every decision, and the ultimate test of whether our solutions succeed or fail.