NIST releases human-centered cybersecurity concept paper

The National Institute of Standards and Technology (NIST) has released a concept paper regarding human-centered cybersecurity (HCC) and is currently seeking stakeholder input. This new approach aims to prioritize the needs, capabilities, and limitations of individuals during the design, deployment, and decision-making stages of cybersecurity systems.

NIST defines HCC as a method that views people not merely as vulnerabilities, but as active defenders, reporters, and troubleshooters. The agency noted that failing to address human factors—such as the use of weak passwords, misconfigured settings, or the adoption of insecure workarounds—can lead to security professional burnout, employee frustration, noncompliance, and financial or reputational harm.

The proposed guidance intends to supplement existing NIST publications by addressing gaps that traditional employee awareness training may not resolve, such as difficult security processes or organizational culture. The development of these resources is informed by feedback from researchers and practitioners collected through workshops, interviews, and surveys.