The security of information systems is often approached through a technology‑centric lens. Yet, independently of any technology, another persistent threat exists: human individuals themselves. This presentation proposes a paradigm shift by considering humans as full‑fledged components of information systems that may, like any technical element, constitute insider threats.
Both academic research and professional communities have long highlighted insider threats, particularly those arising from legitimate users who fall victim to phishing attacks. When interacting with digital systems, humans tend to transpose interpersonal trust and distrust mechanisms to technical artifacts. These cognitive mechanisms, deeply rooted in human behavior, constitute a critical attack surface within information systems.