Blog

Stay updated with our new news!

The Security Myth: Why Your Best Defenders Aren’t on the Security Team

Hameem Dakheel | 01/12/2025 | Cybersecurity

Let’s be honest. When you hear the word “cybersecurity,” what comes to mind? Probably a team of hyper-focused experts in a dark room, staring at scrolling green text, defending the company from shadowy hackers. We treat them like guardians of a fortress, and we, the everyday employees, are just living inside the walls.
This model is comforting. It’s also completely broken. And it’s putting our companies at risk.

The biggest security breaches often don’t start with a sophisticated hack. They start with something mundane, something that looks like a normal part of a busy workday:

An urgent email. A finance employee receives a very convincing message from the “CEO,” requesting a last-minute transfer to a new supplier. This is a classic phishing attack known as CEO Fraud, where the only defense isn’t a firewall, but a skeptical employee who decides to verify the request first.
A rushed deadline. The marketing team, under pressure to launch a new promotional website, uses a cool third-party plugin to get the job done fast. Unbeknownst to them, the plugin has a well-known vulnerability, creating an open door for attackers. The cause wasn’t a malicious actor; it was a business decision.
A digital “gift horse.” We get the term “Trojan Horse“ virus from the ancient story for a reason. The original Trojans were defeated not by force, but by accepting a package that looked like a gift. Today’s attacks are the same: disguised as a helpful PDF invoice or a free software tool that an employee innocently brings inside our digital walls.

These aren’t just problems for specialists to solve. They are company-wide challenges. Relying on a small team of experts to catch every mistake is like having the best goalie in the world but no defenders on the field. It’s a losing strategy.

The Emergency Room Model of Security

Think about a hospital’s Emergency Room. The doctors and nurses there are heroes. They are brilliant experts who perform miracles when a crisis hits—a car crash, a sudden illness, a major injury. We absolutely need them.

But you wouldn’t go to the ER for a flu shot, a routine check-up, or advice on a healthy diet.

Too many companies today treat their security team like an ER. They are seen as the heroic experts you call after something has gone terribly wrong. The problem is, a company’s security isn’t built on crisis response; it’s built on preventative health. And a business that only relies on its ER is fundamentally unhealthy.

This model fails because it’s purely reactive. An ER doctor will stitch up your wound, but they won’t go back in time to stop you from tripping. In the same way, a security team can help clean up after a phishing attack compromises an account, but they couldn’t stop the employee from clicking the link. They are constantly dealing with the consequences of decisions made by others, all over the company.

True organizational health—and security—comes from the daily habits and choices made by everyone. It’s the “public health” system of the company. It’s the finance team practicing good “digital hygiene” by verifying payment requests. It’s the marketing department choosing tools that are healthy and safe from the start. It’s a culture where everyone is empowered to be their own “family doctor,” looking after the well-being of their own department.

When everyone practices preventative care, the ER is still there for true emergencies, but it’s no longer the entire healthcare plan. And a company that isn’t constantly in crisis mode is a company that can truly thrive.

From ER to Wellness Plan: The Proactive Solution

So, how do we get out of the reactive ER model? We start thinking like a public health official, not an ER surgeon. The goal is to create a company-wide wellness plan that makes safe choices easy and natural for everyone. It’s not about adding more rules; it’s about changing the environment.

1. Make the Healthy Choice the Easy Choice:

A cafeteria that puts fresh salads and fruit at the front of the line will sell more of them than one that hides them in a corner. The same principle applies to security. We must design our internal processes and tools—our “digital cafeterias”—so that the safest option is also the easiest one.

This isn’t just theory. In the late 2000s, Google suffered a sophisticated cyberattack known as “Operation Aurora,” where attackers gained access through targeted employees [1]. The incident proved that even with strong walls like a VPN, a compromised employee device could put the entire “fortress” at risk.

Their solution wasn’t just to build higher walls; it was revolutionary. In response, they created what became the world’s first major implementation of a “zero-trust” network, internally named BeyondCorp. In this model, they decided to trust no one by default—not even employees inside the network. Every single person and device has to be constantly verified for every single action. This was a monumental shift, creating a new, safer “paved road” for everyone to work on.

2. Embrace the “Second Opinion” Culture:

Before a major surgery, a good doctor encourages a second opinion. It’s not a sign of weakness or distrust; it’s a mark of diligence that ensures the best outcome and protects against single points of failure. This same logic should be a core part of our business culture.

This goes far beyond just having a developer review another’s code.

For Finance: It should be mandatory for any large payment to require approval from a second person.
For Marketing: A major ad campaign or press release should be reviewed by legal and PR to ensure it doesn’t create unintended risks.
For HR: Accessing sensitive employee data should create an alert that is reviewed by a peer.

A culture that embraces the “second look” stops honest mistakes before they become costly incidents.

3. Provide Real-Time Nudges, Not Just Annual Check-ups:

A fitness tracker that reminds you to walk every hour is far more effective at changing your behavior than a doctor telling you once a year to “get more exercise.” Timely, contextual advice works.

The alternative can be devastating. In March 2023, the popular YouTube creator Linus Tech Tips had several of their channels hijacked [2]. The attack was a classic Trojan Horse with a modern twist. An employee received a convincing email pretending to be from a potential sponsor. This email contained a malicious file disguised as a business PDF.

When the employee downloaded and opened the file, it executed malware that didn’t steal their password. Instead, it stole the session tokens from their browser. These tokens are what keep you logged into a service like YouTube. With these tokens, the attackers bypassed both the password and multi-factor authentication entirely, as their computer was now seen as a trusted, already-logged-in session. They used this access to take over the multi-million subscriber channels. This shows that even with good defenses, one innocent click on the wrong file can be the entry point.

Conclusion | Your Best Defenders

For too long, we’ve treated security like a trip to the emergency room—something we only think about after there’s been an accident. We’ve relied on a small team of heroic experts to patch the wounds, hoping they can keep up with the next crisis. As we’ve seen, that reactive model is fundamentally broken.

True resilience isn’t built in the ER; it’s built through a daily culture of wellness. It’s an environment where the safe choice is the easy choice, where getting a second opinion is standard practice, and where we learn with timely nudges, not just annual check-ups.

This shift doesn’t happen by decree. It happens through the thousands of small decisions made by every employee, every single day. Security is not a feature to be added or a box to be checked. It’s a shared responsibility.

So, the next time you receive an unusual email, are about to use a new app, or are defining a process for your team, ask yourself a simple question: “How can I make this choice a safer one for the company?”

The myth of the security expert as a lone guardian is over. The truth is that the company’s best defenders aren’t just on the security team. They’re in finance, marketing, HR, and operations. They’re in every department, at every level.

They’re you.