The human factor - an aviation lens on cyber security

Cyber security still treats humans as the weakest link. Aviation learned decades ago that this mindset fails. 

Under the theme "empowered together," this session—co-presented with a commercial airline captain—reframes the human as a critical safety control: one that must be designed for, supported, and continuously learned from, especially under pressure.

Drawing directly on the captain’s operational experience, we will bridge aviation safety science with modern cyber security practices across three core pillars.

Safety-I vs Safety-II

Cyber security largely reflects Safety-I thinking: analyse failures, identify root causes, and close gaps. The aviation industry, as the captain will explain through real cockpit scenarios, has evolved to Safety-II—understanding how success is achieved in complex, time-critical environments. Pilots operate safely not because procedures are flawless, but because they adapt effectively to variability. Translating this to cyber, we will explore how teams can move beyond post-incident reviews to examine "everyday success": how analysts triage alerts correctly, how users avoid phishing attempts, and how defenders make sound decisions under pressure. 

Attendees will learn how to embed this thinking into operations through positive-outcome reviews and adaptive, human-centred ideas.

The Swiss Cheese Model

Aviation assumes that all controls are fallible, and safety emerges from multiple overlapping layers of defence. The captain will illustrate how these layers function in practice—from checklists to crew cross-checking—particularly when workload and stress are high. In cyber security, however, there is often overreliance on singular controls. We will demonstrate how breaches occur when gaps align across technical and human layers, and how organisations can design defences that are resilient to real human behaviour. This includes reducing cognitive overload, improving signal clarity, and ensuring that when one control fails, the next action is intuitive under pressure.

The SHELL Model

A key insight from aviation, which the captain will bring to life, is that the critical focus of the model is the human participant, or Liveware. Liveware interface Software (procedures, policies), Hardware (tools, systems), Environment (operational conditions), and other Liveware (the human and their interactions with others). Errors are rarely individual failings—they emerge from mismatches between these elements. In cyber security, this systems view is often overlooked. We will demonstrate how applying the SHELL model can uncover hidden friction points: poorly designed interfaces that drive analyst error, ambiguous policies that lead to inconsistent decisions, and environmental pressures—like alert fatigue or time constraints—that degrade judgement. Attendees will learn how to recognise these issues to better support human performance, including clearer decision pathways, improved tooling and stronger team-based cross-checking mechanisms during high-pressure incidents.

Throughout the session, we will combine aviation case studies with cyber security parallels—spanning phishing response, SOC operations, and incident escalation. The focus is practical: how to design systems where humans are empowered to succeed, not set up to fail.