What does anthropology have to do with cyber-security? Enis Bytyqi argues that both fields reveal how human habits and social structures quietly shape outcomes.
When hackers brought Marks & Spencer to its knees this year, they didn’t have to smash through a sophisticated firewall; all they needed to do was trick a help desk. By impersonating an employee, attackers convinced a third-party supplier to reset access credentials, handing them the keys to the company’s systems.
And the result of this small move was weeks of disruption, millions in losses, and a bruised reputation.
This attack was not an outlier. 95 per cent of data breaches in the past year were tied to human error. The uncomfortable truth is that the weakest link in cyber-security is not the servers or the software. It is not hiding somewhere deep. In fact, it is standing right in front of us. It’s the people in the organisation. Firewalls and filters won’t save you if the culture fails, when routine office politics, habits, or plain fear take precedence over vigilance.
The smallest habits make the biggest difference
The attack on the retailer underscores a deeper truth, one that lets us know that cyber-incidents are rarely just technical failures. To understand why employees click, comply, or stay silent, it is crucial to look beyond firewalls and into the human patterns that take place within organisations. That’s where culture comes in, and why cyber-hygiene cannot be treated as a universal checklist.
At its core, staying secure online starts with a simple term “Cyber-hygiene” It’s not really soap and water, but the principle is pretty much the same. Cyber-hygiene refers to the set of routine practices and habits that individuals and organisations follow to maintain the security and health of their digital systems. Much as personal hygiene protects the body from illness, good cyber-hygiene protects networks, devices, and data from threats like malware, phishing, and unauthorised access.
The anthropology of cyber-security
As someone with an anthropology background stepping into the world of cyber-security, I can’t help but see “cyber-hygiene” through the lens of culture. Just as customs, rituals and taboos vary across societies, the ways employees engage with security in the workplace are also deeply shaped by context.
In anthropology, we learn that no practice exists in isolation and that every action is guided by shared values, hierarchies and unspoken norms. This reminds us that even in the digital realm, human patterns and social structures quietly shape outcomes.
In this realm of cyber-security, with its glowing and flickering blues and purples and the skulls that so often appear in pictures illustrating articles, I keep thinking of the skulls that occupy such a central place in anthropology. In both worlds, they serve as symbols, of danger, of mortality, of power. Seeing these motifs repeated in digital culture makes the underlying patterns of behaviour and meaning stand out even more sharply to me.
A decision to report a suspicious email or to remain quiet, to reuse a password or to tick yet another box, can never be just an individual act in itself. This is why cyber-hygiene is not, and could never be, truly uniform. The values and expectations that shape it vary not only between countries and industries but even from one team to another within the same company. As a result, what may feel natural in one setting can feel quite disruptive, unnecessary or even threatening in another.
Taking account of culture
A recent EU-wide study found that cyber-behaviour is shaped not just by individual traits but by national culture, industry dynamics, and organisational norms. For instance, employees in highly hierarchical organisations may be hesitant to challenge authority or question unusual requests, making them more vulnerable to social engineering attacks. This is why standardised, “one-size-fits-all” cyber-security training often falls flat.
Instead, effective awareness programs must be culturally aware, and more nuanced when adapting to context, rather than assuming universal rules that are the same for everybody. It’s the sort of thinking that makes sense on paper, but falls apart in practice.
In many organisations, employees avoid reporting suspicious activity because they fear blame, embarrassment, or slowing down the workflow. Hierarchical structures amplify this problem: people protect themselves instead of protecting the organisation, and this ends up being one of the biggest obstacles to cyber-hygiene.
Hackers know how to exploit this. The smallest hacking attempt that goes unreported can be just as dangerous as one that goes unnoticed. Insider threats often thrive in environments where communication is poor and reporting mechanisms are weak. Organisations often overlook cultural blind spots, focusing too narrowly on technical measures while underestimating the effects of human behaviour.
In anthropology, silence is often as meaningful as talking. But, in cyber-security, silence can be catastrophic.
Illogical behaviour
Even when employees know better, they don’t always act accordingly. This paradox lies at the heart of the psychology of risk. Overconfidence (“it won’t happen to me”), fatigue from repetitive training, and disconnection from perceived threats all contribute to lapses in vigilance.
Habitual behaviour makes phishing emails particularly effective, even when staff are trained to spot them. Cyber-hygiene must therefore be not only about technical know-how but also about reshaping habits and mindsets.
Security awareness initiatives must consider these psychological realities. Strong cyber-hygiene requires ongoing reinforcement, realistic simulations, and habit-building strategies. Additionally, employees’ sense of community and collective responsibility strongly impacts how well they follow good practices.
Turning cultural vulnerabilities into strengths
Organisations can strengthen their cyber-resilience by addressing cultural weak points. Three key steps like can make a difference:
Context-specific training. Move beyond generic modules. Tailor programmes to your industry, organisational structure, and local culture. What works for a European bank won’t work for a UK retail chain.
Encourage reporting without fear. Foster a “just culture” where employees feel safe flagging suspicious activity. Treat mistakes as learning opportunities, not career threats.
Fight fatigue and overconfidence. Keep training fresh and engaging with realistic simulations and varied formats. Vigilance sticks when it’s practical, memorable, and part of the daily rhythm.
Cyber-security: much more than IT
The bottom line is that cyber-security is far more than an IT protocol. It should be a collective practice, a ritual that protects the organisation. Leaders who cultivate trust, openness, and vigilance can transform employees from the weakest link into the strongest line of defence. Cyber-security goes beyond technology. At its core it is also a cultural challenge.
To succeed with it, employees must feel safe reporting mistakes or suspicious activity, while security leaders must make efforts to refresh training regularly, update awareness programs with the latest threats, and weave vigilance into daily life. In the digital age, culture is the only firewall that truly matters.
