Human-factor risk is security exposure caused by people rather than by code alone. It includes mistakes, weak judgment, fatigue, poor password habits, careless sharing, and low awareness of common threats. In many environments, the human layer is the easiest place for an attacker to exploit because it is harder to patch than software.
This risk matters because many attacks succeed only after a person clicks a phishing link, approves a malicious login, reuses a password, or sends sensitive data to the wrong recipient. Defenders reduce human-factor risk with security awareness training, clear procedures, multi-factor authentication, cautious access controls, and verification steps for unusual requests. Good security programs treat behavior as part of the attack surface, not as an afterthought, because a well-trained user can stop an intrusion before technical controls are even tested.