Socio-technical risk is risk created by the interaction of technology with people, institutions, incentives, and procedures. In cybersecurity, a tool is rarely dangerous on its own; harm often emerges from how it is configured, who can use it, what oversight exists, and what the organization rewards or ignores.
This matters because attackers target the human and organizational layer as much as the software layer. A model, platform, or admin console may be technically sound, yet still become a security problem if it has broad permissions, weak review, or unclear accountability. Defenders reduce socio-technical risk with least privilege, approval workflows, logging, segmentation, and real human override paths. The goal is not just to secure code, but to control decision rights and limit the blast radius when people make mistakes or incentives push systems toward unsafe use.