This is one of the most repeated phrases in cybersecurity. You hear it at conferences. You see it in vendor marketing. You read it in security awareness training materials. "Employees are the weakest link in security."
It drives me crazy every time.
Not because it's completely wrong. People do click things they shouldn't. People do reuse passwords. People do fall for social engineering. But framing employees as the weakest link shifts accountability in a direction that doesn't actually improve security. And it gives security teams a convenient excuse for architectural failures.
If an employee clicks a phishing link and an attacker gets full access to your environment, that's not an employee problem. That's an architecture problem.
The question nobody asks
When a phishing attack succeeds, the industry reflexively blames the person who clicked. But the click is rarely the point of failure. The real question is: what happened after the click?
An employee clicked a link. Okay. Then what?
Did the attacker get credentials? If so, was MFA in place? If not, why not? If so, was it phishing-resistant MFA, or was it SMS-based MFA that the attacker bypassed with a real-time phishing proxy?
Did malware get installed? If so, was endpoint detection and response (EDR) running on the device? Did it catch the payload? If not, why wasn't EDR deployed?
Did the attacker gain access to internal systems? If so, how far did they get? Could they move from the compromised account to other systems? Could they escalate privileges? Could a compromised marketing coordinator's account reach production databases, financial systems, or customer data?
How long did the attacker operate before someone noticed? Was there monitoring in place to detect unusual login patterns, impossible travel, mass file access, or lateral movement? If the attacker was in the environment for weeks before detection, the problem isn't the click. It's the detection gap.
Each of these questions points to a control that the security team is responsible for. Not the employee.
Why the "weakest link" framing is harmful
When organizations internalize the idea that employees are the primary security risk, it creates several downstream problems.
It shifts investment toward awareness training and away from technical controls. Companies spend $50,000 a year on security awareness platforms and phishing simulation tools while running no EDR, no MFA on critical systems, and no centralized logging. Security awareness training is valuable, but it's one layer in a defense-in-depth strategy, not the primary defense. Treating it as the main investment assumes that if people just stop clicking, the problem is solved. That assumption fails every time.
It creates a blame culture around security. When employees are called the weakest link, they become afraid of making mistakes. They don't report suspicious emails because they're worried about being shamed, don't ask questions because they feel like they should already know the answers, and don't flag near-misses because they don't want to get in trouble. That's the opposite of what you want: a culture where someone who gets a phishing email forwards it to the security team without hesitation.
It lets security teams off the hook. “Our employee clicked a bad link” is a more comfortable narrative than “our security controls failed to prevent a routine phishing attack from becoming a full environment compromise.” If the employee is the weakest link, the architecture doesn't get examined, the gaps don't get addressed, and the same attack works again next time.
The truth is that every control that should have prevented the compromise, MFA, EDR, least privilege access, network segmentation, email filtering, monitoring, is the responsibility of the security and IT team. Not the employee. The employee's job is to do their actual job. Your job is to build an environment where one mistake doesn't cascade into a breach.
What the data actually shows
Every phishing simulation in history shows that some percentage of employees will click. The industry average click rate is somewhere between 10 and 30%, depending on the sophistication of the simulation. Some campaigns hit 50% or higher.
You're not going to train this to zero. Human curiosity, urgency, and pattern recognition work against you. A well-crafted phishing email that looks like it's from your CEO, references a real project, and arrives during a busy Monday morning will get clicks. The question isn't whether someone will click. The question is what happens when they do.
The companies with the strongest security postures don't have lower click rates. They have better containment. A click at these companies is a non-event because the architecture prevents it from becoming a breach.
MFA catches the stolen credentials. EDR catches the malware. Least privilege limits how far the attacker can move. Segmentation prevents lateral movement to critical systems. Monitoring detects the anomaly within minutes. The incident is contained before it starts.
That's the difference. Not better employees. Better architecture.
The controls that actually prevent phishing from becoming a breach
Instead of spending all your energy trying to prevent clicks, invest in the controls that contain the damage when clicks happen.
Phishing-resistant MFA. Not SMS codes, voice calls, or push notifications that can be fatigue-attacked. FIDO2 security keys or passkeys are cryptographically bound to the legitimate site and cannot be phished. Even if an employee enters credentials on a phishing page, the attacker can't use them because the MFA challenge can't be proxied. This single control eliminates the most common phishing attack path and is the highest-ROI security investment most companies can make.
Endpoint detection and response. EDR on every device, not just antivirus. Real EDR monitors process behavior, detects malicious activity, isolates compromised devices, and provides forensic data for investigation. If a phishing link delivers malware, EDR should catch it before it executes, or catch it during execution and contain it. CrowdStrike, SentinelOne, Microsoft Defender for Endpoint — pick one and deploy it on every device.
Least-privilege access. Every employee should have access to what they need and nothing more. A marketing coordinator should not have access to production databases. A sales rep should not have admin privileges in AWS. When an account is compromised, least privilege limits the blast radius to what that employee had access to — not everything in the company.
Network segmentation. Even within your internal network, systems should be segmented. Production should be separated from corporate. Development should be separated from production. Sensitive data stores should be in their own network segment with restricted access. This prevents an attacker who compromises an endpoint in the corporate network from reaching production databases without crossing additional security boundaries.
Email security. Modern email security platforms (Microsoft Defender for Office 365, Proofpoint, Mimecast, Abnormal Security) catch the majority of phishing attempts before they reach the inbox by analyzing sender reputation, link destinations, attachment behavior, and sending patterns. No filter catches everything, but a properly configured solution dramatically reduces the volume of malicious emails employees ever see.
Monitoring and detection. If an attacker gets past every other control and gains a foothold, you need to know fast. Centralized logging, alerting on suspicious activity (impossible travel, unusual login times, mass file downloads, privilege escalation), and someone actually monitoring the alerts. The difference between a minor security event and a catastrophic breach is often detection time.
What about security awareness training?
It still matters. But reframe what you're measuring and what you're training for.
Train for reporting, not just avoidance. A company where 30% of employees click but 25% also report the email is in a much better position than a company where 10% click and nobody reports. Reporting behavior is the leading indicator of a security-aware culture, and it gives your security team real-time threat intelligence that no tool provides.
Focus training on high-risk roles. Finance teams who handle wire transfers, executive assistants with access to sensitive calendars and communications, IT and engineering with privileged access, HR with access to employee PII. These roles face higher-risk social engineering attacks and should receive more targeted, more frequent training.
Use simulations to measure program health, not to punish individuals. Phishing simulations are useful for identifying trends, testing your email security controls, and measuring whether your security culture is improving over time. They're not useful for publicly shaming people who clicked or creating leaderboards of failure.
Train people on what to do, not just what to avoid. “Don't click suspicious links” is not actionable advice for someone who receives 100 emails a day and can't reliably distinguish legitimate from malicious. “If something feels off, forward it to security and we'll tell you if it's safe” is actionable.
The uncomfortable truth
Blaming employees is easy. Fixing the architecture is hard. It requires investment, planning, and ongoing maintenance. It requires acknowledging that the security team's job isn't just to educate employees about threats but to build systems that contain damage when education fails.
Employees will click things. That's a fact. Build your security posture assuming it will happen and you'll be prepared when it does. Build it assuming it won't and you'll learn the hard way that awareness training alone doesn't stop breaches.
Your employees aren't the weakest link. Your architecture is.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies.