What does anthropology have to do with cyber-security? Enis Bytyqi argues that both fields reveal how human habits and social structures quietly shape outcomes.
When hackers brought Marks & Spencer to its knees this year, they didn’t have to smash through a sophisticated firewall; all they needed to do was trick a help desk. By impersonating an employee, attackers convinced a third-party supplier to reset access credentials, handing them the keys to the company’s systems.
And the result of this small move was weeks of disruption, millions in losses, and a bruised reputation.
This attack was not an outlier. 95 per cent of data breaches in the past year were tied to human error. The uncomfortable truth is that the weakest link in cyber-security is not the servers or the software. It is not hiding somewhere deep. In fact, it is standing right in front of us. It’s the people in the organisation. Firewalls and filters won’t save you if the culture fails, when routine office politics, habits, or plain fear take precedence over vigilance.
The smallest habits make the biggest difference
The attack on the retailer underscores a deeper truth, one that lets us know that cyber-incidents are rarely just technical failures. To understand why employees click, comply, or stay silent, it is crucial to look beyond firewalls and into the human patterns that take place within organisations. That’s where culture comes in, and why cyber-hygiene cannot be treated as a universal checklist.
At its core, staying secure online starts with a simple term “Cyber-hygiene” It’s not really soap and water, but the principle is pretty much the same. Cyber-hygiene refers to the set of routine practices and habits that individuals and organisations follow to maintain the security and health of their digital systems. Much as personal hygiene protects the body from illness, good cyber-hygiene protects networks, devices, and data from threats like malware, phishing, and unauthorised access.
The anthropology of cyber-security
As someone with an anthropology background stepping into the world of cyber-security, I can’t help but see “cyber-hygiene” through the lens of culture. Just as customs, rituals and taboos vary across societies, the ways employees engage with security in the workplace are also deeply shaped by context.
In anthropology, we learn that no practice exists in isolation and that every action is guided by shared values, hierarchies and unspoken norms. This reminds us that even in the digital realm, human patterns and social structures quietly shape outcomes.
In this realm of cyber-security, with its glowing and flickering blues and purples and the skulls that so often appear in pictures illustrating articles, I keep thinking of the skulls that occupy such a central place in anthropology. In both worlds, they serve as symbols, of danger, of mortality, of power. Seeing these motifs repeated in digital culture makes the underlying patterns of behaviour and meaning stand out even more sharply to me.
A decision to report a suspicious email or to remain quiet, to reuse a password or to tick yet another box, can never be just an individual act in itself. This is why cyber-hygiene is not, and could never be, truly uniform. The values and expectations that shape it vary not only between countries and industries but even from one team to another within the same company. As a result, what may feel natural in one setting can feel quite disruptive, unnecessary or even threatening in another.
Taking account of culture
A recent EU-wide study found that cyber-behaviour is shaped not just by individual traits but by national culture, industry dynamics, and organisational norms. For instance, employees in highly hierarchical organisations may be hesitant to challenge authority or question unusual requests, making them more vulnerable to social engineering attacks. This is why standardised, “one-size-fits-all” cyber-security training often falls flat.
Instead, effective awareness programs must be culturally aware, and more nuanced when adapting to context, rather than assuming universal rules that are the same for everybody. It’s the sort of thinking that makes sense on paper, but falls apart in practice.
In many organisations, employees avoid reporting suspicious activity because they fear blame, embarrassment, or slowing down the workflow. Hierarchical structures amplify this problem: people protect themselves instead of protecting the organisation, and this ends up being one of the biggest obstacles to cyber-hygiene.
Hackers know how to exploit this. The smallest hacking attempt that goes unreported can be just as dangerous as one that goes unnoticed. Insider threats often thrive in environments where communication is poor and reporting mechanisms are weak. Organisations often overlook cultural blind spots, focusing too narrowly on technical measures while underestimating the effects of human behaviour.
Follow us on all social media platforms @dailyquery for news and analyses around the globe.
