In the pantheon of catchy cybersecurity slogans that should never have caught on, two about social engineering spring to mind almost immediately: “End users are the weakest link” and “attackers only have to be lucky once; defenders have to be lucky all the time.” Both of those statements have been repeated by practitioners for time immemorial and seem to make sense superficially, but should we be comfortable with the onus we put on end users to overcome the deficiencies of our defensive systems?

Read full article on Threat Post