There’s one cognitive bias that we people are vulnerable to, and it lies on the centre of among the challenges that cybersecurity professionals face day by day. It’s generally known as the normalcy bias – what Dr. Lauren Braithwaite defines as “our tendency to underestimate the potential of catastrophe and consider that life will proceed as regular, even within the face of serious threats or crises.” It is why individuals hesitate after fireplace alarms go off or delay reacting in different unfolding conditions as a result of issues nonetheless seem manageable.
As this bias can lead us to mistake familiarity for security and assumptions for proof, it’s more and more getting in the way in which of coping with the cybersecurity actuality. It causes individuals to underestimate the probability of a cyberattack or to interpret an absence of apparent issues or penalties as proof that dangers are below management. In follow, many organisations deal with an absence of clear alerts from their chosen safety platform(s) as proof that the whole lot is hunky-dory. Others fail to behave shortly sufficient on warning indicators as a result of they assume that enterprise will merely proceed as ordinary.
In the meantime, regardless of a gradual drumbeat of stories headlines on breaches at organisations like M&S, JLR, and Co-op (and most breaches by no means really make it to the entrance pages), and recommendation from the cybersecurity business and authorities organisations about tips on how to keep away from turning into the following sufferer, the variety of main incidents continues to rise at an eye-watering fee.
The NCSC Annual Evaluation 2025 reported 204 “nationally vital” cyberattacks within the 12 months to August 2025, a 130% improve from the 89 reported within the earlier yr. Of 429 complete incidents, 18 had been categorized as “extremely vital,” marking a 50% improve in extreme incidents. Breach charges stay stubbornly excessive, which can mirror a creeping normalisation of breach danger and be seen as normalcy bias at scale: the extra widespread breach disclosures grow to be, the much less urgency each could carry.
Classes learnt?
There’s a phrase that’s peddled out by governments and corporations alike when a disaster of any sort – together with a cybersecurity breach – happens: “Classes have been learnt”.
However have they? The 130% improve in vital incidents between 2024 and 2025 severely challenges this assertion and factors to classes not being learnt, at a macro stage. Looks as if an enormous no!
Final yr I wrote a weblog put up which will, partly, clarify the psychological state after a breach. I argued that many corporations are, in a way, each breached and never breached, concurrently, and I likened this example to Schrödinger’s cat. Till you open the field by interrogating logs or actively looking for a compromise, the consolation of “we haven’t been breached” merely displays the truth that no-one has really checked. In actual fact, this reluctance to look may be normalcy bias quietly doing its work.
“Classes have been learnt” is the aftermath of opening the field, discovering the cat to be (sadly) deceased, after which declaring: “we all know what’s occurred, we’ve received a deal with on this, don’t fear”. That is narrative, not proof of a significant change in strategy.
In contrast, actual studying is a proactive course of that adjustments how organisations have to behave. This must be mirrored in adjustments to budgets, insurance policies, guidelines, restoration planning, provider scrutiny, logging, monitoring, coaching, and the tolerance for error, to call just some issues. And all performed earlier than the inevitable breach takes place. It’s way more tough to hit a transferring goal, in spite of everything.
So, if we will settle for that normalcy bias is a standard and human cognitive situation, we will progress in the direction of avoiding complacency earlier than a breach and minimise its impression. ‘To err is human’, however now we all know what the failing is, now we have an crucial to behave upon that data – and do issues in a different way.
Endgame: what if we nonetheless don’t recognise this bias?
The legal ‘auditors’ are banking on human error. In spite of everything, it’s why phishing continues to be probably the most prevalent ways in which breaches happen.
There are two principal methods through which the endgame performs out in cybersecurity.
Both we repeatedly audit ourselves – run penetration testing, pink/blue/purple workforce and different assault simulation workout routines, repeatedly re-evaluate the menace panorama, and spend money on our safety provision as a part of our cyber resilience technique.
Or we permit cybercriminals to do the ‘audit’ for us. They depend on a false sense of safety (actually), and that is the chink within the armour they exploit.
Criminals ‘auditing’ you will be brutal, pricey, devastating and, in lots of instances, terminal for organisations. That’s the reason this metaphor issues – cybercriminals uncover the hole between what an organisation believes about its safety and what the actuality is.
To place issues into perspective, ESET’s menace intelligence processes 750,000 suspicious samples, analyses 2.5 billion URLs whereas blocking 500,000 of them – day by day. Risk actors are relentless, and as their assaults grow to be increasingly more subtle, now we have to ditch any thought that we’re impervious. We should settle for that normalcy bias exists and act upon it.
Within the face of a lot of high-profile retail breaches within the UK, ESET performed analysis with 2,000 shoppers. The ensuing report revealed, amongst different issues, that 46% of consumers stated it will take them 5+ months to rebuild belief after a knowledge breach. That’s an costly audit! One must do the straightforward math to estimate the direct monetary injury if that’s all of the senior administration are fascinated by. All by itself this could suffice regardless of the very fact that is typically the tip of a really painful iceberg.
The underside line
A side of normalcy bias that I discover most intriguing is that, regardless of the elevated sophistication, velocity, quantity and number of assault vectors we’re all conscious of, our strategy to cyber resilience methods typically stays rooted up to now – even whether it is comparatively current previous. However time passes shortly in cybersecurity, and within the 4 or 5 minutes it’s taken you to learn this text, ESET may have processed over 2,000 suspicious samples and scanned approx. 7 million URLs blocking approx.1,500 of them.
When asking why we must always assessment cybersecurity providers provision, are we accounting for all parameters which have modified (globally in addition to regionally) in the previous few years and the way it might have an effect on our present safety posture?
Proper off the highest of your head, you may in all probability title at the least a couple of of those:
- Rise of AI-enabled fraud and different threats.
- The conflict in Ukraine.
- Iran.
- Enhance in price of cybercrime worldwide.
- Deepfakes.
- Elevated social engineering assaults.
- Persistence of phishing as the principle assault vector.
- Elevated complexity of cybersecurity options and providers.
- Cyber abilities gaps remaining worryingly vast.
There are lots of others, little question. And it’s no coincidence that the extent of safety provided by distributors only some quick years in the past is being phased out, and MDR/XDR/MXDR providers and options have gotten the norm.
The legal ‘auditors’ actually haven’t sat again on their laurels in that point. While using new instruments, like AI, doesn’t essentially imply higher coding, it does allow them to scale assaults massively – and it permits them to scan for vulnerabilities at an unprecedented tempo.
- For those who aren’t investing in auditing, testing, cyber consciousness, and prevention applied sciences, you’re not saving cash – you’re merely outsourcing assurance to the criminals.
- Probably the most engaged C-suite are with cybersecurity is instantly after a pricey breach – after normalcy is shattered. Make them have interaction earlier.
- Criminals work 24 hours a day, around the clock with agentic AI by their facet. Are your options resilient sufficient to manage? Verify.
- Regardless of the measurement of your organisation, you want to take a look at your cyber profile and resilience consistently.
- Don’t mistake (incident) silence for security – spend money on 24/7 MDR/MXDR providers.
- Now in regards to the ‘normalcy bias’ entice – keep away from it.
