Emotional intelligence is the ability to empathize, control our own emotions, and interact with others in a way that accounts for the role feelings play in how people make decisions. In many fields, including education, marketing, and sales, the importance of emotional intelligence is widely acknowledged. But it’s somewhat unusual to hear about emotional intelligence in the cybersecurity space.

That should change. Emotions may not be the first thing that comes to mind when we think about cybersecurity, but they play an important role because people are still at the center of efforts to keep data safe, and hackers play on users’ emotions to gain access to confidential information. Here are just a few examples of how emotional intelligence comes into play in cybersecurity:

• According to Verizon’s 2019 Data Breach Investigations Report, phishing remains a top attack vector, with people falling for scams designed to bypass cybersecurity measures.
• Hackers are getting more emotionally intelligent; sophisticated cybercriminals analyze when potential victims catch on to attempted scams and develop more convincing ruses.
• In the cybersecurity world, user security awareness training is considered a must and has been adopted by many companies, but data breaches are still on the rise.

As long as people fall for phishing scams and hand over their credentials or grant access to sensitive data, emotional intelligence will be a relevant factor in cybersecurity. It doesn’t matter how well defended a system is if hackers can con employees into bypassing protections by playing on their emotions with “urgent” messages purportedly from trusted sources that demand immediate action.

So, what can you do to bring your cybersecurity emotional IQ up? The first step is to realize the role emotional intelligence plays in security and look for ways to incorporate best practices. Here are some tips on how to use emotional intelligence to beef up cybersecurity and foil attacks:

• Use positive language when discussing cybersecurity. Discussions about cybersecurity tend to focus on the negative consequences of failure. While it’s essential to understand the risks, concentrating on the dangers exclusively can make discussions unnecessarily negative, which isn’t conducive to productive dialogue. Instead, focus on the positive aspects of protecting the company and customer data. Recognize and reward good practices when you encounter them.
• Be empathetic with users. Practicing emotional intelligence means not only understanding how emotion drives your own behavior but also recognizing how feelings motivate others. Employees are busy, and many are under an incredible amount of pressure. That doesn’t excuse careless behavior that can lead to data breaches, but it’s a good idea to put yourself in employees’ shoes and frame conversations about cybersecurity in empathetic terms.
• Demonstrate that position is no protection. It’s easy for high-level, savvy people to assume that their knowledge and position will protect them from scammers. The rise of so-called “whaling” attacks shows the fallacy of that logic. Whaling attacks target high-profile individuals like c-suite executives, who typically have more access to sensitive data. Convey that employees at all levels are at risk and that even the savviest team members can fall for scams.
• Teach staff to be suspicious of urgency. Successful attacks often play on employees’ desire to respond to urgent situations quickly. There are many examples of “spearfishing” attacks where hackers impersonate executives with an urgent request to lure employees into exposing data or transferring cash or goods. That’s how hackers got access to Snapchat payroll information a few years ago; a cybercriminal impersonated the CEO to gain access to the data. Educate employees to be suspicious of such requests and make a phone call or send a separate email to confirm.
• Make security awareness training engaging and personal. Rigorous training is a great idea, but it’s no panacea. Companies already invest millions in training, and they still get hacked. Security training is another area where emotional intelligence can be a success factor: Some training program designers seem to forget that boredom is an emotion too. A monotonous training class is unlikely to hold staff attention long enough to impart knowledge, so make training engaging and relatable for employees. One useful technique is to use real-world examples in training.
• Use technology that minimizes the damages that result from human error. Even if you create an emotionally intelligent cybersecurity strategy, people will inevitably make mistakes. Take the reality of human nature into account when creating your cybersecurity plan by adding protection like AppGuard, which shuts down malware at the kernel level and prevents malicious apps from causing harm, even if an employee accidentally introduces a virus into the system.

To ensure that you maximize your organization’s emotional intelligence defenses against cyber threats, honestly assess your current security posture through that lens and identify areas for improvement. Think of it as a range, with the worst actions at one end and the best at the other. Then, create a plan to improve your security posture through better emotional intelligence.

In the digital world, it can be easy to lose sight of the emotional dimension of the operations we perform. This will only increase as AI becomes more dominant. Too many experts are expecting AI to address the risks that other cybersecurity tools have failed to defeat entirely. But as long as the human element remains, emotional intelligence will be an essential part of an effective cybersecurity strategy.