Security experts are always blaming employees for letting criminals into company networks. Workers don’t heed warning messages on their screen. They fail to see the obvious signs that an email is fake. Yet our research shows that another culprit is to blame for the failure to heed warnings—the human brain. The peculiarities of the way our brains work bias much of our behavior, including how we respond to security warnings.

---