Contemplating blame in cyber security

Cyber breaches continue to occur, powered by a global cyber-crime contingent. Some crimes are carried out by malicious insiders, but in many cases the breach is facilitated by an interplay of technical vulnerabilities and human errors. Cyber criminals might exploit a failure to install updates or poor configuration. They might deceive employees into clicking on a link or opening an attachment. Here, we highlight a blaming tendency when adverse incidents occur. We will explore the advisability of blaming, contemplate the considerations that come into play if blaming is deemed appropriate, and consider the consequences for the "culprit". We propose a "blame-free" way of responding to these kinds of events on the human level.