PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Human-centered security starts with a task someone can actually complete
Observe whether someone can act securely, get help and complete an authorized task. Turn obstacles into corrections with named owners.
By Pentesty
What NIST published and what we propose
On August 12, 2026, NIST published a concept paper on Human-Centered Cybersecurity. It introduces the goal of developing guidance and resources for the human aspects of cybersecurity. This is a concept paper, not an enterprise certification. The practical proposal below is Pentesty’s analysis of how to observe tasks and produce evidence of improvement.
Start with the secure outcome of a real task
Imagine someone realizes they shared a file with the wrong recipient. An assessment should follow how they find help, communicate the issue and request access removal. The goal is to check whether the process supports an authorized, understandable action, also considering the work of whoever receives the request.
Agree beforehand on what completing the task means: identifying the correct file, limiting access, notifying the owner and confirming the outcome. Use fictional content and a group informed about the exercise. Observation can then support a discussion about workflow design without exposing customer data or turning a simulated mistake into a judgment about an individual.
Observe the handoff between requesting and resolving
A visible help button may start a path that ends without a response. Check who receives the request, what information is needed and who has authority to act. If teams transfer the request, follow it through to the outcome; closing a ticket alone does not demonstrate that permission was removed.
This review complements the discussion of access throughout employment. The task must retain verifiable identities and approvals. An easier experience does not justify giving support staff broad powers or accepting requests from third parties without appropriate confirmation.
Measure the path without unnecessary surveillance
Define assessment questions before collecting records. Prefer the minimum needed to understand the task and restrict access to results. Compare process obstacles with context and an opportunity for explanation, rather than creating a ranking of people who needed help.
- Discovery: did the person find the correct channel without relying on an informal contact?
- Understanding: did the instruction identify the next action and its owner?
- Handoff: did the request reach someone authorized to resolve the problem?
- Completion: was there verifiable confirmation of the expected secure outcome?
Give each obstacle a correction that can be checked
If an instruction is ambiguous, revise the text and repeat the task with another participant. If authorization is missing, adjust the approval workflow and check its boundaries. If the requester receives no response, test the confirmation. Each change needs an owner, a deadline and an acceptance criterion tied to the task.
Pentesty’s analysis is that usability and technical verification need to inform each other. A person may complete the form correctly while the application retains improper access. Connect observation to the records supporting security controls and maintain the distinction between perceived completion and a confirmed outcome. Repeat the review when systems, owners or policies change.
Distinguish a correct denial from an avoidable obstacle. An unauthorized request should be refused, but the person needs to understand why and how to request the appropriate review. Test that response with participants in different roles. Evidence may show that the restriction worked while the guidance still needs improvement, allowing precise corrections to be assigned to each part of the process.
Frequently asked questions
Does the NIST paper create a mandatory certification?
The cited material is a concept paper introducing an initiative for guidance and resources. This article does not present it as a certification or an obligation applying to the business.
Does the assessment need to involve every employee?
An initial exercise can cover one task, informed participants and the people handling requests. Document the context and limitations before generalizing any result.
Should asking for help count as failure?
Asking for help may be the correct action. Observe whether the channel works and whether the team can resolve the situation with authorization, sufficient information and confirmation.
How can we check whether a change worked?
Repeat the task under comparable conditions and check the expected technical outcome. A clearer instruction needs to produce an authorized action and evidence of completion.
Sources and references
- Cyber Security Brazil: editorial news reference
- NIST CSRC: concept paper record, August 12, 2026
- NIST: Human-Centered Cybersecurity concept paper
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.