{"id":43193,"date":"2026-07-02T11:35:00","date_gmt":"2026-07-02T09:35:00","guid":{"rendered":"https:\/\/smartfense.com\/?p=43193"},"modified":"2026-07-02T11:35:05","modified_gmt":"2026-07-02T09:35:05","slug":"human-error-negligence-intent","status":"publish","type":"post","link":"https:\/\/smartfense.com\/en\/blog\/human-error-negligence-intent\/","title":{"rendered":"Human error, negligence or intent are not the same"},"content":{"rendered":"

Human error, negligence or intent are not the same<\/h1>\n

When something goes wrong in security, the explanation shows up almost on its own. It was human error. The phrase is reassuring because it closes the case before opening it. It also hides a problem, because it gathers under one label situations that barely resemble each other. The person who clicks in a hurry at the end of a long day, the one who reuses a password because nobody offered anything better, and the one who copies a database the week before resigning share a word and little else. According to the Verizon Data Breach Investigations Report, the human element remains present in a large share of the breaches analyzed each year. That figure tends to be read as a verdict against people. Reading it that way is, precisely, the first error, and that one is ours.<\/p>\n

What do we mean by \u201chuman error\u201d?<\/h2>\n

Human error is the gap between what a person meant to do and what actually happened. Defined with that precision, it leaves out much of what we usually put inside it. The psychology of error has worked on this distinction for decades. In Human Error<\/em> (1990), James Reason distinguished unintentional failures<\/strong>, the slips and mistakes of someone trying to get it right, from violations<\/strong>, the deliberate deviations from a known rule. They are different mechanisms, with different causes, and so they require different responses.<\/p>\n

The practical problem is that the \u201chuman error\u201d label erases that boundary. It lumps together the person who slipped without noticing, the one who took a conscious shortcut, and the one who acted to cause harm. When the diagnosis is that coarse, so is the treatment. And a coarse treatment tends to fail with all three at once. Worse, it hides the organization behind the person. If everything ends up being \u201chuman error,\u201d the environment that made that error likely never gets reviewed.<\/p>\n

How do error, negligence and intent differ?<\/h2>\n

It helps to separate three phenomena that everyday conversation confuses.<\/p>\n

Error<\/strong> happens when the person wanted to do the right thing and failed anyway. Attention was fragmented, analytical capacity drained, a bias did the rest. There was no decision to skip any rule. Human risk starts there, before the click<\/a>, in the conditions under which someone decides in front of the screen.<\/p>\n

Negligence<\/strong> appears when the person knew the rule and chose the path of least resistance. There is rarely malice. There is almost always an organization that set security to compete against the task that person has to deliver today. Reusing a password, postponing an update or sharing an access \u201cjust this once\u201d are shortcuts the environment makes reasonable.<\/p>\n

Intent<\/strong> is another matter. Here the person seeks to cause harm or gain an advantage. Sabotage, fraud, data theft before an exit. It is a minority of cases, but it exists, and no awareness campaign corrects it.<\/p>\n

Lined up, the difference is quick to see:<\/p>\n