Human behaviour and decision-making are the primary determinants of cybersecurity outcomes, but the argument for human-centric cybersecurity has only recently gained traction.