Chapter 4 explores the human dimensions of cybersecurity. Steps that nation-state attackers use to penetrate an organization through phishing and social engineering are described as well as responses that defenders can take to protect themselves. These include hardening facilities, controlling remote access, educating security personnel and users on security hazards, using reputational services, and running an effective security operations center. Because people play a central role in cybersecurity, the chapter also examines limitations on human judgment, captured in the phrase “cognitive biases,” where preconceived notions and biases shape how we organize and respond to challenges. The chapter closes with discussions of applications of economics to cybersecurity and cybersecurity risk evaluation.