DEV Community: Tuna Turacan

The Invisible Killer of Cybersecurity: Why Even the Best Tools Collapse Against Human Fatigue

Tuna Turacan — Fri, 02 Oct 2026 17:25:11 +0000

We’ve spent the last decade pouring money into shiny security stacks. SIEM platforms that ingest terabytes of logs. EDR agents that watch every process. Zero-trust architectures that assume breach by default. Threat intelligence feeds that update in real time. And yet, major breaches keep happening—not because the tools failed, but because the people staring at those tools were running on empty.

I call it the “Fatigue Defense” syndrome. It’s the quiet, unglamorous reason why sophisticated security programs still get blindsided. And almost nobody is talking about it honestly.

Alert Fatigue Is Only the Surface

We love to talk about “alert fatigue” like it’s a simple volume problem: too many alerts, not enough eyes. But the real issue runs deeper. It’s decision fatigue meeting circadian biology meeting the modern security operations center.

Our brains are not designed to maintain high-stakes vigilance for eight hours straight, let alone overnight. After a certain point, as fatigue accumulates, the cognitive functions required for sustained attention, working memory, inhibition and flexible decision-making can deteriorate. We default to heuristics. “This looks like the last one.” “I’ve seen this signature a hundred times.” “If it was real, someone else would have escalated it by now.”

Security tools are optimized for detection. Humans are optimized for survival under conditions of scarcity and rest. Those two systems are currently in open conflict inside most SOCs.

And the operational environment makes this problem harder. Security teams operate around the clock, while fatigue and sleep loss can degrade the cognitive functions required for sustained attention, working memory and inhibition. They don't need a zero-day when defenders are already operating under degraded cognitive conditions.

The Tools That Make It Worse

Here’s the uncomfortable part: many of the tools we celebrate are actively contributing to the problem.

Every new detection rule, every additional data source, every “high-fidelity” alert that still requires human judgment adds weight to the cognitive load. We’ve created environments where the people responsible for protecting the organization are among the most overloaded knowledge workers in the building. Then we act surprised when they miss things.

Worse, the metrics we use to measure success often reward the wrong behavior. Number of alerts triaged. Mean time to respond. Ticket closure rates. These numbers look good in dashboards and board presentations. They say almost nothing about whether the humans doing the work are still capable of careful thought by the end of their shift.

What Actually Helps

The solutions are less glamorous, which is probably why they get less attention than the latest AI detection model.

First, treat cognitive capacity as a finite resource that must be protected the same way we protect privileged credentials. That means designing shifts and escalation paths around human biology instead of pretending it doesn’t exist. Some organizations are experimenting with shorter, more intense shifts followed by real recovery time. Others are building “quiet hours” into their detection logic—automatically reducing low-value noise while preserving escalation paths for anomalous or high-confidence activity.

Second, stop measuring people by how many alerts they close. Start measuring the quality of decisions under load. Track how often analysts reverse earlier decisions once they’ve had rest. Look at the correlation between time-on-shift and false negative rates. The data is usually uncomfortable.

Third, design the tools differently. Adaptive alerting that considers the operational load on the team–queue depth, time on shift, alert complexity and escalation availability. Interfaces that reduce rather than increase decision load. Systems that are honest about uncertainty instead of presenting every detection as a binary “investigate or ignore.”

This is also where AI earns its place—not as a replacement for the analyst, but as a load-balancer. A system that knows the queue is deep, the shift is late, and the alert is ambiguous should say so, and should route accordingly. Human-AI teaming, in this framing, isn't about automating judgment. It's about protecting the conditions under which human judgment still works.

And finally, culture. The organizations that handle this best are the ones where it’s acceptable to say, “I’m cooked, I need someone else to look at this,” without it being treated as a personal failure. That cultural permission is rarer than it should be.

The Real Competitive Advantage

In a world where every company can buy roughly the same detection technology, the remaining edge is human. Not the mythical “rockstar” analyst who never sleeps, but teams that are deliberately protected from the conditions that destroy judgment.

The next major wave of breaches may not always come from a missing a CVE or failure to implement MFA. They may also be enabled by something much less technical: smart, well-intentioned people who were simply too tired to notice the pattern that didn’t quite fit.

We keep adding more sensors, more rules, more intelligence. Maybe it’s time we started subtracting the conditions that make those investments worthless.

Because the most advanced security stack in the world is still only as good as the most exhausted person looking at it.

Tariq, S., Chhetri, M. B., Nepal, S., & Paris, C. (2025). Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities. ACM Computing Surveys, 57(9), Article 224.

Cao, Y., Xie, T., & Ma, N. (2025). The impairments of sleep loss on core executive functions: General and task-specific effects. Sleep Medicine Reviews, 84, 102163.

Uetz, R., Bönninghausen, P., Hackländer-Jansen, L., & Henze, M. (2026). Can Risk-Based Alerting Mitigate Cybersecurity Alert Fatigue? preprint arXiv:2609.02465.

Chhetri, M. B., Tariq, S., Singh, R., Jalalvand, F., Paris, C., & Nepal, S. (2024). Towards Human-AI Teaming to Mitigate Alert Fatigue in Security Operations Centres. ACM Transactions on Internet Technology, 24(3), Article 12.

A New Cybersecurity Concept: Digital Shadow Security System

Tuna Turacan — Wed, 09 Sep 2026 15:27:56 +0000

An attacker can obtain the password, and even with added security, we can inadvertently grant malicious individuals access. Therefore, a system could be created that learns your behavior within the system over time and see if your behavior within the system aligns with your behavior.

For example, it can learn your typing speed, the times you generally use the system, and your mouse movements, and then display a behavioral match score every time you log in.

People don't behave the same way every day, of course, so the system creates a profile for you over a certain period, and if your behavior doesn't largely match, it requests verification with an authenticator.

If your behavior is not consistent with your previous behavior by 0% to 40%, there will be no restrictions, if the level is between 40% and 70%, continue monitoring and collect additional behavioral signals, if it's between 70-90 percent, sensitive access may be restricted and if the value is even higher, additional verification may be requested directly.

This protection system is an additional system and should not be used alone. Since, user behavior may change over time, someone else may use the user's computer, AI can make behavior mimicry easier and keyboard/mouse data may create privacy problems.

If this project is implemented, password, MFA, digital trust, and shadow security systems can be used together to provide stronger security.

Is Simply Sharing Photos Now A Danger?

Tuna Turacan — Mon, 07 Sep 2026 12:59:51 +0000

Today, billions of people actively use social media. Some people post many photos, videos, and stories publicly. In our digital age, there are many people who are influencers, make a living from social media or are content creators. But how safe is it to constantly share photos with everyone?

Even if we don’t share it constantly or at all, we can be at risk just with our profile picture. This is because deepfake videos can be created very well using only your photo. Sharing just one photo can trigger a chain reaction and put you in a difficult situation.

Nowadays, most photos and videos are not accepted as evidence in any crime unless they are from official or security cameras. This is because the videos that are prepared are so easy and professional. They can do whatever they want with just one photo of yours, publish it, and then demand money to have it removed. They make it so incomprehensible that you might say, "Did I really have a video like that?" If you’re thinking, "Everyone’s sharing their photos, nothing’s happening, so why would they use mine?", well, that’s entirely up to them. Because they don’t need to be hackers or anything like that to create deepfake videos.

In 2024, an employee in Hong Kong was tricked by a deepfake video of the company’s CFO into approving a $25 million wire transfer. Even though this event happened a few years ago, we are now facing far more advanced technology, and privacy is the most important thing protecting us.

Between 2023 and 2024 alone, deepfake scams increased by more than 200% worldwide. According to a report by cybersecurity firm Trend Micro, attackers can now carry out these attacks using free and easily accessible platforms that don’t require expertise.

Don’t share very clear photos of yourself with everyone. When an unknown number calls, don’t speak before the other person can intervene, as your voice could also be used. Perhaps in a few years, people will be afraid to even share their photos, and even the simplest photos will be manipulated and spread on the internet simply because it’s easy to do so.

Moreover, now scammers are creating fictional characters and using them. Criminals create new identities by combining real information belonging to different people. This realistic, AI-generated identity is being used in bank loan applications and money laundering operations. This threat is so significant that, for example, the Saudi Arabian Central Bank has temporarily suspended remote bank account openings after identifying more than 4.8 million suspicious identities.

Unfortunately, there is still no way to protect our photos, audio recordings, and videos other than not sharing them or only sharing them with our closest friends and family. Moreover, 84% of people no longer feel that a convincing video is real evidence. And one in ten people report that fake deepfake images of them have been created without their consent. It has been determined that deepfake photos of young girls are being used for blackmail and revenge purposes even in schools.

From now on, approaching every photo and video with skepticism, not trusting anyone directly, and protecting our privacy are the most important steps we can take. We are entering an era in the digital world where we cannot trust our eyes and ears; therefore, we must find new ways to establish trust.

Instagram Content Moderation: User-level observational study

Tuna Turacan — Thu, 03 Sep 2026 16:20:17 +0000

Observation period: August 2026- September 2026
Duration: 2 weeks

Due to the enormous amount of user-generated content shared on Instagram, effective content moderation is a crucial element for online safety and security. This study adopts a user-level observational approach to examine Instagram's content moderation and reporting mechanisms.

Objective: The aim of this study is to observe how Instagram responds to potentially inappropriate types of content and whether moderation results vary depending on the content's format. The study also aims to examine the effectiveness of Instagram's user reporting mechanism and the feedback provided to users following reports.

Research Questions

1)Does Instagram's observable moderation response differ between images, videos, and direct messages?
2)How often do user reports result in visible enforcement actions?
3)What types of enforcement actions are observed following reports?
4)How consistently does Instagram provide
feedback following a report?

Methodology: Over a period of 2 weeks, I reported over 50 pieces of content shared via Instagram Stories, over 20 Reels videos that I considered potentially inappropriate, and over 20 direct messages that I considered potentially inappropriate. I then observed Instagram's enforcement actions and the feedback it provided.

Fraud/fake accounts: Accounts created for fraudulent purposes and structured to resemble real user profiles were appeared more difficult to identify in observational tests based solely on profile and content. This could increase the importance of user reporting, especially if the account has just been created.

Hate speech: Users are given the option to filter specific words or phrases. However, in the tests conducted, some comments expressing the same meaning with different spellings were able to pass through the filtering mechanism.

Sexual/Inappropriate Content: Rapid intervention was observed in some content that could be clearly deemed inappropriate. Conversely, changes such as reducing the size of the content or censoring certain parts were found to make detection difficult in some cases.

User Reporting System: The effectiveness of user reporting appeared more limited in cases where it could not be automatically determined whether the content constituted a violation.

Feedback Consistency: While the user initially received feedback about the action taken after submitting a report, in some tests no additional notification was received regarding subsequent stages.

Findings: A difference was observed between content formats. Image-based content was found to be subject to moderation more frequently than video content. Only a small percentage of reported Reels videos were removed but some videos were subject to moderation after review. Direct messages, however, were different. In many cases, the notification did not result in an account ban. Instead, temporary messaging restrictions lasting a few days were observed, and in some cases, no visible action was taken.

**Limitations: 1)These observations are based on controlled user-level tests and do not provide information about Instagram's internal moderation models, datasets, or application infrastructure. Therefore, the findings should not be interpreted as a comprehensive evaluation of Instagram's content moderation system.

2)The original content was not available for retrospective analysis. Therefore, the study relies on the observations and moderation outcomes recorded during the observation period.
3)To protect user privacy and avoid unnecessarily reproducing potentially harmful material, original reported content and identifiable information were excluded from the published analysis.**

I hope this study contributes to a better understanding of the user-facing aspects of content moderation and provides useful observations for both users and platform stakeholders.