Colleague or colonizer? The weakest link in Cybersecurity: A postcolonial critique

In cybersecurity, the metaphor "the human is the weakest link" has become a dominant and often unchallenged narrative. It is widely used to explain security breaches and frame user behavior as the central problem. This framing tends to portray users as careless and irrational, masking systemic vulnerabilities and reinforcing power asymmetries where expert voices dominate. This thesis critically examines how expert discourse constructs the role of the human, particularly through the "weakest link" metaphor, and how this framing can contribute to the marginalization of users. The study is grounded in the premise that language shapes reality, and that metaphors not only describe but also prescribe thought and action. Conceptual Metaphor Theory is used to analyze how metaphors structure cognition, while Post-Colonial Theory provides tools to explore power dynamics and epistemic authority. The theoretical approach is supported by a background chapter that includes a comprehensive review of 42 research papers. Empirically, the study is based on semi-structured interviews with 20 cybersecurity professionals. The study uses thematic analysis alongside Foucault-informed Discourse Analysis to uncover recurring themes and examine how expert discourse shape understandings and boundaries of authority and responsibility. Findings suggest that the "weakest link" metaphor operates as more than a rhetorical device, it reflects and reinforces deeper institutional logics that resemble colonial structures. Expert discourse constructs users as either negligent actors or unlucky victims, shaping perceptions of what kinds of change are feasible. These constructs limit possibilities for reimagining the user role in cybersecurity in ways that meaningfully shift power. While some experts advocate reframing users as "the strongest link," such shifts often preserve the underlying asymmetries by re-inscribing expert control. The analysis reveals both parallels and tensions between the literature and empirical data, indicating that dominant framings are not only repeated but also resisted and negotiated in subtle ways. This thesis contributes a critical perspective to cybersecurity discourse, showing how metaphors shape and reflect the boundaries of agency, responsibility, and inclusion. It argues for rethinking how users are positioned, not just through softer semantics, but by altering the institutional and interpretive conditions that determine who get to speak in cybersecurity practice and research.