A technology-centric approach to cybersecurity is essential, but not sufficient. The nation’s recent history of data breaches, many of which began with phishing attacks, suggests that agencies need to take a people-centric approach as well.