# Principal Researcher

Source: https://startwithidentity.com/experts/cormac-herley/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Bio

Cormac Herley is a principal researcher at Microsoft Research. His 2009 paper argued that users reject security advice because the arithmetic favours rejection: the advice imposes certain, measurable effort now against a small and uncertain expected loss, and the people giving the advice never account for the aggregate cost of following it.

Profile built from public research and publication records.

## Where their work shows up

This is the argument that made "blame the user" untenable as a security posture. If a control only works when millions of people absorb a cost nobody measured, the control is the problem. It is the intellectual basis for judging authentication by friction as well as strength, and for the conclusion that [passwordless](https://startwithidentity.com/guides/fundamentals/what-is-passwordless/) methods succeed where policy exhortation failed. See [credential stuffing](https://startwithidentity.com/techniques/credential-stuffing/), [MFA fatigue](https://startwithidentity.com/techniques/mfa-fatigue-push-bombing/), and [help desk social engineering](https://startwithidentity.com/techniques/help-desk-social-engineering/).