The expression “the users are the weakest link” is that it abdicates responsibility for stopping problems. Security professionals may believe that they did everything they could, but they’re really just giving up. The problem lies not with the user, but with the experts, says John Defterios. The user is an embedded component of organizational computer systems, he says, and it is negligent not to put in a set of comprehensive countermeasures to prevent, detect, and mitigate the anticipated failings of that component.”]
Source: https://www.darkreading.com/careers-and-people/security-experts-not-users-are-the-weakest-link