What is Missing? An HFACS Analysis of the VERIS Community Database
TL;DR
Results suggest that current public reporting can identify the type of error that occurred, but is limited in explaining why it occurred, and suggest that current public reporting can identify the type of error that occurred, but is limited in explaining why it occurred.
Abstract
Human action drives most cybersecurity breaches, yet industry reports rely on vague labels that lack diagnostic utility. This study evaluates whether public incident narratives from the VERIS Community Database provide the context required for systemic intervention to 45 Action.Error records from 2020 to 2021 were analyzed across three error varieties: misdelivery, misconfiguration, and publishing. Using the Human Factors Analysis and Classification System, we applied a strict evidence-based coding strategy to map narrative to systemic levels. Our results reveal a significant diagnostic gap: while narratives consistently support Level 1 (Unsafe Act) coding, evidence for latent preconditions, supervision failures, and organizational influences remains largely absent. Specifically, misdelivery and misconfiguration align cleanly with skill-based and decision errors, but the causal chain stops at the individual. These findings suggest that current public reporting can identify the type of error that occurred, but is limited in explaining why it occurred.