As a result of an increasingly digital society, an even higher demand regarding a reliable information security can be seen. In the past, IT-security was something that mostly affected the IT departments of organizations, today it has become an obvious part of the business. A majority of the safety measures that have been implemented in organizations earlier are of technical character. Nowadays, an increasing need to involve the user can be seen. The impacts of the human factor and human contribution can be seen as two main concepts with reference to theory within the area. In email security, which is in fact the most common attack vector, the human factor is taken advantage of in order to gain access to the organization. As the attacks are getting worse and appearing more frequently, the purpose of this study is to see in what ways organizations should and could work with the human factor and human contribution in order to succeed in their information security work. A literature study and semi-structured interviews have been conducted in order to gather empirical data. The results show that in order to succeed with the information security work, organizations have to take the cognitive abilities into consideration. This involves creating awareness around the topic, establishing an understanding and making sure the employees realize the consequences and impact an action can result in. A recurring challenge within organizations can also be seen regarding being able to meet the needs of each individual employee.