Top security pros say human error and some very normal, common employee behaviors are the biggest risk of letting cybercriminals into your company’s networks. It turns out most of what keeps your Chief Information Security Officer and his or her team up at night is … you.

Well okay, not you exactly—but mistakes you and your co-workers might make that could expose the company to financial losses, customer reputation damage, sensitive plans and data in the hands of competitors or even harm national security in some cases.

In a fascinating study from Proofpoint, 55% of CISOs and CSOs called human error/lack of cybersecurity awareness the biggest risk for their business, no matter what cybersecurity solutions are in place.

Common employee behaviors

According to the experts these are the most common employee behaviors likely to result in cyberattacks:

Clicking on a malicious link or downloading a compromised file (43%) 

Falling victim to phishing emails (39%)

Intentionally leaking data (35%)

Unauthorized use of devices and software applications (35%)

Interestingly, while these experts were clearly aware of the risk employees pose to the business, 44% admitted they didn’t know who the most at-risk employees in their organization are.

Training and exposure to concept reinforcement is key

So what makes employees less likely to commit potentially harmful security gaffes, in most cases without meaning to or intending harm? Researchers note that ongoing security training is the key.

CSOs and CISOs agree with 73% saying their organization must improve its employee cybersecurity awareness training. Indeed, despite the numerous challenges facing CISOs, 49% have made it their number one priority this year.

Unfortunately, providing this training looks like an uphill battle. In the study, 54% of respondents said limited time and resources are an obstacle as they attempt to develop an effective program, and 50% don’t believe their board pays enough attention to delivering effective cybersecurity.

Easy things you can do to help

Be intentional about scrutinizing emails you receive. Something’s off? Double check with IT. Costs you nothing. 

Don’t share work devices with family. It’s a common thing but the problem is that your family won’t be as cautious you are

Receive a request from someone in the company that’s unusual? It hurts nothing to check in with them by phone or in person to clarify. Criminals love to steal credentials to pretend they are legit

© National Security Institute, Inc. www.nsi.org