Human error remains the top cybersecurity threat, survey finds

Human error as the top cybersecurity threat

According to a survey conducted by Kaseya, 68% of security professionals view human error as the most concerning attack vector over the next 12 months. This finding underscores the persistent challenge of mitigating risks stemming from user behavior, such as falling for phishing scams or mishandling sensitive data.

The survey also revealed that 80% of recent security incidents can be traced back to poor user practices or a lack of adequate training. These incidents highlight the gap between cybersecurity policies and their implementation at the user level.

Email attacks and social engineering risks

Email-based attacks remain a significant concern, with 55% of security professionals citing them as a primary vulnerability. This aligns with the broader issue of social engineering, where attackers exploit human psychology to gain access to systems or data.

Additionally, 41% of respondents identified gullibility as a risk, while 40% pointed to insufficient cybersecurity training for users as a contributing factor. These findings suggest that traditional security measures, such as firewalls and encryption, are insufficient without addressing the human element.

Resource and budget constraints in IT departments

The Kaseya survey highlights a disconnect between cybersecurity risks and available resources. Only 20% of IT departments reported that their budgets are growing in line with the threats they face, while 77% described their teams as under-resourced.

Nearly half of the respondents (49%) also noted that incomplete documentation and procedures could create compliance and security challenges. Despite these concerns, 65% of IT professionals believe their organizations would pass a compliance audit today.

Expert perspectives on cyber resilience

David Baggett, SVP and GM of Security Suite at Kaseya, emphasized that the goal of cyber resilience is not to eliminate mistakes but to build organizations capable of withstanding them. He stated that the path to true cyber resilience involves expecting mistakes, accounting for constraints, and engineering systems to mitigate their impact.

This perspective aligns with the survey’s findings, which suggest that organizations must adopt a proactive approach to cybersecurity, combining technology with robust training and procedural safeguards.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This survey reinforces what many cybersecurity operators already know: technology alone cannot solve the security challenges organizations face. The human element—whether through error, lack of training, or social engineering—remains the weakest link in the chain. For founders and operators, this is a reminder that cybersecurity strategies must extend beyond tools and policies to include continuous user education, realistic budgeting, and a culture of accountability.

The fact that 77% of IT departments feel under-resourced is particularly telling. It suggests that many organizations are operating with a reactive mindset, addressing risks only after they materialize rather than investing in preventative measures. For startups, this presents an opportunity to differentiate by prioritizing cybersecurity from the outset, rather than treating it as an afterthought.

Key takeaways

• Human error is the dominant concern for cybersecurity professionals, accounting for 80% of recent incidents. Founders should prioritize user training and awareness programs as part of their security strategy.
• Email-based attacks and social engineering remain critical vulnerabilities. Implementing multi-factor authentication and regular phishing simulations can help mitigate these risks.
• Most IT departments lack the resources to keep pace with cybersecurity threats. Startups should advocate for realistic budgeting and demonstrate the ROI of proactive security measures.
• Cyber resilience is about more than preventing mistakes—it’s about building systems that can recover from them. Operators should focus on creating redundant safeguards and clear incident response protocols.
• Compliance is not the same as security. Even if 65% of IT professionals believe they would pass an audit, the survey highlights gaps in documentation and user practices that could undermine long-term security.

FAQ

Why is human error such a significant threat in cybersecurity?

Human error is a significant threat because it often bypasses technical safeguards. Even the most advanced security systems can be compromised by simple mistakes, such as clicking on a phishing link, using weak passwords, or mishandling sensitive data. The Kaseya survey found that 80% of recent security incidents involved poor user practices or lack of training.

What are the most effective ways to mitigate human error in cybersecurity?

Mitigating human error requires a combination of training, technology, and procedural safeguards. Regular cybersecurity awareness programs, phishing simulations, and clear policies for handling sensitive data can reduce risks. Additionally, implementing multi-factor authentication and automated monitoring tools can help detect and prevent errors before they lead to incidents.

How can startups address cybersecurity with limited resources?

Startups can prioritize cybersecurity by focusing on high-impact, low-cost measures. This includes training employees on basic security practices, using open-source or affordable security tools, and implementing multi-factor authentication. Demonstrating a commitment to security can also help build trust with customers and investors, potentially attracting budget allocations for more advanced measures.

Related on Lazyfounder

• More technology news