You've almost certainly seen the statistic before. It's one of the most quoted lines in the IT security industry: "Over 80% of all security breaches happen because of human error."
The line is often used as a wagging finger. As proof that employees are the weakest link in the chain.
But what if that claim is both true and fundamentally wrong at the same time?
In this article, we take a closer look at exactly that.
Why the claim is true
It's unhealthy to ignore facts. The reason the 82% figure keeps showing up study after study (including Verizon's DBIR) is simple: hacker attacks rarely hit the code first. They hit the person.
Hackers rarely attack an impenetrable technical firewall if they can instead send a well-crafted phishing email, a fake login link, or make a cunning phone call to a busy employee.
People are the primary entry point to company data, because we:
- React to urgency, authority and emotion.
- Make quick decisions in a busy everyday life.
- Reuse passwords or fall for convincing phishing attempts.
When a security breach is analysed in hindsight, you can almost always point to a moment where a person clicked, approved, or entered information. In that sense, the statement is correct.
Part 2: Why the claim is "wrong" (it's a design problem)
Here's the catch: pointing at the human as "the error" is like blaming a driver for crashing on a road with no signs, no lighting, and a sharp bend hidden behind a hill crest.
If a system makes it easy to do things wrong, then it will be done wrong.
Calling 82% of security breaches "human error" is only true once we factor in the design too. Here are three reasons why:
1. Poor system design forces people into mistakes
If an employee has to get through 5 complicated logins, change their password every 14 days, and use heavy workflow processes, workarounds appear. Employees write passwords on sticky notes or send documents to private email addresses just to be able to do their job at all. That's not negligence. It's a system working against the user.
2. Technical barriers failed first
Before a phishing email even reaches an employee's inbox, it has already passed through the company's spam filters, mail gateways and security configurations. When an employee clicks, that's the last line of defence failing, but it was the technical security layer that let the threat through in the first place. That's exactly where the employee needs enough training to be able to spot it.
3. Absence of security "airbags"
A well-designed system accounts for the fact that people are people. If a single click from a single employee can bring down the entire company network, the problem isn't solely the employee's behaviour.
From "the human is the problem" to "human-centred security"
If we only place the blame on employees, we build an unhealthy culture of fear. Employees who are afraid of making mistakes stop speaking up when something goes wrong, and a breach is then only discovered once the damage is irreversible.
The solution is neither to ignore the human factor nor to leave everything to technology. The solution is to bridge good system design and trained behaviour:
- Make the right choice the easiest choice: Reduce the complexity of your systems, so security doesn't feel like a roadblock in everyday work.
- Train behaviour instead of assigning blame: Give employees manageable, relevant and continuous training in recognising threats, so they become an active part of the defence, as a human firewall.
- Build forgiving systems: Put technical safety nets in place (e.g. MFA, proper access management and automatic detection), so a single wrong decision doesn't lead to a disaster.
Conclusion
People aren't the weakest link. People are the most flexible and alert piece of your defence, if they're given the right conditions.
Most of those mistakes arise in systems and processes that are poorly designed.
Want to know more about how to build a strong security culture, where employees are helped instead of pointed at?
Contact us for a no-obligation chat >>