Around 60% of firms experienced data loss or exfiltration caused by an employee mistake on email in the last 12 months, according to new research.

Data collected by the Ponemon Institute and Tessian revealed email as the riskiest channel for data loss in organisations, as stated by 65% of IT security practitioners.

This was closely followed by cloud file-sharing services (62%) and instant messaging platforms (57%).

Furthermore, most respondents (54%) said that the primary barrier to securing sensitive company data is the lack of visibility of sensitive data that is transferred from the network to personal email.

More than half (52%) of respondents say it is the inability to detect anomalous employee data handling behaviours and the inability to identify legitimate data loss incidents.

Due to this lack of visibility, it can take IT security teams almost three days to detect and remediate a data loss and exfiltration incident caused by a malicious insider on email and up to 48 hours to detect and remediate an incident caused by employees.

Commenting on the stats, Josh Yavor, Chief Information Security Officer for Tessian, said: “Most security awareness training programs focus on inbound threats yet fail to adequately address the handling of sensitive data internally. But data loss – whether accidental or intentional – is a major threat and should be treated as a top priority.

“To create awareness and mitigate data loss incidents, organisations need to be proactive in delivering effective data loss prevention training while also gaining greater visibility into how employees handle company data.

“Security awareness training that directly addresses common types of data loss – including what’s okay to share with personal accounts and what’s not okay to take with you when you leave a company – and a culture that builds trust and confidence among employees will improve security behaviours and limit the amount of data that flows out of the organisation.”

The report also found that most organisations (73%) are concerned that employees do not understand the sensitivity or confidentiality of data they share through email.

Despite these findings, nearly half of IT security leaders surveyed (46%) say their programmes properly address the sensitivity and confidentiality of the data that employees can access on email.

Larry Ponemon, chairman and founder of the Ponemon Institute said: “This study showcases the severity of data loss on email and the implications it has for modern enterprises.

“Our findings prove the lack of visibility organisations have into sensitive data, how risky employee behaviour can be on email and why enterprises should view data loss prevention as a top business priority.”

Recommended

• Comment | Developing data talent in key industries
• 10 major data breaches from 2021
• Seven business growth programmes to help boost UK tech scaleups

Data breaches continue to be a huge problem for companies globally, with employee mistakes continuing to be a major reason for the leaking of data.

Research from 2020 found that human error was responsible for 90% of the UK’s cyber data breaches in 2019, according to the UK Information Commissioner’s Office.

Additionally, Atlas VPN previously found that a record-breaking 5.9 billion accounts were affected by data breaches throughout 2021.

The cost of such breaches can be substantial for firms. According to a report from IBM in July last year, data breach costs hit record highs during the coronavirus pandemic.

An increase in remote working and a shift to the cloud meant that the average cost per incident stood at $4.24 million (£3.1m), marking the highest cost in the history of IBM’s Cost of a Data Breach Report.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.