A new survey finds that UK security leaders believe human error, or even malicious intent, is behind their cyber breaches, with employees continually exposing sensitive data to the risk of a breach, yet are neglecting to take the necessary steps to control the risks.

The annual research carried out by Apricorn, a manufacturer of encrypted-USB drives, found that 70% of corporate breaches are a direct result of employee error or malicious intent.

Of the security decision makers surveyed, 22% said employees unintentionally putting data at risk had been the main cause of a data breach at their organisation, with staff being caught out by phishing emails close behind at 21%.

Remote workers specifically were said to be the catalyst of a data breach at 26% of organisations, up from 21% in 2022.

20% of companies also said employees with malicious intent had been behind a breach at their company, a rise from 10% last year.

Further, the research found that third parties have been mishandling corporate information, leading to a breach at 21% of companies, up from 12%, highlighting the increasing need for tighter security in the supply chain.

48% of respondents claimed that their company’s mobile or remote workers have knowingly exposed data to a breach over the last year, a rise from 29% in 2022, while 46% stated that their remote workers ‘don’t care’ about security, up from 17% the previous year.

This trend was echoed when the respondents were asked about the main problems they faced with implementing a cybersecurity plan for remote and mobile working.

The biggest issue – which 28% are struggling with – is lack of awareness among employees of the risks to data when working away from the office

Also high on the list is the fact that staff who are aware of security risks will still take action that results in data being exposed or lost, according to 23% of respondents.

These findings appear to be in line with projected trends: a 2023 Gartner report on cybersecurity predicted that by 2025, a lack of talent or human failure will be responsible for over half of all significant cyber events.

Further, a survey commissioned by CyberSmart and conducted by Censuswide, found that almost half of SMEs are worried that disgruntled employees are causing more cyber incidents due to the cost of living crisis.

If employers are concerned about awareness, disgruntled employees practicing negligence, or even with malicious intent, the the answers seem increasingly obvious: better, human-centric training, and higher wages to at least keep up with the rising cost of living for employees.

Recommended

• Roundtable | What Can Be Learned From Estonia’s Tech Success?
• Sunak: Ten Ways the UK Is the ‘Best’ for Tech Businesses
• Report: Complex Cloud Storage is Leading to Rise in Data Breaches

The recent onslaught of reports citing the increased cyber security dangers associated with remote working, however, may have to do with something else. Apricorn’s statistics are based on a survey of 201 security decision makers and what they claim, not actual trends in the route cause of cyber incidents.

If more companies purport remote working as an cyber-risk, then it might be easier to force workers back into the office.

Shifting the blame to neglectful or disgruntled employees this consistently must make companies question their cybersecurity awareness training and system implementation practices more intensely.

As Robin Bylenga argued at DIGIT’s Scot Secure 2023 Summit, cybersecurity is often a systematic issue, rather than a blame-game.

“The Information security department needs to be a part of a department of trust, not a department where people feel intimidated, or where people feel stupid, or uneducated,” she insisted at the conference in March.