The Human Factor in Cybersecurity

Australian businesses are projected to spend $6.2 billion on security and risk management in 2025. Organisations often set up complicated infrastructures and firewalls, yet seem to forget you’re only as strong as your weakest link.

And what is the weakest link in the security chain? People. Read on to learn how you can turn your weakest link into your strongest line of defence.

To Err is Human

Analysing the Notifiable Data Breaches Report from July to December 2024 reveals that human error was a large contributor to data breaches, accounting for 170 of the notifications. These breaches, often resulting from unauthorised disclosures or the mishandling of personal information, make up 29% of the reported incidents, a 10% increase from the preceding period. This trend is not confined to Australia alone. Internationally, the number of data breaches caused by human error increases to 95%.

Looking ahead, this trend is expected to grow, due to the exponential growth of AI in workplaces. As Generative and Agentic AI tools continue to gain popularity without accompanying organisational AI policies, the likelihood of employees inadvertently exposing sensitive data through these technologies only grows.

So...What Can You Do?

There are several key strategies you can put in place in your organisation:

• Add in the necessary controls and policies in place: encryption, awareness training, and software updates, to name a few.

• Ensure IT teams and business users are both accountable to ensure access management is reviewed.

  • When a staff member leaves, proactively review and revoke access to all systems.

  • Create a process to regularly review access to systems every 6 months, not only when staff leave.

  • Don’t forget that this process extends to contractors, vendors and anybody that has access to your company data.

• Create an incident response plan and test it with staff through various scenarios and practical examples.

• Have regularly scheduled staff training and awareness sessions. Ensure it is clear and concise, but don’t overdo it, as this can cause fatigue.

• Ideate and enforce a clear AI policy and communicate that with your staff. Create capabilities and guardrails for your staff to explore and use AI in a safe way.

Creating a Culture of Security

Beyond policies and procedures, sustainable cybersecurity requires embedding security awareness into your organisation's DNA. This means moving from a compliance based approach, to creating an environment where security becomes second nature.

Start by making security everyone's responsibility, not just IT's domain.

• Recognise and reward employees who identify potential threats or follow security protocols correctly.

• Share success stories of prevented incidents to demonstrate the value of vigilance.

• Consider appointing security champions across different departments who can serve as local advocates and first points of contact for security concerns.

Finally, and perhaps most importantly - leadership visibility is crucial. When senior leadership actively participate in security training and openly discuss security priorities, it signals to the entire organisation that cybersecurity is a business imperative, not just a technical requirement. This cultural shift is what transforms your workforce from the weakest link into your strongest defence.

As businesses navigate the complexities of modern cybersecurity, recognising the human role is crucial to remain secure. The data underscores a pressing need to address your staff in order to ensure the investment in your security frameworks is not for naught. Through a combination of technical safeguards, access management, incident planning, structured training, and well-defined AI policies, organisations can fortify their cybersecurity posture. You can transform human weaknesses into strengths, clearing the way for a secure future for your business.

Want to learn more? Talk to us about how to implement people-first cybersecurity practices in your organisation.