How Many Cyberattacks Start With a Human?

Cyberattacks take advantage of ordinary work habits, from trusting a familiar-looking email to approving a login prompt in a hurry or leaving access in place longer than intended. Those moments create openings attackers know how to use.

The familiar claim that 95 percent of cyberattacks are caused by human error gets repeated frequently, but there isn't one reliable percentage that applies to every organization or every type of incident. Studies define the human element differently, and attackers have plenty of other ways into a business.

Canadian businesses are certainly dealing with the consequences. Statistics Canada reported that 16 percent of businesses experienced cybersecurity incidents that affected their operations in 2023. At the same time, only 22 percent provided formal cybersecurity training to develop or improve the skills of non-IT employees.

Recognizing where everyday decisions intersect with cyber risk and putting stronger safeguards around those moments is part of understanding the human element of cyberattacks.

Human Risk Goes Beyond Clicking a Bad Link

Phishing is probably the first thing that comes to mind when businesses think about employee cybersecurity. Someone receives a convincing email, clicks a link, and enters their credentials on a fraudulent login page.

Attackers have plenty of other opportunities to find their way in. A fraudulent request may arrive by text message or phone. An employee may approve a multi-factor authentication (MFA) prompt they didn't initiate. Passwords may be reused across services. Someone may send sensitive information to the wrong recipient, install unauthorized software, or grant a vendor broader access than the job requires.

Access can linger after it's needed. Former employees, contractors, unused accounts, and old vendor connections create openings nobody deliberately intended to leave behind. Most of these situations happen while people are simply trying to do their jobs.

Social Engineering Is Getting Harder to Spot

For years, employees were taught to look for spelling mistakes, awkward language, and suspicious links as obvious signs of phishing.

Those clues aren't as dependable as they once were. The Canadian Centre for Cyber Security's current National Cyber Threat Assessment warns that generative AI helps threat actors create convincing phishing messages, malicious content, and other social engineering material more efficiently.

A fraudulent email can be polished and professional. A message can imitate the language an organization normally uses. Publicly available information can give an attacker enough detail to make a request sound credible.

Employees need to know when a request deserves a second look and how to verify it through a trusted channel.

Training Can't Carry the Whole Load

Security awareness training gives employees a better chance of recognizing suspicious activity before it becomes an incident.

Effective training reflects the situations employees encounter at work. Employees should be provided guidance on phishing and suspicious login requests, protecting sensitive information, using passwords and MFA securely, and knowing when unusual payment or account changes require verification.

Training alone can't catch everything. People get busy and work quickly. They respond to customers and colleagues while answering messages, attending meetings, and moving between applications. Even a well-trained employee can make the wrong decision when a convincing request arrives at the right moment.

Security controls limit how far one mistake goes. MFA adds another barrier when a password is compromised. Individual accounts provide better control than shared credentials. Limiting permissions reduces what a compromised account can reach. Endpoint protection, email security, patching, and restrictions on software installation add barriers between an employee mistake and a larger incident.

Clear verification procedures take some of the guesswork out of unusual requests. Employees shouldn't have to decide on instinct whether a request to change payment details, reset credentials, provide sensitive information, or grant remote access is legitimate.

The less your security relies on someone making the right call every single time, the stronger your position becomes.

Make It Easy to Speak Up

Someone clicks a suspicious link and immediately realizes something isn't right. What happens next?

An employee who worries about getting in trouble may close the browser and hope nothing happens. Someone who doesn't know whether the situation is serious enough to report may wait to see if anything unusual occurs.

Either response gives an attacker more time. Employees should know exactly where to report a suspicious email, unexpected MFA prompt, strange login, lost device, or mistake. Reporting should be simple enough that nobody has to hunt for the right contact or debate if an incident is worth mentioning.

How the business responds is important too. Treating every mistake as a disciplinary issue makes employees reluctant to come forward. A quick report gives the IT or security team an opportunity to investigate, contain the problem, and determine if anything else needs attention.

If an employee raises an alarm and the situation turns out to be harmless, the reporting process still works.

Security Awareness Is Ongoing

Security awareness requires regular attention because the environment employees work in keeps changing. New people join, roles and permissions shift, applications and vendors are added, and attackers adapt their methods.

Training should evolve alongside those changes. Cybersecurity belongs in onboarding, followed by regular refreshers that keep common threats and reporting procedures familiar. Phishing simulations and short updates can give employees opportunities to apply what they’ve learned without requiring another hour-long course every few months.

Different roles may need different guidance. Finance employees face payment fraud and impersonation attempts. HR teams handle sensitive employee information. Administrators have elevated access. Executives can be particularly attractive targets because of their authority and visibility.

A useful awareness program reflects those differences instead of giving every employee the same generic presentation once a year.

Your Employees Can Be Part of the Defence

Security awareness turns employees into active participants in the defence. Recognizing a phishing message, questioning an unusual payment request, or reporting an unexpected MFA notification can interrupt an attack before it spreads further.

Training gives employees a better chance of spotting those moments, while security controls reduce the pressure to make the right decision. Strong cybersecurity brings technology, people, and processes together, so one mistake doesn't have to become a much larger incident.

How much of your cybersecurity strategy depends on someone making the right decision every time? Nucleus can help your team review where stronger controls, employee awareness, and clear processes minimize your exposure.

Frequently Asked Questions: Cybersecurity and Human Error

What percentage of cyberattacks are caused by human error?

There is no single reliable percentage that applies across all cyberattacks. Studies use different definitions of human error and examine different types of incidents, industries, and organizations. Human behaviour can contribute to cyber risk in many ways, including phishing, social engineering, credential theft, excessive access, misconfiguration, and accidental data exposure.

What is the human element in cybersecurity?

The human element refers to the role people's actions play in cybersecurity incidents. Examples include responding to phishing or social engineering, reusing passwords, approving fraudulent authentication requests, granting unnecessary access, or accidentally exposing sensitive information. People can also strengthen security by recognizing suspicious activity and reporting it quickly.

Can cybersecurity awareness training prevent cyberattacks?

Training can help employees recognize threats and respond appropriately, but it works best alongside technical controls and clear processes. MFA, access controls, endpoint protection, email security, patching, and verification procedures can reduce the likelihood that one employee mistake develops into a larger incident.

How often should employees receive cybersecurity training?

Security awareness should continue throughout the year rather than relying solely on an annual session. Onboarding, regular refreshers, phishing simulations, emerging-threat updates, and role-specific education can keep cybersecurity relevant as the business changes.