Month: August 2026

A year can make a big difference. As Chloe wraps up her placement with Leaf IT, she reflects on the projects, experiences, and lessons that will help determine the next stage of her career.

Over the past year, Chloe has worked across both our Modern Work and Service Desk teams, gaining hands-on experience of the IT industry and life within a Managed Service Provider. From supporting customers and developing PowerShell scripts to contributing to internal Power BI projects, she has embraced every opportunity to learn and take on more responsibility.

Before she heads back to university, we asked Chloe to reflect on her placement experience, the skills she has developed and what comes next.

Looking back on your placement year at Leaf IT, how would you describe your experience, and what surprised you most about working across both the Modern Work and Service Desk teams?

This past year has been an exciting change of pace from university, and I’m grateful to come away with fond memories and a greater understanding of the IT industry. I would describe the experience as valuable, varied and a bit of a rollercoaster at times. It offered me exposure to the inner workings of a technology partner, especially having worked across both the Modern Work and Service Desk teams.

The team made me feel welcome from the get-go and were very supportive when I ran into problems beyond my depth of knowledge. Jumping between the two teams, I was surprised by how the different areas of service worked together, and it allowed me to develop a much broader technical skill set.

What’s been your biggest achievement and key learning, and what skills will you take forward into your final year?

One of the most interesting things I got to work on during my placement was Leaf-IT’s internal Power BI custom connector. I was able to apply my prior knowledge of databases to understand the data being pulled from our PSA software and manipulate it using Power Query M. This was a big achievement for me as I had never worked with the language before and, once rolled out, the connector made a significant difference in speeding up report refreshes and reducing the load on Power Query.

Every day was a learning day, but the most critical skill I’ll take forward is problem-solving. Regularly resolving IT support requests strengthened my analytical thinking and taught me to approach problems methodically while considering the wider impact of any changes made.

How has the placement helped you develop both personally and professionally, and what’s next for you as you return to university?

“Throughout the placement year, I progressed from learning fundamental Microsoft skills to independently delivering client solutions, developing PowerShell scripts and configuring Microsoft environments.

I took on more responsibility as I went and developed strong self-management skills. Working with clients and in teams has taught me to adapt how I communicate and recognise when to seek guidance.

I’m now returning to Queen’s for my final year with a clearer idea of the direction I want to take my career. I will continue to invest in my own development, taking opportunities to expand my technical knowledge and build my professional network.

The experience has provided a solid foundation for my future career and given me a greater appreciation for the importance of continuous learning, adaptability, and collaboration in the ever-evolving technology sector.”

Thank You, Chloe!

Chloe has become a valued member of Leaf IT over the past year, and her enthusiasm, dedication and willingness to get involved have made a real impact across the business.

We would like to thank Chloe for all her hard work and support throughout her placement. We wish her every success as she returns to university for her final year and takes the next steps in her career.

Good luck, Chloe! 👋

When businesses think about cybersecurity, the focus is often on technology. Firewalls, endpoint protection, network monitoring and threat detection tools are all designed to prevent systems from failing and keep attackers out. While those controls are essential, they only address part of the challenge.

In reality, technology is rarely the weakest link. More often, security incidents happen because of the way people interact with technology during the course of their day-to-day work.

The Number Worth Paying Attention To

According to Mimecast’s State of Human Risk 2025, 95% of cybersecurity issues can be traced back to human error rather than a technical failure (Mimecast, State of Human Risk 2025). In most cases, the root cause isn’t an unpatched server or a failed security product. It’s a person making a decision that seemed reasonable in the moment, whether that’s clicking a link, approving a request, sharing information or misconfiguring a setting.

This finding is reinforced by Verizon’s 2024 Data Breach Investigations Report, which found that 68% of breaches involve a human element (Verizon, 2024 Data Breach Investigations Report). While the methodologies differ, both studies point to the same conclusion: for most organisations, cyber risk is no longer centred solely on infrastructure. It’s tied directly to human behaviour across email, collaboration tools, cloud platforms and business applications.

Human Error Doesn’t Mean Carelessness

It’s tempting to look at these statistics and conclude that employees simply need more training. However, the data suggests the issue is more nuanced than that.

Mimecast’s platform data shows that just 3% of users are responsible for 92% of malware incidents (Mimecast Engage product documentation). Rather than indicating widespread risky behaviour across an organisation, this suggests that risk is often concentrated among a relatively small group of individuals, while the majority of employees consistently follow security guidance.

Research from Gartner provides further context. According to its Top Eight Cybersecurity Predictions for 2023–2024, more than 90% of employees who carried out an insecure action were aware that their behaviour introduced additional risk (Gartner, Top Eight Cybersecurity Predictions for 2023–2024, March 2023). In other words, the issue frequently isn’t a lack of awareness. Employees are often navigating competing priorities, tight deadlines and operational pressures, and security can lose out to convenience when people are trying to complete tasks quickly.

Understanding this distinction is important because it shifts the conversation away from blame and towards designing security processes that work within the realities of modern working environments.

The Perimeter Has Changed

The traditional model of cybersecurity was built around protecting a defined network perimeter. A decade ago, the majority of employees worked from a fixed location, on company-managed devices, behind a corporate firewall. Today, work happens everywhere.

Employees access business systems from home, customer sites, shared workspaces and mobile devices. As a result, the edge of the organisation, often referred to as the attack surface, is no longer a physical location. It extends to every user, device and login connected to company data.

Mimecast’s State of Human Risk 2025 highlights the significance of this shift, reporting that approximately 8% of employees account for around 80% of an organisation’s risk exposure (Mimecast, State of Human Risk 2025). This isn’t a reason to distrust employees; rather, it demonstrates the value of understanding where risk is concentrated and applying security controls accordingly, rather than assuming every user presents the same level of exposure.

What This Means in Practice

For business leaders and IT teams, there are several important lessons to take away.

Awareness training remains valuable, but training alone is unlikely to eliminate human risk. Most employees already understand basic security principles, so the challenge lies in maintaining secure behaviours when people are busy, distracted or under pressure.

Organisations also benefit from identifying where risk is concentrated instead of applying the same controls indiscriminately across the workforce. If a relatively small percentage of users account for the majority of risky behaviour, targeted support, monitoring and guidance will often have a greater impact than broader policy changes.

Perhaps most importantly, security strategies need to align with how people actually work. Policies that rely on perfect decision-making in every situation are unlikely to succeed. Effective cybersecurity programmes recognise that mistakes happen and build safeguards that help reduce the likelihood and impact of those mistakes.

Across Northern Ireland, we regularly see organisations with robust technical security controls and committed employees, yet gaps still emerge because security processes haven’t evolved alongside modern working practices. Addressing human risk isn’t about tightening restrictions, it’s about creating an environment where secure decisions are easier to make.

The Threat Landscape Is Evolving

The challenge for organisations today is that human risk is no longer operating in the same threat environment as it was a few years ago.

While human behaviour remains one of the most common entry points for cyber incidents, artificial intelligence is changing the speed and scale at which attackers can exploit mistakes. Threat actors are increasingly using AI to accelerate tasks such as reconnaissance, phishing, credential theft and attack execution, enabling them to operate more efficiently and at a greater scale than ever before.

CrowdStrike reported in their latest findings (2026 Global Threat Report) that attacks by AI-enabled adversaries increased by 89% year-on-year, demonstrating how rapidly attackers are adopting and weaponising AI technologies. At the same time, the average time taken for cybercriminals to move through a compromised environment fell to just 29 minutes, significantly reducing the window organisations have to detect and contain threats.

This means that what may once have been a relatively minor security lapse can now have far greater consequences. A compromised credential, a rushed decision or a successful phishing attempt can provide attackers with the opportunity to move quickly through systems before security teams have time to respond.

As cyber threats continue to evolve, organisations must ensure their cybersecurity strategies evolve alongside them. Technology remains a critical line of defence, but it must be supported by effective security processes, user awareness and a proactive approach to identifying and reducing human risk.

In an environment where attackers are becoming faster, more automated and more sophisticated, building cyber resilience is no longer just about preventing attacks. It’s about ensuring your organisation can detect, respond to and contain them when they occur.

Get In Touch

The first step in improving cybersecurity is understanding where the real risks lie, and we recognise that there’s no one-size-fits-all approach. Whether you’re reviewing existing security measures or planning for the future, our team is always available to discuss how we can support your organisation in navigating an increasingly complex security landscape.

help? / Business

Name *

First

Last

Business / Organization *

Work Email *

Phone *

How can we help? *

Tell us about your cybersecurity challenges, training requirements, or any questions you have about reducing human risk within your organisation.

Submit