Why 95% of Cyber Incidents Start with Human Behaviour, not Technology Failures.
When businesses think about cybersecurity, the focus is often on technology. Firewalls, endpoint protection, network monitoring and threat detection tools are all designed to prevent systems from failing and keep attackers out. While those controls are essential, they only address part of the challenge.
In reality, technology is rarely the weakest link. More often, security incidents happen because of the way people interact with technology during the course of their day-to-day work.
The Number Worth Paying Attention To
According to Mimecast’s State of Human Risk 2025, 95% of cybersecurity issues can be traced back to human error rather than a technical failure (Mimecast, State of Human Risk 2025). In most cases, the root cause isn’t an unpatched server or a failed security product. It’s a person making a decision that seemed reasonable in the moment, whether that’s clicking a link, approving a request, sharing information or misconfiguring a setting.
This finding is reinforced by Verizon’s 2024 Data Breach Investigations Report, which found that 68% of breaches involve a human element (Verizon, 2024 Data Breach Investigations Report). While the methodologies differ, both studies point to the same conclusion: for most organisations, cyber risk is no longer centred solely on infrastructure. It’s tied directly to human behaviour across email, collaboration tools, cloud platforms and business applications.
Human Error Doesn’t Mean Carelessness
It’s tempting to look at these statistics and conclude that employees simply need more training. However, the data suggests the issue is more nuanced than that.
Mimecast’s platform data shows that just 3% of users are responsible for 92% of malware incidents (Mimecast Engage product documentation). Rather than indicating widespread risky behaviour across an organisation, this suggests that risk is often concentrated among a relatively small group of individuals, while the majority of employees consistently follow security guidance.
Research from Gartner provides further context. According to its Top Eight Cybersecurity Predictions for 2023–2024, more than 90% of employees who carried out an insecure action were aware that their behaviour introduced additional risk (Gartner, Top Eight Cybersecurity Predictions for 2023–2024, March 2023). In other words, the issue frequently isn’t a lack of awareness. Employees are often navigating competing priorities, tight deadlines and operational pressures, and security can lose out to convenience when people are trying to complete tasks quickly.
Understanding this distinction is important because it shifts the conversation away from blame and towards designing security processes that work within the realities of modern working environments.
The Perimeter Has Changed
The traditional model of cybersecurity was built around protecting a defined network perimeter. A decade ago, the majority of employees worked from a fixed location, on company-managed devices, behind a corporate firewall. Today, work happens everywhere.
Employees access business systems from home, customer sites, shared workspaces and mobile devices. As a result, the edge of the organisation, often referred to as the attack surface, is no longer a physical location. It extends to every user, device and login connected to company data.
Mimecast’s State of Human Risk 2025 highlights the significance of this shift, reporting that approximately 8% of employees account for around 80% of an organisation’s risk exposure (Mimecast, State of Human Risk 2025). This isn’t a reason to distrust employees; rather, it demonstrates the value of understanding where risk is concentrated and applying security controls accordingly, rather than assuming every user presents the same level of exposure.
What This Means in Practice
For business leaders and IT teams, there are several important lessons to take away.
Awareness training remains valuable, but training alone is unlikely to eliminate human risk. Most employees already understand basic security principles, so the challenge lies in maintaining secure behaviours when people are busy, distracted or under pressure.
Organisations also benefit from identifying where risk is concentrated instead of applying the same controls indiscriminately across the workforce. If a relatively small percentage of users account for the majority of risky behaviour, targeted support, monitoring and guidance will often have a greater impact than broader policy changes.
Perhaps most importantly, security strategies need to align with how people actually work. Policies that rely on perfect decision-making in every situation are unlikely to succeed. Effective cybersecurity programmes recognise that mistakes happen and build safeguards that help reduce the likelihood and impact of those mistakes.
Across Northern Ireland, we regularly see organisations with robust technical security controls and committed employees, yet gaps still emerge because security processes haven’t evolved alongside modern working practices. Addressing human risk isn’t about tightening restrictions, it’s about creating an environment where secure decisions are easier to make.
The Threat Landscape Is Evolving
The challenge for organisations today is that human risk is no longer operating in the same threat environment as it was a few years ago.
While human behaviour remains one of the most common entry points for cyber incidents, artificial intelligence is changing the speed and scale at which attackers can exploit mistakes. Threat actors are increasingly using AI to accelerate tasks such as reconnaissance, phishing, credential theft and attack execution, enabling them to operate more efficiently and at a greater scale than ever before.
CrowdStrike reported in their latest findings (2026 Global Threat Report) that attacks by AI-enabled adversaries increased by 89% year-on-year, demonstrating how rapidly attackers are adopting and weaponising AI technologies. At the same time, the average time taken for cybercriminals to move through a compromised environment fell to just 29 minutes, significantly reducing the window organisations have to detect and contain threats.
This means that what may once have been a relatively minor security lapse can now have far greater consequences. A compromised credential, a rushed decision or a successful phishing attempt can provide attackers with the opportunity to move quickly through systems before security teams have time to respond.
As cyber threats continue to evolve, organisations must ensure their cybersecurity strategies evolve alongside them. Technology remains a critical line of defence, but it must be supported by effective security processes, user awareness and a proactive approach to identifying and reducing human risk.
In an environment where attackers are becoming faster, more automated and more sophisticated, building cyber resilience is no longer just about preventing attacks. It’s about ensuring your organisation can detect, respond to and contain them when they occur.
Get In Touch
The first step in improving cybersecurity is understanding where the real risks lie, and we recognise that there’s no one-size-fits-all approach. Whether you’re reviewing existing security measures or planning for the future, our team is always available to discuss how we can support your organisation in navigating an increasingly complex security landscape.