Survey: 68% of IT Pros Name Human Error as Top Cyber Threat
A global Kaseya poll of over 1,100 professionals finds human error outweighs email scams as the primary security concern for managed service providers.
Key points
- % of respondents cite human error as the most significant attack vector.
- % of recent security incidents are linked to poor user practices or training gaps.
- % of IT departments report being under-resourced to handle current risks.
Human error remains the dominant challenge for cybersecurity professionals, according to a new survey conducted by Kaseya. The research, which polled more than 1,100 managed service providers and IT experts globally, identifies people—not software flaws—as the primary vulnerability in modern security postures.
Sixty-eight percent of those surveyed identified human error, including social engineering and distraction, as the most concerning attack vector over the next 12 months. This figure surpasses email-based scams, which were cited by 55% of respondents as a major threat. The data suggests that organizations are increasingly worried about the unpredictability of user behavior compared to automated attacks against network infrastructure.
Context and Background
The survey highlights a persistent gap between compliance and actual security resilience. While 65% of respondents believe their organizations would pass a compliance audit today, 49% admitted that incomplete documentation and procedures could create significant problems. This discrepancy indicates that meeting regulatory checkboxes does not necessarily translate to robust operational security or effective incident prevention.
David Baggett, SVP and GM of Security Suite at Kaseya, noted that cybersecurity still relies heavily on individuals making correct decisions consistently. He stated that while people are imperfect, the industry must factor these inevitable mistakes into its resilience strategies rather than assuming perfect adherence to protocol.
Who Is Affected
The findings reflect widespread resource constraints within the IT sector. Seventy-seven percent of respondents described their departments as under-resourced, and only 20% reported having budgets that grow in line with the risks they face. This financial pressure may limit the ability of organizations to implement comprehensive training programs or advanced monitoring tools that could mitigate human error.
Other specific human-related risks identified in the poll include gullibility, cited by 41% of respondents, and a general lack of cybersecurity training for users, noted by 40%. These factors contribute to an environment where even well-intentioned employees can inadvertently compromise organizational security through simple mistakes or manipulated trust.
What should you do?
Organizations should review their current training programs to ensure they address common social engineering tactics and distraction-related errors. IT leaders should also audit their documentation to ensure it is complete and up-to-date, reducing the risk of procedural gaps during incidents. Monitoring user behavior for anomalies can help detect errors before they escalate into major breaches.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Kaseya
- Implement regular, practical cybersecurity training that focuses on recognizing social engineering and avoiding distraction-based errors.
- Audit internal documentation and procedures to ensure they are complete and accessible, reducing reliance on memory during incidents.
- Deploy monitoring tools that detect unusual user behavior patterns which may indicate accidental data exposure or credential misuse.
- Review budget allocations to ensure security resources scale with the increasing complexity of human-centric threats.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of security incidents are linked to human error?
According to the Kaseya survey, 80% of contributing factors in recent security incidents can be traced back to poor user practices or a lack of training.
How do IT departments feel about their current resources?
77% of respondents described their IT departments as under-resourced, with only 20% having budgets that grow in line with the risks they face.
Is human error a bigger threat than email scams?
Yes, 68% of respondents cited human error as the most concerning attack vector, compared to 55% who were concerned about attacks via email.
