Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / The Human Factor 95 Percent of Breaches Start With People
Transcript
- Lucas: So let's start with a number that stopped me the first time I read it: 95 percent of all cybersecurity breaches involve human error. Not a zero-day exploit, not some nation-state breaking AES encryption — someone clicks a link they shouldn't have, reuses a password, or misconfigures a server. Luna: I've seen that stat from IBM and Verizon's Data Breach Investigations Report. It's been consistent for years. And yet, companies still pour most of their security budget into firewalls and endpoint protection. Lucas: Right. Because hardware and software are easier to buy than changing how thousands of employees behave. But if 19 out of 20 breaches start with a person, you've got to address the human factor directly. Luna: Let's anchor this with a concrete example. The 2013 Target breach. 40 million credit card numbers stolen. Total cost eventually reported around $162 million. And it all started with a phishing email sent to a third-party HVAC vendor. Lucas: Exactly. Attackers didn't break into Target's network through some sophisticated zero-day. They sent a spear-phishing email to an employee at Fazio Mechanical Services, a refrigeration and HVAC contractor. That employee clicked, malware got installed, and attackers stole network credentials from that vendor. Luna: Then they pivoted from the vendor's network into Target's point of sale systems. One click from someone who wasn't even a Target employee. That's the human factor. Lucas: And the aftermath changed how companies think about vendor risk management. Target ended up spending over $60 million just on settlements and legal fees. Their CIO and CEO both resigned. The stock took a hit that took months to recover. Luna: But it wasn't just the click. Target had actually deployed a malware detection tool from FireEye that flagged the attack in real time. Their security team in Bangalore saw the alert and escalated it — but the team in Minneapolis didn't act on it. Lucas: Right. That's another layer of human error — not technical failure, but a process failure. Someone didn't follow up on an alert. So the technology worked. The people didn't. Luna: And that's why, post-Target, you saw a huge surge in security awareness training budgets. Gartner estimated that by 2020, global spending on security awareness training hit $1 billion annually. Lucas: But here's the thing: a lot of that training is still checkbox compliance. Watch a 20-minute video once a year. That doesn't change behavior. The effective programs do continuous simulated phishing, track click rates by department, and make security part of performance reviews. Luna: I talked to a CISO at a mid-cap fintech last year. She said their biggest win wasn't a new tool — it was reducing phishing click rates from 18 percent to under 2 percent over two years through monthly simulations and real-time coaching. Lucas: That's a massive improvement. And it has a direct ROI: the average cost of a phishing attack on a mid-size company is around $1.6 million, according to Ponemon. If you cut your risk by 90 percent, you're saving millions. Luna: But it's not just phishing. There's also the insider threat — employees who accidentally or maliciously cause a breach. The 2025 Insider Threat Report from Cybersecurity Insiders says 69 percent of organizations saw an increase in insider attacks year-over-year. Lucas: And those are harder to defend against because the person already has legitimate access. So you need user behavior analytics — tools that flag when an employee suddenly downloads 10,000 files at 2 AM or accesses a server they've never touched before. Luna: But those tools also raise privacy concerns. Employees don't love being monitored. How do you balance security with trust? Lucas: It's a real tension. The best approach I've seen is transparency — tell employees exactly what's monitored, why, and how data is used. And focus on malicious intent, not mistakes. If someone clicks a phishing link but reports it immediately, that's a learning moment, not a firing offense. Luna: Culture matters. Google's Project Aristotle showed that psychological safety is the top predictor of team effectiveness. If people fear punishment for mistakes, they'll hide them, and that's exactly when small errors turn into big breaches. Lucas: That's a great point. So the human factor isn't just about training — it's about designing systems that assume humans will make mistakes. That's the philosophy behind zero trust: never trust, always verify. Every access request is authenticated and authorized, even if it comes from inside the network. Luna: Zero trust has been one of the biggest buzzwords in cybersecurity for the past few years. But adoption is still uneven. A 2025 survey by Okta found that only about 35 percent of enterprises have a mature zero-trust architecture in place. Lucas: Part of the resistance is cost and complexity. Retrofitting legacy systems is hard. But the other part is pushback from employees who don't want to authenticate five times a day. So you need to make security frictionless — single sign-on, biometrics, adaptive authentication that only triggers when something looks off. Luna: Apple's approach with Face ID and passkeys is a good example. It's actually easier and faster than typing a password. Security as a feature, not a burden. Lucas: Exactly. And that's the direction the industry is heading: passwordless authentication. Microsoft said that 80 percent of all cyberattacks involve compromised passwords. Taking passwords out of the equation eliminates a huge chunk of the human error surface. Luna: But passwords aren't going away overnight. In the meantime, multifactor authentication is the single most cost-effective control. The FBI's 2023 Internet Crime Report said MFA could have prevented over 80 percent of reported breaches. Lucas: Let's zoom out for a second. There's a broader structural issue: security teams are overworked and understaffed. ISC2's 2025 Cybersecurity Workforce Study found a global shortage of 4.8 million cybersecurity professionals. That's a human factor too — not enough people to watch the screens. Luna: And that shortage drives burnout. The same study found that over 60 percent of cybersecurity professionals report high or extreme stress. That leads to mistakes, high turnover, and gaps in coverage. Lucas: So the human factor cuts both ways. Employees are the weakest link, but they're also the most important asset. A well-trained, well-supported workforce can be the best defense. And the companies that invest in that — not just tech, but people and culture — are the ones that weather breaches better. Luna: Any examples of a company that got this right? Lucas: One I like is Capital One. After their 2019 breach where an ex-employee exploited a misconfigured firewall, they invested heavily in a program called 'Security Champions' — embedding security liaisons in every engineering team. They also run continuous red-team exercises and give employees real-time feedback on risky behavior. Luna: So it's about embedding security into the workflow, not bolting it on. That's harder to scale, but it's more sustainable. Lucas: Right. And it's cheaper in the long run. The average cost of a data breach in 2025 was $4.88 million, according to IBM. Prevention is a fraction of that. But it requires leadership buy-in — the CEO and board have to treat cybersecurity as a business risk, not just an IT problem. Luna: And that brings us back to the human factor at the top. If the C-suite doesn't model good security behavior — reusing passwords, clicking on random links, bypassing VPNs — the culture won't change. Lucas: Absolutely. Security culture starts at the top. There's a known case where a European bank's CEO was found using 'password123' for his corporate account in a 2024 audit. That sends a terrible signal. Luna: So what's the one takeaway for a business leader listening today? Lucas: Stop thinking of cybersecurity as a technology problem you can throw firewalls at. Start thinking of it as a people problem that needs continuous investment in training, culture, and processes. And measure what matters: phishing click rates, time to report incidents, employee satisfaction with security tools. Luna: And if you're a listener who wants to improve your own security hygiene? Start with a password manager and enable multifactor authentication everywhere it's available. Lucas: That's a $0 investment that protects against the most common attacks. And it's one click — the right kind of click.