In this panel excerpt, the speakers examine why humans are a critical factor in cybersecurity risk. They reference the Verizon Data Breach Investigations Report, noting that 75% of breaches involve human error, but caution against a blanket view that all users are the problem. Their research reveals that a small minority—about 10% of users—are responsible for roughly 73% of risk, while a majority—over 60%—actually foster vigilance that strengthens security. The discussion emphasizes a shift from treating humans as binary, error‑prone elements to viewing them as assets, advocating for empowerment through visibility, targeted training, and appropriate controls to turn human behavior into a strength of cyber‑defense programs.
Chapters
If we really want to manage cyber risks that involve people, such as, well, social engineering attacks that can lead to ransomware theft, fraud, insider attacks, system compromises, so on and so forth, we really need clear insights. And today, we have a panel of experts that will dive into the analysis, tease out the behavioral security importance, and discuss the underlying cognitive vulnerabilities. Why do humans pose such a problem to cybersecurity?
So, I'm like, there's so many ways I could go with this. I think the first is to acknowledge like the extent of the problem. And so the recent Verizon DBIR report talks about, you know, 75% of cybersecurity breaches are a result of some sort of human error, right? And, but what's really interesting, so what does that stat actually cause the industry to believe that like, that humans are the problem. Like, stupid humans, they're always, you know, causing issues. And so actually through this research, we came out with a couple interesting stats. So one, it's actually 10% of users that are responsible for about 73% of risk. So I think using sort of like the blanketed statement of like, all humans are the problem is probably like the first thing that we need to counteract here. And then the other stat that we actually found was over 60% of users in an organization their behavior is actually helping to produce vigilance. And so it's moving risk in the other direction. And so we're like, we're really faced with this like interesting dichotomy of like, okay, yeah, we have some risky users and risky behavior, but then we also have some users that are causing, you know, vigilant behavior and they're causing us to be more secure. We've actually shown that in fact, with the right empowerment, with visibility, with training, with controls, we can start seeing humans be one of like the greatest strengths of a cybersecurity program. So, um, that's something that I'm really passionate about. But, but, you know, at the end, like, at the end of the day, why are we here? Um, humans aren't like X's and O's and ones and zeros. And so the traditional like cybersecurity staff that's been investing millions of dollars in like cyber tech and tools, they're much more comfortable with like black and white, and people just are not that way. And so, we needed to take a different approach in how we handle that, how we manage risk around the human.
