A new Kaspersky study reveals that 80% of organizations view people-related factors as the biggest driver of a potential successful cyberattack on their business – even ahead of technical controls. Among the top three risks are high workload on IT and IT security teams, insufficient expertise among security specialists, and a lack of security awareness among staff – equally gaining nearly a quarter of all votes.
Cyber attackers increasingly rely on the human factor, from social engineering that tricks employees into sharing sensitive data to misconfiguration left unnoticed by overloaded teams. Even high-severity incidents are often triggered by social engineering, where a single convincing lure leads to a critical human-driven lapse. Despite advances in automation, the human factor remains the decisive reason why cyberattacks succeed.
According to a new study by Kaspersky’s internal market research center[1], 24% of organizations identified high workload on the IT and security functions as one of the top factors increasing the likelihood of successful cyberattacks. This share rises among medium-sized businesses (27%) and large enterprises (26%), where the number of processes and tasks is higher. When expert teams are stretched thin, they have less time for proactive defense, which in turn increases the probability of errors or missed incidents.
The next factor cited by 24% of respondents is the lack of expertise and experience among security and IT professionals. This challenge directly affects an organization’s ability to identify, analyze and respond to modern threats. This concern is particularly pronounced in several regions with higher shares, reported in Mexico (30%), Colombia (29%), Turkey (28%), and Germany (27%).
Finally, 24% of respondents mention low employee security awareness, which continues to make organizations vulnerable to a range of cyberattacks. This concerns organizations even more frequently in Germany (32%), as well as across several markets in the Asia-Pacific region, particularly in Vietnam (35%), Thailand (33%), China (30%), India (28%) Indonesia (27%), and Malaysia (27%).
“At a first glance, deploying advanced security technologies seems enough to effectively defend against modern threats. However, Kaspersky’s incident analysis consistently reveals that high-impact intrusions frequently involve a human weakness, whether it’s a convincing social engineering lure or a missed alert during peak workload. Strengthening this human layer, from specialists’ skills to everyday awareness, help organizations reduce the likelihood that such errors turn into full-scale cyber incidents,” says Evgeniya Russkikh, Head of Academic Affairs at Kaspersky.
To help organizations reduce risks connected with human factor, Kaspersky experts recommend the following:
· Invest in additional cybersecurity courses for your staff to keep them up to date with the latest knowledge.
o With Kaspersky Cybersecurity Training , professionals can advance their hard skills and be able to defend their companies against attacks.
o From specialized technical courses to advanced training programs for top management, Kaspersky Academy offers a wide range of options that best meets your company’s needs.
· Use interactive simulators, for instance, Kaspersky Interactive Protection Simulation to test your own expertise and assess how employees make strategic decisions under cyberattack pressure. Regular awareness training helps employees recognize threats, avoid risky actions and support the organization’s overall security posture.
· Engage teams in gamified cybersecurity challenges, that develop practical skills to identify vulnerabilities, analyze incidents, and prevent attacks in a secure environment. On August 29–30, Kaspersky will host Kaspersky{CTF}, a competition designed for corporate and academic teams to strengthen teams’ defensive capabilities.
· Use centralized and automated solutions such as Kaspersky Next XDR Expert to reduce the burden on the IT security team and minimize the possibility of making mistakes. By aggregating and correlating data from multiple sources in one place and using technologies of machine learning, these solutions provide effective threat detection and fast automated response.
· If a company lacks security workers, adopt managed security services such as Kaspersky Managed Detection and Response (MDR) or/and Incident Response, which covers the entire incident management cycle – from threat identification to continuous protection and remediation. They help to protect against evasive cyberattacks and gain additional expertise without additional hiring.
[1] To provide insights into the most critical cybersecurity risks facing businesses today, Kaspersky surveyed 1,800 IT security specialists and cybersecurity decision-makers across 18 countries, including Brazil, China, Colombia, Egypt, France, Germany, India, Indonesia, Italy, Malaysia, Mexico, Russia, Saudi Arabia, South Africa, Spain, Thailand, Turkey, Vietnam.
