Human Error in Cybersecurity: What the Data Shows and How to Reduce It

What is human error in cybersecurity?

Human error in cybersecurity means a mistake or a manipulated action by a person, such as clicking a phishing link, reusing a password or misconfiguring a cloud service, that gives attackers access or exposes data. Attackers deliberately exploit behavior patterns like time pressure and trust. How much damage a single mistake causes depends on the organization: on training, processes and technical controls.

This article separates figures that hold up from figures that circulate without a source, and shows which controls limit the damage.

How much risk is caused by human error?

According to the Verizon Data Breach Investigations Report (DBIR) 2026, a human element was present in 62% of breaches, up from 60% in the previous year. The figure describes how often people are involved in a breach, not who is to blame. Social engineering was the third most common breach pattern (16% of all breaches), as the DBIR 2026 Executive Summary states.

Which figures on human error and data breaches are verified?

Only figures with an accessible primary source are listed; numbers that circulate online without one are left out. Reports use different samples and definitions, so compare values only within the same report.

Which errors cause most breaches?

Verizon names the exploitation of vulnerabilities as the most common initial access vector in 2026 (31%), ahead of stolen credentials (13%); phishing stayed at 16%. On the human side, these are the typical entry points:

Phishing & Social Engineering

Phishing attacks are among the most widespread and effective methods used by cybercriminals. They rely on fake emails or messages that impersonate legitimate senders. The goal is to get employees to disclose sensitive data or click on malicious links. Voice phishing is a common variant, as the ShinyHunters attacks on Google and Salesforce show; AI-generated voices make it harder to spot (deepfake phishing). More: battling phishing.

Weak or Reused Passwords

Passwords are another entry point for attackers — especially when they're simple, reused, or even publicly accessible. Despite all the recommendations on password hygiene, practice shows that many employees continue to use insecure passwords.

Misconfiguration and Data Errors

Missing encryption, inadequate permission management, or misconfigured cloud services regularly lead to data breaches. The problem is often not intent, but a lack of awareness of the consequences.

Device Loss

Lost or stolen devices such as laptops and smartphones pose a significant risk, especially if they're unencrypted or lack remote-wipe capability.

Example: the Qantas incident

On 30 June 2025, Qantas detected unusual activity on a third-party platform used by its contact centre. According to Help Net Security, a cyber criminal targeted the call centre and gained access to a third-party customer servicing platform; around 5.7 million customers were affected. Qantas did not name the technique; Silverfort notes the hallmarks of the group Scattered Spider, which relies on social engineering.

What does a breach cost, and what do the reports say?

The IBM Cost of a Data Breach Report 2026 puts the global average at USD 4.99 million per breach, a record high and 12% more than the year before. The 2025 edition reported USD 4.44 million globally and EUR 3.87 million for Germany, where phishing was the second most common initial attack vector (14%, average damage EUR 4.15 million). These are averages across very different incidents; compare them only within one report. For smaller companies, see cyberattacks on businesses and SME protection.

Why does training alone not fix it?

Training lowers the likelihood of a mistake but cannot bring it to zero, so technical controls have to limit the damage when someone still clicks. In the DBIR 2026, phishing remained at 16% as an initial access vector, and the median click rate in simulated voice and text message attacks was 40% higher than for email.

Many companies rely on annual training sessions or mandatory onboarding modules. Such formats are often irregular, not very practical and not tailored to specific target groups. A common mistake: training is treated as a mandatory task rather than an ongoing process. The effect is correspondingly limited. New formats and learning approaches are needed that make security tangible and embed it sustainably, for example compliance trainings.

Which controls reduce the impact?

Controls that still work when someone makes a mistake: phishing-resistant multi-factor authentication, restricted access rights, encryption and a tested incident response plan.

Cultural Change

Cybersecurity must be understood as an integral part of company culture. Leaders play a decisive role here — they must make the topic visible, lead by example, and address it continuously.

Regular, Personalized Training

Not every employee needs the same content — IT teams face different risks than HR or sales. Micro-learning formats, monthly impulses, role-playing exercises, and phishing simulations are especially effective.

Technical Complements

Measures such as multi-factor authentication (MFA), password managers, or endpoint encryption help minimize the consequences of human error. Access rights should be reviewed and adjusted regularly. Certifications such as ISO 27001 can also help systematically identify and address technical vulnerabilities, but a certificate alone does not prevent attacks (why certified companies still get hacked).

AI-Powered Detection

Modern AI solutions can detect suspicious behavior in real time — for example, unusual login times or atypical email communication.

What do GDPR and NIS2 require?

The GDPR requires appropriate technical and organisational measures (Art. 32 GDPR) and, after a personal data breach, notification of the supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33(1) GDPR). Whether a notification is required in an individual case depends on the risk to the persons affected. Relevant to human risk:

• Art. 32(4) GDPR: persons acting under the authority of the controller or processor process personal data only on instructions.
• Art. 39(1)(b) GDPR: where a data protection officer is designated, their tasks include awareness-raising and training of staff.
• Art. 28(3) GDPR: processing by a processor is governed by a contract, the DPA.
• Art. 30(1) GDPR: controllers maintain a record of processing activities.

According to the European Commission, NIS2 requires medium-sized and large entities in critical sectors to take appropriate cybersecurity risk-management measures and introduces accountability of top management. Whether your company is in scope depends on sector and size: NIS2 overview.

What should companies do first?

Start with controls that work even when mistakes happen, then build regular, role-specific training on top. It's often assumed that employees are to blame when a security incident occurs. But usually a completely different problem is behind it: missing training, unclear rules, or technical gaps. Sure, clicking a link can be the trigger, but responsibility lies with the organization. It's the company's job to ensure employees can work safely — with clear processes, good technology, and understandable communication.

Short-Term Measures:

• Conduct and evaluate phishing awareness campaigns
• Introduce or update training for all employees
• Revise password and access policies
• Implement heyData for DPA management and documentation
• Create and test an incident response plan

Long-Term Measures:

• Make security awareness a leadership responsibility
• Integrate cybersecurity into target systems and internal communication
• Regularly review processes with tools like heyData
• Provide targeted training and enablement for employees
• Align technical and organizational measures

Conclusion: Cybersecurity Starts With People and Is Reinforced by Systems

The digital threat landscape is dynamic, but one factor remains constant: humans are often the entry point. Organizations must therefore invest consistently in training, culture, and compliance. Tools like heyData help meet legal requirements, create transparency, and empower employees to act.

Because real security doesn't come from technology alone, but from the interplay of people, processes, and digital tools.

heyData: Compliance Meets Usability

In this complex landscape, heyData supports companies with a pragmatic, digital solution. The platform focuses on the operational implementation of data protection requirements — simple, automated, and fast.

heyData offers, among other things:

• Automated creation and maintenance of data protection documentation (e.g., records of processing activities, privacy policies)
• Structured management of Data Processing Agreements (DPAs)
• GDPR-compliant training modules for employees
• Management of data subject requests (e.g., access, erasure)
• Up-to-date legal guidance on regulatory changes such as NIS2 or DORA

Thanks to seamless integration into company processes, data protection becomes routine — not a burden.

Important: heyData doesn't replace technical safeguards like firewalls or SIEM systems. But it does provide a central platform for managing organizational obligations — a building block in protecting against human error.