Human Error and Cybersecurity: A Survival Guide for the Person in Charge

Your people are not the weakest link. They are the most targeted one.

Despite real investment in prevention and awareness, actions that feel completely harmless to the person doing them can have serious consequences for the whole company. Clicking a link in an email that looked routine. Opening an attachment from a name you recognise. Choosing a password that is easy to remember. Pasting that password into a chat message so a colleague can get into the shared account.

None of these feel like security decisions in the moment. That is exactly the problem — and exactly what attackers count on.

Why "Train Them Harder" Keeps Failing

Most companies respond to human error with more training. An annual e-learning module. A poster in the kitchen. A reminder email after the last close call.

It rarely moves the needle, for three reasons:

• Training is a memory test, and attacks happen under pressure. People do not fail because they don't know what phishing is. They fail because the email arrived at 16:45 on a Friday, referenced a real invoice, and asked for something ordinary.
• The attacks got better. Generative AI removed the broken grammar and clumsy formatting that awareness training taught people to look for. The old advice now actively misleads.
• Nobody measures anything. If you cannot say what share of your staff would click today, you cannot say whether last year's training worked.

Awareness without measurement is a feeling, not a control.

The Four Errors That Actually Cost Money

Not all mistakes carry equal weight. In practice, these four cause the overwhelming majority of incidents at small and medium companies.

1. Clicking a Link That Looked Right

The modern phishing email does not look like a scam. It looks like a delivery notification, a shared document, a password expiry notice, or a message from a supplier you actually use. The link goes to a page that is a pixel-accurate copy of a login screen.

The credentials go straight to the attacker. Often nothing else happens for weeks — the attacker reads mail quietly and waits for a payment conversation to join.

What reduces it: Phishing-resistant multi-factor authentication (passkeys or hardware keys). A stolen password on its own becomes worthless.

2. Opening the Attachment

Invoices, CVs, delivery notes, order confirmations. Anyone in finance or HR opens dozens of unexpected files a week — it is literally their job, so "don't open unexpected attachments" is not usable advice for the people most exposed.

What reduces it: Open documents in the browser preview rather than the desktop application. Block macros from files that came from the internet. Keep the endpoint patched. Make it structurally hard for one opened file to become a company-wide problem.

3. Weak and Reused Passwords

The password itself is rarely cracked. It is reused. An employee signs up for a small service with their work email and their usual password, that service gets breached years later, and the combination ends up in a credential list that attackers replay against every login page they can find — including yours.

What reduces it: A password manager for everyone, so unique passwords cost nothing to use. MFA on every external-facing service. Monitoring for your domain's addresses appearing in breach data.

4. Sharing Credentials in Plain Text

The shared social media account. The supplier portal three people need. The admin login for the booking system. The password ends up in a chat thread, an email, or a spreadsheet on a shared drive — and it stays there, searchable, for years.

What reduces it: Shared vaults in the password manager. It solves the actual business need instead of just forbidding the workaround.

Most "Human Error" Is a Design Problem

Here is the shift that changes outcomes: when a mistake is easy to make and expensive to make, that is a system failure, not a character failure.

If a single click on a convincing link can drain an account, the problem is not the click. The problem is that one click was enough.

Blaming people has a specific, measurable cost. In a culture where mistakes get punished, the employee who realises they entered their password on a fake page does not report it. They hope it was nothing. That silence is where a contained incident turns into a breach — the difference between resetting one password in ten minutes and explaining a data loss to your customers and your supervisory authority.

The single highest-value thing you can say to your staff: if you think you clicked something, tell us immediately and nothing bad happens to you. Mean it, and prove it the first time someone tests it.

What Actually Works, In Order of Impact

Note what is not on this list: more slides, longer policies, and a stricter tone.

Measure It, Or You Are Guessing

You would not accept "our finances feel fine" as a report. Human risk deserves the same rigour.

A phishing simulation gives you a number you can act on and compare over time:

• Click rate — how many people followed the link.
• Submit rate — how many went further and entered credentials. This is the number that matters.
• Report rate — how many flagged it. A rising report rate is the clearest sign your culture is improving.
• Time to first report — how fast you would have known in a real attack.

Run it, look at where the clicks cluster, and fix that department's specific exposure. Then run it again in a few months and watch the curve. Individual results should never be used to name and shame — the moment they are, your report rate collapses and you lose the only early warning you had.

The Bottom Line

You cannot train human error to zero. Anyone who promises you that is selling something.

What you can do is make the ordinary mistake survivable: strong authentication so a stolen password does nothing, a password manager so reuse stops being convenient, email authentication so your domain cannot be used against you, and a culture where the person who clicked tells you within the minute.

Start with the number. Run one phishing simulation and find out where you really stand — most companies are surprised, in both directions.

Stay secure,

Want to know your organisation's real click rate? Start a Pilot — we run the simulation, you get the numbers.