The Human Habits Behind Most Cybersecurity Breaches

Most security incidents don't start with a sophisticated hack. They start with a tired employee clicking a convincing email, or a shared password nobody thought twice about. The data backs this up consistently, year after year — and 2026's figures make the case more strongly than ever.

The human element is now involved in the majority of breaches

According to Verizon's 2026 Data Breach Investigations Report, 62% of confirmed breaches involved a human element — an employee falling for a social engineering attempt, or making a mistake that opened a path for an attacker. That figure is up from 60% in the previous year's report, suggesting the trend is worsening rather than improving. Separate research from Keepnet's 2026 analysis puts the figure even higher, citing that 95% of cybersecurity issues involve some human element, whether through direct action or a process failure that a person could have caught.

Phishing specifically remains the dominant entry point. The Cybersecurity and Infrastructure Security Agency (CISA) has stated that over 90% of cyberattacks globally begin with phishing as the initial vector, and separate industry analysis puts phishing and stolen credentials consistently among the top causes of successful breaches worldwide.

Why phishing works even on careful people

What's changed in 2026 isn't the basic mechanism of phishing — it's the sophistication. According to Adaptive Security's 2026 analysis, modern phishing messages are increasingly personalised using information gathered from LinkedIn profiles, press releases, and public company information, making them convincing enough to bypass both automated filters and a recipient's own instincts. This shift matters for how training needs to be designed: recognising an obviously fake email is a very different skill from recognising a message that references a real colleague's name, a real project, and a plausible reason for urgency.

The financial impact of this is significant. According to figures compiled in 2026 industry reporting, global phishing-related losses are projected to surpass $25 billion annually, and the FBI's Internet Crime Complaint Centre reported $2.77 billion in Business Email Compromise losses in 2024 alone, across more than 21,000 complaints — an average of roughly $129,000 per incident. These aren't losses driven by unsophisticated organisations; they happen inside companies that have technical defences in place but a gap in human awareness.

It's not just phishing — everyday mistakes matter too

Human error in cybersecurity isn't limited to clicking malicious links. Research compiled by Keepnet in 2026 found that misdirected emails — sending sensitive information to the wrong recipient — accounted for roughly 49% of breaches involving personal information exposure, and 17% of employees admitted to having accidentally emailed an external party by mistake. SentinelOne's 2026 data breach statistics report similarly found that around 45% of data mis-delivery cases involved information sent to the wrong person, often linked simply to employee distraction in the moment.

This reframes the problem usefully: cybersecurity awareness isn't only about recognising malicious intent from an outside attacker. It's also about building careful, deliberate habits around everyday actions — double-checking a recipient before hitting send, verifying a request before acting on it, and pausing before clicking under time pressure.

Training works — when it's designed for behaviour, not just awareness

The encouraging finding across this research is that training genuinely reduces risk when it's designed well. Hoxhunt's 2026 phishing trends data found that organisations using an ongoing, personalised security behaviour programme (rather than a traditional annual or quarterly training session) saw a sixfold improvement in employees recognising and reporting social engineering attempts within six months, along with an 87% reduction in malicious link clicks. Separate industry analysis compiled by Total Assure in 2026 puts the general reduction in human-error incidents from effective security awareness training as high as 86%.

The distinction that matters here is between compliance-driven training — a once-a-year session designed to tick a box — and behaviour-driven training, designed around building habits that hold up under real-world pressure and time constraints. The data consistently favours the latter.

What this means in practice

A handful of practical habits make the biggest difference:

• Slowing down under urgency — attackers deliberately create time pressure because it short-circuits careful thinking; recognising that urgency itself as a red flag is a trainable habit
• Verifying before acting — a quick check (a phone call, a second look at the sender's actual email address) before transferring money, sharing credentials, or sending sensitive data
• Double-checking recipients — given how often misdirected email drives breaches, this simple habit alone addresses a meaningful share of incidents
• Knowing the reporting process — employees who know exactly who to tell, and feel comfortable doing so without blame, catch problems faster

Our Cybersecurity Awareness for Employees course builds these everyday habits through realistic scenarios. For the people responsible for policies, incident response and technical controls, Cybersecurity Fundamentals for Managers & IT Teams covers the management side.

Building genuine security awareness means moving well past the once-a-year tick-box session and toward ongoing habits that hold up under real conditions — because the data is clear that the biggest vulnerability in most organisations isn't the technology. It's the moment a person, under pressure, makes a split-second decision.

If you're planning security awareness training for your team, take our training needs quiz to identify where to start, or book a free consultation to talk it through.