Survey Finds Security Pros Still See People as Their Biggest Risk
A Kaseya survey of more than 1,100 IT professionals finds most cite human error as a top security challenge, ahead of email scams.
According to TechRadar, a new survey by Kaseya of more than 1,100 managed service providers and IT professionals worldwide found that human error is seen as one of the largest challenges to online security. The report says 68 percent of respondents cited human error, compared with 55 percent who pointed to email-based scams.
TechRadar also reports that the survey found 80 percent of contributing factors in recent security incidents could be traced to poor user practices or a lack of training. The outlet frames the findings as evidence that people, rather than technology alone, are seen by industry leaders as the main weak point in many organizations.
The summary available to us does not describe the survey's methodology in detail, including how respondents were selected, how the contributing factors were classified, or how the 80 percent figure was calculated. Those details would matter for judging how far the results generalize beyond the people who answered.
The coverage is a reminder that security teams often rank risks differently from the attacks that make headlines. Human error is cited more often than email scams in this survey, even though scams are a common route into organizations.
Background
Cybersecurity has long been shaped by the idea that people are both the most adaptable part of a defense and one of the most exploitable. Early security thinking focused heavily on code, networks and encryption, but attackers quickly learned that tricking a person can be easier than breaking a system. Phishing, credential theft and social engineering have grown into major categories of attack over the past two decades, and many large breaches have started with a single employee clicking a link, reusing a password or approving an unexpected request.
In response, organizations have invested in security awareness training, simulated phishing exercises, multifactor authentication and clearer reporting channels. Many security frameworks now treat people as one control among several rather than as the final safeguard. The idea is that good design should limit the damage any single mistake can cause, so that a lapse does not automatically become a full compromise.
Managed service providers occupy a particular place in this picture. They administer systems for many clients at once, so a weakness in their own habits or a gap in training can spread across a large set of networks. Small and mid-sized businesses often depend on these providers because they lack in-house security staff.
Critics of the human-blame framing argue that calling staff the weakest link can hide poor product design, confusing software and insufficient support. Others argue that training has limits and that secure defaults matter more. Both views share a recognition that the human factor is real, but they disagree about where responsibility should sit.
Why it matters
The survey's headline finding is significant because it shows how the people who defend systems describe their own problems. When most respondents rank human error above email scams, the priority may shift toward behavior and process rather than only toward filters and tools. That can change budgets, training schedules and how incidents are reviewed after they happen.
It also raises a fairness question. If most incidents are attributed to poor user practice, organizations may be tempted to stop there. A focus on individuals can overlook systemic causes, such as tools that are hard to use securely, approval processes that encourage shortcuts, or permissions granted more broadly than needed. Treating people as the problem can make it easier to avoid asking whether the environment set them up to fail.
For smaller businesses that rely on outside providers, the finding has practical consequences. Clients may need to ask their providers how training is delivered, how staff are tested and how they measure whether lessons stick. The answer may matter as much as the technology a provider uses.
The result also highlights a tension in the industry: vendors sell tools that promise to protect against mistakes, while the survey suggests mistakes remain the central concern. Whether those tools reduce human error or simply add complexity will be a key test for the years ahead.
What to watch
Look for the full survey report to see how questions were worded, who responded and how incidents were categorized. Those details will shape how confidently the figures can be read. Comparisons with other surveys from security vendors and independent researchers would also help show whether the pattern holds.
Watch how providers respond. Changes in training programs, adoption of phishing-resistant authentication and reduced default permissions would suggest that organizations are acting on the finding. Equally important is whether incident reports begin to separate user error from design flaws, which would make the human-factor numbers easier to interpret.
Viewpoints
Commentary from our columns: three angles on this story.
The Skeptic open questions and weak points
It is easy to nod along when a survey says people are the biggest security risk. It is harder to ask what that claim actually measures. A figure of 80 percent for contributing factors sounds decisive, but contributing factors are not the same as root causes, and the way an analyst labels an incident can shape the result. If a breach report says a user clicked a link, does that count as the cause, or as the final step in a chain that began with weak controls?
The survey also comes from one vendor and a group of respondents who work in the same field and may have a stake in selling training or tools. That does not make the findings false, but it does mean they should be read as the view of people inside the security business. Their sense of where risk lies is useful, yet it is not the same as an independent audit of what went wrong.
Before accepting the headline, it would help to see the questions, the sample and the classification rules. Until then, the safest reading is that human error is widely seen as a serious problem, not that it has been proven to be the dominant one.
The User what changes for people who use it
For the people who actually sit at a desk and use company email, this story lands in a familiar place. Most employees have been told to watch for suspicious messages, and many have sat through training that felt like a chore. The survey suggests that organizations still rely heavily on those individual moments of judgment, which can feel unfair when the pressure of a busy day makes a mistake easy.
What might change is how the work feels. Better systems would ask less of each person: fewer warnings to interpret, clearer prompts about what is safe, and fewer situations where a single click can open the door. Training that respects people's time and explains why a request looks wrong could help more than a yearly slideshow.
The finding also suggests that users deserve a say in how security is designed. If the people blamed most often are the ones asked to carry the risk, then their experience is part of the evidence that policies need to hear.
The Ledger the business angle
For managed service providers, a finding like this is a business signal as much as a security one. If clients see human error as the main threat, they may expect providers to show measurable progress in training, phishing tests and incident response. That creates a market for services that can prove results, and it may favor firms that can document outcomes rather than simply promise protection.
The economics are also worth noticing. Security tools are a large and growing spending category, yet a survey that points to behavior may push some budget toward staff time, process design and ongoing education. Those costs are harder to package and sell, which could make them easier to neglect when margins are tight.
Providers that serve small businesses face a particular squeeze. They must offer enough training to reduce risk without pricing out clients who already feel stretched. The firms that find efficient ways to deliver good habits at scale may gain an advantage over the next several years.