Security Professionals Still See Human Error as Top Threat, Kaseya Survey Finds
A Kaseya survey of more than 1,100 MSPs and IT professionals found 68% consider human error the most concerning attack vector, while 80% of recent incident factors were tied to poor user practices or lack of training.
The survey, reported by TechRadar, found that email-based attacks were the next most cited concern at 55%, followed by user gullibility at 41% and a lack of cybersecurity training for users at 40%. The results indicate that cybersecurity professionals are more worried about user error and the vulnerabilities of “soft” targets than about automated attacks against network hardware and servers. The survey also found that 80% of contributing factors in recent security incidents could be traced back to poor user practices or a lack of training.
Security suites and the teams that use them are increasingly focusing on ways to mitigate the challenges posed by people, the report said.
Compliance checks do not necessarily close the gap. Of those surveyed, 65% said they would pass a compliance audit today, but 49% noted that incomplete documentation and procedures could create problems. Budget pressure was also reported: only 20% of IT departments have a budget that is growing in line with the risks they face, while 77% described themselves as under-resourced.
David Baggett, SVP and GM of Security Suite at Kaseya, said the problem is inherent in relying on people. “People aren’t perfect, and everyone knows it,” Baggett said. “Yet much of cybersecurity still depends on people making the right decision every time.”
Baggett said the answer is not to expect flawless behavior. “The path to true cyber resilience isn’t about eliminating mistakes. It’s about building an organisation that can withstand them. Expect mistakes, account for constraints and engineer around them,” he said. For Kaseya, that means building security systems and practices designed to withstand those mistakes.