8% of people, 80% of accidents: rethinking our approach to risk
Human risk is concentrated: 8% of people account for 80% of accidents. Why training everyone in the same way doesn’t work, and what to do instead.
· 5 min
There is a finding, revealed by industry research, that should change the way organisations approach human risk: 8% of people are responsible for 80% of security incidents. This is not because that 8% consists of people with malicious intent, but because they are more exposed, more frequently targeted, or simply find themselves in riskier roles or situations.
The risk is not uniform
Traditional training treats everyone the same: the same course, the same content, the same frequency. It is an approach that ignores reality: the risk is concentrated. Providing everyone with the same training means over-training those who do not need it and under-protecting those who are genuinely at risk.
Training everyone in the same way is like treating all patients with the same medicine, regardless of their illness.
The targeted approach
Rethinking our approach means, first and foremost, observing: understanding where the risk actually lies, in which behaviours and among which groups. Then, we need to tailor our training, focusing our attention where it is needed. And finally, we must measure the results to verify that exposure is falling precisely where it was highest.
- 8% / 80% 8% of people account for 80% of incidents (Mimecast)
- just 28% Some organisations combine training with behavioural monitoring (Mimecast)
Only a minority of organisations today combine training with a genuine assessment of behaviour. Most provide training blindly, without knowing whether they are protecting the right people. Rethinking our approach to risk starts here: stop training blindly and start seeing.