The human factor in safety: the figures that matter
68% of breaches involve a human element. Data from the Verizon DBIR and Mimecast on human risk, and what this means for organisations.
· 5 min
When it comes to security, the focus is almost always on technology: firewalls, systems and software. But the data tells a different story. Most incidents do not stem from a technical flaw, but from human behaviour.
Key figures
- 68% of the breaches involve a human element (Verizon DBIR 2024)
- < 60 sec the median time taken to fall for a phishing email (Verizon DBIR 2024)
- 8% / 80% 8% of people account for 80% of incidents (Mimecast)
The most frequently cited statistic comes from the Verizon Data Breach Investigations Report, the industry’s most authoritative study: more than two-thirds of data breaches involve a human element. Not a sophisticated, unstoppable attack, but a click, a password or a configuration error.
The Speed of Risk
One statistic stands out more than any speech: the median time it takes for a person to fall for a phishing email is less than a minute. There is no time to think, to consult a policy, or to recall a training course taken months earlier. The decision is made in a matter of seconds, on instinct. And that is where the risk lies.
If a risky decision is made in less than a minute, defence cannot be a year-long course. It must be a trained response.
What does this mean for your organisation?
These figures do not suggest that people are the problem. They suggest that behaviour is the key. An organisation that wants to reduce risk must stop treating it as a technical problem to be solved with other tools, and start treating it as a behavioural issue to be trained, measured and demonstrated.