When a company suffers a cyberattack, it’s often the employee who clicked a suspicious link, opened an attachment or followed a fraudulent instruction who comes under scrutiny. Not always, of course, but often. However, cybersecurity experts argue that focusing on individual mistakes have the potential to distract from a much bigger issue, which is why just one small error can lead to a serious incident. Surely, companies should have stronger security protocols than that? Of course, human error can contribute to cyber incidents, but there’s no doubt about the fact that organisations need to take greater responsibility for the systems, safeguards and working environments they create.
Dray Agha, Senior Manager of Security Operations at Huntress, explains that attackers deliberately exploit moments when employees are distracted or under pressure. “If one employee clicking a malicious link can bring down an entire network, there are much bigger problems that need addressing,” Agha says. Kevin M. Coles, Fractional CIO at Coles Technical Group, shares this perspective on how employees are deliberately targeted. As he puts it, employees don’t necessarily decide to leave critical security gaps in place, like missing multi-factor authentication or excessive administrative privileges. “If your security plan depends on nobody ever having a bad day, you don’t have a security plan,” Coles says.
The problem is becoming more complicated as cybercriminals use AI to make scams more convincing. Employees may be expected to identify fraudulent messages that closely resemble legitimate requests, even when they’re working under significant time pressure. Shai Gabay, CEO of Trustmi, points to a Trustmi survey in which 71% of employed respondents said they had spotted an error or suspicious detail after already responding to, sharing or acting on it.
And of those surveyed, 43% reported experiencing this multiple times. “General cybersecurity training isn’t enough to stop increasingly sophisticated fraud attacks,” Gabay says. He argues that employers need appropriate technology and training tailored to employees’ specific roles. Richard Ford, CTO at Integrity360, similarly warns that AI is helping cybercriminals create persuasive phishing messages and impersonate trusted colleagues. Security awareness remains important, he says, but it definitely can’t be an organisation’s primary defence.
Shadow AI and Unapproved Tools Create Risks
Organizations that adopt AI without proper oversight introduce additional hazards. Martin Hartley, Group Chief Commercial Officer at emagine, points out that “shadow AI”—unapproved AI tools used by employees—is growing into a major security threat. Without clear guidelines or approved systems, workers may inadvertently introduce vulnerabilities.
Accountability must extend beyond individual employees. Tobias Ander, Founder of Securebyme, distinguishes between reasonable mistakes and deliberate negligence. Repeated errors or workarounds suggest deeper flaws in security policies or unrealistic expectations. “If one person’s mistake can expose everything, the mistake was in the system,” says Roman Oliinyk, Founder and CEO of PayCore Media.
Systemic Flaws Outweigh Human Error Blame
Oliinyk advocates for practical safeguards, such as requiring a second approval for large data exports or triggering alerts for bulk data transfers. These measures help limit the damage a single error can cause. Lianne Potter of NorthStar Intelligence observes how language following a breach often shifts focus away from systemic failures. Phrases like “weakest link” or “user error” frame incidents as isolated human failures rather than symptoms of deeper issues.
Outdated systems, underfunded security teams, and controls that ignore human behavior all contribute, yet companies default to blaming individuals. Potter argues that phishing awareness training alone cannot address gaps created by outdated technology or impractical expectations. Instead, she urges companies to redesign systems that anticipate mistakes and then reduce their impact before they escalate.
For instance, many organizations still rely on manual approvals for sensitive actions, which can be bypassed by AI-driven social engineering. A single employee following an automated instruction, such as a fake “verify your identity” prompt, may trigger a data leak, but the real failure lies in the absence of automated safeguards.
Potter notes that investigations rarely go beyond “When a company suffers a cyberattack, it’s often the employee who clicked a suspicious link, opened an attachment or followed a fraudulent instruction who comes under scrutiny,” when the critical question should be: Why did the system allow that click to cause a breach? She insists that organizations must treat security incidents as opportunities to review controls, not as reasons to punish staff.
AI Transparency and Privilege Controls Needed
Michael Heinrich of 0G Labs emphasizes that verifiable AI infrastructure is essential. Companies must track exactly what their AI systems are doing, and be able to prove it. His firm is developing tools to audit AI actions in real time, ensuring transparency as automation expands. Heinrich stresses that while employees remain responsible for following procedures, leadership must design systems that contain mistakes. This means restricting administrative privileges, enforcing least-privilege access, and ensuring that any single compromised account cannot expose an entire network.
Ultimately, employee awareness matters a lot, but it can’t compensate for weak systems, inadequate investment or unrealistic expectations. Organizations must assume mistakes will happen (because humans are human, after all) and build defenses that limit their consequences. As Will O’Donnell, Client Relationship Manager (Technology and Data) at Robert Walters, puts it, effective cybersecurity depends on balancing employee awareness with strong technical controls. Blaming an employee may explain what happened at one point in an attack, but it doesn’t necessarily explain why the attack succeeded. It’s a lot more useful to figure out how it can all be avoided in the first place.
