Human error turns breach prevention into a governance problem

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Spin.AI's blog post: Human error remains the main breach driver, with misconfiguration, phishing and weak passwords creating most of the exposure.

Why it matters: IAM, NHI and human identity programmes have to assume that training alone will not stop mistakes, so governance must combine user behaviour change with access control, verification and detection.

By the numbers:

• 85% of data breaches are caused by the human element, including misconfigurations, phishing clicks and poor password choices.
• Compromised credentials account for 20% of cases and phishing for 17%, according to IBM's Cost of Data Breach Report cited by Spin.AI.
• Only 45% of companies impose cybersecurity awareness training, according to Spin.AI.
• Phishing susceptibility dropped from 60% to 10% over 12 months in the study Spin.AI cites.

Context

Cybersecurity awareness is the ability to recognise common attack paths, avoid unsafe actions and apply that knowledge under real pressure. In practice, awareness fails when people know the right behaviour but do not use it consistently, which makes the gap as much about governance and habit as about information.

The same weakness shows up across identity and access programmes, because many incidents begin when a person approves something they should have questioned, reuses a weak secret or accepts an unsafe sharing setting. That is why awareness has to sit beside technical controls rather than being treated as a substitute for them.

Key questions

Q: Why do phishing simulations alone give an incomplete view of user susceptibility?

A: Phishing simulations capture a moment of user behaviour, but a missed or ignored message can reflect workload, inbox noise, or irrelevance rather than security awareness. That makes click rates an imperfect proxy for knowledge. To understand true susceptibility, organisations need evidence of recognition, judgement, and decision-making across realistic scenarios, not just a single interaction outcome.

Q: Why do misconfigured sharing settings create breach risk?

A: Misconfigured sharing settings can expose files, folders or records to unintended users, including external accounts and anonymous links. The breach risk comes from excessive permissions, inherited access and public link exposure, which bypass intended access controls and can allow data exfiltration or unauthorised modification. sharing settings

Q: What should identity teams prioritise after reviewing weak password policies?

A: They should prioritise the full authentication journey, including recovery, MFA enrolment, and account lockout behaviour, not just the password field. A good policy reduces guessability, supports user adoption, and limits the conditions that let attackers exploit reused or predictable credentials.

Q: What happens when awareness training is not reinforced by controls?

A: Awareness training without controls leaves people as the last barrier, so phishing, password reuse and unsafe data sharing still succeed. Controls such as MFA, email filtering, least privilege, conditional access and secure approval workflows reduce reliance on memory alone and block common failure modes. Training reinforces behaviour, but technical enforcement limits the damage when users make mistakes.

Technical breakdown

Why phishing awareness decays without reinforcement

Phishing training teaches people to spot a malicious message, but memory and routine erode that skill quickly. A one-off lesson is especially weak against attacks that rely on urgency, familiarity or inbox volume, because the user is asked to make a fast judgment with limited context. Drills, short refreshers and visible consequences improve retention because they convert abstract advice into repeated behaviour. The real mechanism is not education alone but conditioned pause, where the user checks the sender, URL and request before acting. See the Phishing Incident Response Playbook.

Practical implication: Treat phishing resistance as a continuous control and schedule recurring simulations that measure behaviour, not attendance.

How misconfiguration becomes an access problem

A sharing-setting error, exposed link or overly permissive workspace policy turns a simple configuration mistake into an access-control failure. The issue is not only that data becomes visible, but that the organisation has no reliable boundary between intended and unintended recipients. In cloud and collaboration systems, this often means the initial policy is too broad, the review cycle is too slow or ownership is unclear. Once the wrong access path exists, attackers do not need to defeat a control, they only need to find and use the one that was already left open. See the Secure File Sharing Guide.

Practical implication: Map sharing and collaboration settings to explicit ownership and review them as access controls, not as convenience features.

Why weak password behaviour becomes an identity risk

Weak passwords are not a user preference issue alone, they are an identity assurance issue because they lower the cost of credential theft, guessing and reuse attacks. When people choose predictable secrets or reuse them across services, a single compromise can spread into multiple systems. The control problem is that authentication strength depends on both policy and user behaviour, so organisations need stronger defaults, better guidance and fewer places where weak secrets can survive unnoticed. The breach path is usually boring, predictable and fast.

Practical implication: Strengthen authentication policy and remove opportunities for weak secret reuse across the identity estate.

Threat narrative

Attacker objective: The attacker wants to convert human error into unauthorised access, then use that access to steal data, disrupt operations or extend the compromise across connected systems.

1. Entry often begins with a phishing email, a weak password or an unsafe sharing setting that gives the attacker a foothold without technical exploitation.
2. Credential access follows when a user reveals a secret, reuses a password or authorises an overbroad session that the attacker can leverage immediately.
3. Escalation occurs when the compromised account or misconfigured access path reaches files, cloud services or internal systems beyond the original target.
4. Impact is data theft, service disruption or wider business harm, especially when the same weak control exists across multiple users or platforms.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Human error is not a training problem alone, it is a control-design problem. Spin.AI's figures reinforce a pattern that identity teams already see in breach reviews: people make mistakes, but systems decide how far those mistakes travel. When awareness is separated from access policy, sharing governance and credential controls, organisations end up relying on memory where they need enforcement. The practical conclusion is to treat human error as a governance input, not as an exceptional event.

Awareness programmes only matter when they are tied to the exact failure mode that caused the breach. Phishing, password weakness and misconfiguration are different control problems, even if they all sit under the umbrella of human error. That means a single generic training module is less useful than role-specific reinforcement, repeated drills and policy changes that remove easy mistakes. The reader takeaway is to match education to the actual control gap, not to the label of the incident.

Awareness and identity governance now overlap in the same operational question: who can make a mistake that becomes access? In identity-heavy environments, poor decisions about secrets, consent and sharing can become standing access paths for attackers. That is why secure file sharing settings and account policy deserve the same scrutiny as user education. The practitioner conclusion is to govern human action and machine-enforced access together, not separately.

Credential fragility: weak secrets, overbroad sharing and low-friction workflows create a breach surface that attackers can exploit without advanced tooling. The important shift is to identify where convenience has become a security dependency, then remove that dependency before the next campaign arrives. Practitioners should assume the most common failure path will be simple, repeatable and already known to users.

From our research library:

• 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
• 74% of all breaches included the human element, through error, privilege misuse, stolen credentials or social engineering, according to Verizon's 2023 Data Breach Investigations Report.
• Read next: Data Breach Statistics Guide

What this signals

Awareness fatigue is a governance failure, not a communications problem. When users see security messages as repetitive noise, the programme stops changing behaviour and starts measuring completion. The better model is to connect each reminder to the control it supports, especially in environments where access decisions and sharing settings create immediate risk.

Human error should be managed at the point of action. The most effective response is to push verification into the workflow, because people will continue to make rushed decisions under pressure. That means the next generation of awareness work will look more like control design, with policy, authentication and sharing rules doing more of the heavy lifting than slides or annual training.

Credential fragility: attackers keep winning where weak passwords, reused secrets and recovery shortcuts shorten the path from mistake to compromise. Programmes that remove those shortcuts will outlast programmes that merely warn about them.

For practitioners

• Measure behaviour, not attendance Track phishing simulation outcomes, link-click rates and reporting speed so awareness is judged by observed action rather than course completion.
• Separate configuration errors from user error Review external sharing, guest access and link permissions as governance controls, then assign a named owner for each setting.
• Harden password policy and recovery paths Reduce reuse and guessable secrets by tightening password requirements and reviewing reset flows that attackers can abuse after credential theft.
• Include management in the same control loop Require leaders to complete the same training and drills as staff so exceptions do not weaken the organisation's security posture.

Key takeaways

• Human error remains the dominant breach pathway, but the underlying issue is governance failure rather than a lack of security messaging.
• Spin.AI cites 85% of breaches, 45% awareness training adoption and a large drop in phishing susceptibility when training is sustained.
• The practical fix is to pair behaviour change with access control, sharing governance and credential hardening so mistakes do not become incidents.

Related NHI Mgmt Group resources: Phishing Incident Response Playbook · Secure File Sharing Guide · Data Breach Statistics Guide

Key terms

• Phishing: Phishing is a deceptive message or website designed to trick a person into revealing credentials or other sensitive information. In identity terms, it is an unauthorised collection method that turns human trust into downstream account access and potential privilege abuse.
• Cloud misconfiguration: A security failure caused by incorrect permissions, exposure settings, or integration design in cloud services. It is often less about the cloud platform itself and more about access paths that were created quickly, left broad, and never fully revalidated against actual business need.
• Credential Theft: Credential theft is the unauthorized capture of secrets used to authenticate a user or workload, such as passwords, MFA codes, or security questions. In SaaS environments, it usually produces login events that defenders can inspect, but it still becomes dangerous when attackers combine it with token abuse or integration misuse.
• Security Awareness Training: Security Awareness Training is the practice of teaching people how to recognize and respond to security risks in daily work. It covers phishing, password hygiene, data handling, social engineering, device safety, and reporting procedures. Effective training changes behavior, supports policy compliance, and reduces human error as an attack path.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, and secrets management. It helps practitioners connect identity control design to the broader security programme they run.