Topic starter
11/11/2026 5:57 pm
TL;DR: Human error remains the dominant breach driver, with Spin.AI citing misconfiguration, phishing and password weakness as the main pathways. For practitioners, awareness programmes only reduce risk when they are reinforced by controls that catch mistakes before they become incidents.
Editorial analysis by NHI Mgmt Group, based on content published by Spin.AI: “Cybersecurity Awareness: Importance and Purpose”.
By the numbers:
- 85% of data breaches are caused by the human element, including misconfigurations, phishing clicks and poor password choices.
- Compromised credentials account for 20% of cases and phishing for 17%, according to IBM's Cost of Data Breach Report cited by Spin.AI.
- Only 45% of companies impose cybersecurity awareness training, according to Spin.AI.
Key questions
Q: Why do misconfigured sharing settings create breach risk?
A: Misconfigured sharing settings can expose files, folders or records to unintended users, including external accounts and anonymous links.
Q: What should identity teams prioritise after reviewing weak password policies?
A: They should prioritise the full authentication journey, including recovery, MFA enrolment, and account lockout behaviour, not just the password field.
Q: Why do phishing simulations alone give an incomplete view of user susceptibility?
A: Phishing simulations capture a moment of user behaviour, but a missed or ignored message can reflect workload, inbox noise, or irrelevance rather than security awareness.
Practitioner guidance
- Measure behaviour, not attendance Track phishing simulation outcomes, link-click rates and reporting speed so awareness is judged by observed action rather than course completion.
- Separate configuration errors from user error Review external sharing, guest access and link permissions as governance controls, then assign a named owner for each setting.
- Harden password policy and recovery paths Reduce reuse and guessable secrets by tightening password requirements and reviewing reset flows that attackers can abuse after credential theft.
Bottom line: Human error remains the dominant breach pathway, but the underlying issue is governance failure rather than a lack of security messaging.
Glossary terms: Phishing, Cloud misconfiguration, Credential Theft, Security Awareness Training
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Human error is not a training problem alone, it is a control-design problem. Spin.AI's figures reinforce a pattern that identity teams already see in breach reviews: people make mistakes, but systems decide how far those mistakes travel. When awareness is separated from access policy, sharing governance and credential controls, organisations end up relying on memory where they need enforcement. The practical conclusion is to treat human error as a governance input, not as an exceptional event.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- 74% of all breaches included the human element, through error, privilege misuse, stolen credentials or social engineering, according to Verizon's 2023 Data Breach Investigations Report.
A question worth separating out:
Q: What happens when awareness training is not reinforced by controls?
A: Awareness training without controls leaves people as the last barrier, so phishing, password reuse and unsafe data sharing still succeed. Controls such as MFA, email filtering, least privilege, conditional access and secure approval workflows reduce reliance on memory alone and block common failure modes. Training reinforces behaviour, but technical enforcement limits the damage when users make mistakes.
👉 Read our full editorial: Human error turns breach prevention into a governance problem