Why humans are still the weakest link in your organisations cyber defence

Global, Feb 16, 2026

Global research from leading analyst IDC, has revealed that while the threat landscape continues to diversify, human identity remains the biggest vulnerability. 

Their study found that, people are still the easiest way for attackers to gain access to organisations, appearing across all give main causes of initial ransomware attacks. Humans consistently offer the simplest, most accessible entry point. Despite targeting taking significant time, the success rate of infiltration remains much higher than alternative methods. of organisations that paid a ransom handed over between $100,000 and $1 million to regain access to their systems or data. Beyond the financial cost, 81% of breached organisations suffered business disruption lasting from a few days to several weeks.

 

“IDC’s findings reinforce what we’re seeing every day: human identity is still the most exposed and exploitable part of an organisation’s security posture. Attackers don’t need sophisticated exploits when they can rely on everyday behaviours – a distracted click, a reused password, or a supplier account being misused. As the threat landscape diversified, organisations must recognise that protecting identities and shaping secure user behaviour is just as critical as patching systems or deploying new tools.”

Rony Mikhael, Director Networking, Collaboration & Security, Logicalis Germany

 

What does the research show?

The IDC study centred on the question, ‘what are the most significant sources of ransomware compromise?’ The top five responses were:

  1. 18%: Browser-based attack in which attackers gain access during the normal course of internet browsing (users)
  2. 13%: Supply chain attack (e.g., SolarWinds, PC Cleaner, or Kaseya)
  3. 13%: Malware stored on peripheral devices or removable media inserted into a system (user insertion)
  4. 12%: Clicked on a malicious URL or opening a malicious attachment in a phishing email (user click)
  5. 12%: Malicious access that leveraged a compromised credential (user login)

This may not be a surprise to cybersecurity leaders, but with AI enabling attackers to orchestrate at scale, organisations need to secure those human identity risks. 

 

“Cybercriminals have learned that targeting people is both scalable and effective, especially with AI now automating phishing, impersonation, and reconnaissance at unprecedented levels. Eliminating human risk isn’t realistic but reducing it through stronger controls, intelligent detection, and continuous awareness is absolutely achievable.”  

Artur Martins, CISO, Logicalis Portugal

 

How can organisations guard against human threats?

Logicalis Security expert, James Gillies, analysed the five main routes attackers use to create clear steps organisations can follow to reduce the risk of a breach.

 

Human‑Centric Cyber Threats: Recommendations and estimated risk reduction

Threat Area

Key Recommendations

Estimated Improvement

Browser‑Based Attacks

• Use modern, hardened browsers (disable weak ciphers, block third‑party cookies). 
• Implement browser isolation for high‑risk browsing. 
• Monitor user browsing behaviour for anomalies. 
• Conduct regular browser/web app penetration tests.

40–60% reduction in browser originated‑originated compromise risk

Supply Chain Threats

• Perform proactive vulnerability management for internal & integrated supplier systems. 
• Use CTI to score suppliers and identify inherited risks. 
• Restrict supplier access via secure firewall, SSE and ZTNA controls. 
• Monitor supplier accounts for unusual activity.

30–50% reduction in third‑party compromise risk

Malware on Devices

• Deploy XDR to detect malware execution, lateral movement, and persistence. 
• Integrate XDR logs with SIEM for broader correlation. 
• Enforce device control (block unauthorised USBs/removable media). 
• Maintain strong endpoint patching, prioritised via CTI insights.

50–70% reduction in endpoint malware impact

Phishing / Email Interaction

• Run continuous phishing simulations and targeted training. 
• Use XDR policies to detect malicious post‑click behaviour. 
• Apply behavioural analytics to detect mailbox compromise or anomalous login patterns.

35–55% reduction in phishing‑related compromise risk

Compromised Credentials

• Use CTI feeds to identify exposed credentials on leak sites/dark web.
• Apply SIEM correlation across authentication, device, and network behaviours. 
• Implement Zero Trust: continuous verification & least‑privilege access.
• Strengthen password hygiene and MFA hardening.

45–65% reduction in credential‑related compromise risk

Overall Posture Improvement

Implementing all of the above simultaneously enhances user behaviour, control maturity, and third‑party oversight.

65–80% overall reduction in likelihood of initial compromise

 

While ransomware and cyber threats remain prevalent, organisations with the right blend of people, processes, and technology can dramatically reduce human driven cyber risk. Being prepared not only reduces the impact of an attack but also protects reputation, customer trust, and regulatory compliance.‑driven cyber risk. 

 

“Organisations that strengthen identity protections, modernise browser and device controls, and continuously monitor for compromised credentials can dramatically cut their likelihood of a breach. When security teams blend technology with training and well-defined processes, they meaningfully reduce the success rate of human-enabled attacks, even when adversaries invest significant time and patience to infiltrate

Mike Fry, Data and Security Solutions Director, Logicalis UKI

 

Logicalis provides guidance and capability support from prioritising tactical improvements to building scalable, adaptable cybersecurity programs, ensuring organisations remain resilient against human‑centric threats.

 

Related articles:

 

 

Topic

Related Insights