High Risk Users and Where to Find Them

In the process of doing their work, either knowingly or not, users make decisions that can negatively impact their organization. Enterprise information security programs have tried to mitigate this “human risk” by implementing various types of training and checkpoints. But do these processes actually work?

According to the 2022 Verizon Data Breach Investigations Report (DBIR), 82% of all data breaches involve human interaction. This might lead us to believe that all human interactions are inherently dangerous. However, the findings in our own report offer some solace — most users are not risky, but it is only a tiny percentage that carry a high risk.

We found that 76% of users have never clicked a phishing link in an email in contrast to the 4% of users that are responsible for 80% of phishing incidents. Along those same lines, while 93% of users have never had a malware incident, 3% are responsible for 92% of all malware events.

For this report, the Cyentia Institute analyzed almost eight years’ worth of data from Elevate Security (acquired by Mimecast) — from June 2014–July 2022. Take a deeper look into what a high risk user is, where they work in your organization, and how they impact organizations like yours by downloading our white paper today.