Technology is responsible for part of security — the rest depends on people. Most successful attacks start with a simple user mistake. The good news: these mistakes can be effectively reduced.

The most common mistakes

1. Clicking on phishing

Fake invoices, “urgent” requests from the CEO, links to supposed parcels. Phishing works because it plays on emotion and haste. The antidote is awareness and the habit of verifying the sender before clicking.

2. Weak and reused passwords

The same password across many services means one leak opens many doors for an attacker. The solution: a password manager and unique, long passwords for every account.

3. No MFA

Multi-factor authentication is one of the most effective and cheapest safeguards. Even if a password leaks, the second factor stops the attack. Enable it at least on e-mail, VPN and administrative accounts.

4. Mixing personal and work matters

Unsecured personal devices and work data in a private inbox are a classic source of leaks.

How to genuinely reduce the risk

A one-off, hour-long training session once a year doesn't work — the knowledge fades. A micro-training programme is more effective: 15-20 minutes a month, short and to the point, ideally combined with controlled phishing simulations.

Minimum hygiene for every employee

  • MFA on e-mail and key systems.
  • A password manager and unique passwords.
  • Verify the sender before clicking a link or attachment.
  • Knowing a simple procedure: “report it when something looks suspicious”.

The cheapest investment in security is an aware team. Regular micro-training pays for itself with the first attack that never succeeds.