Are Employees Being Blamed For Cybersecurity Failures That Companies Should’ve Prevented? The Experts Weigh In

When a company suffers a cyberattack, it’s often the employee who clicked a suspicious link, opened an attachment or followed a fraudulent instruction who comes under scrutiny. Not always, of course, but often.

However, cybersecurity experts argue that focusing on individual mistakes have the potential to distract from a much bigger issue, which is why just one small error can lead to a serious incident. Surely, companies should have stronger security protocols than that?

Of course, human error can contribute to cyber incidents, but there’s no doubt about the fact that organisations need to take greater responsibility for the systems, safeguards and working environments they create.

 

A Single Mistake Can Expose a Much Bigger Problem

 

Dray Agha, Senior Manager of Security Operations at Huntress, says companies frequently blame staff for incidents rooted in inadequate security controls and poor planning. Attackers deliberately exploit moments when employees are busy, distracted or faced with convincing phishing attempts. “If one employee clicking a malicious link can bring down an entire network, there are much bigger problems that need addressing,” Agha says.

Kevin M. Coles, Author and Fractional CIO, shares this perspective on how employees are deliberately targeted. As he puts it, employees don’t necessarily decide to leave critical security gaps in place, like missing multi-factor authentication or excessive administrative privileges. “If your security plan depends on nobody ever having a bad day, you don’t have a security plan,” Coles says.

For Lianne Potter, Chief AI Security and Ethics Officer at NorthStar Intelligence, the language used after an incident can reveal where responsibility is being placed. “Each phrase puts the individual under scrutiny while pushing the wider system into the background,” she says of terms like “weakest link” and “user error”.

Rather than treating an employee’s mistake as the end of an investigation, Potter argues that organisations should examine why their systems allowed that mistake to cause so much damage.

 

 

AI Is Making Mistakes Harder To Spot

 

The problem is becoming more complicated as cybercriminals use AI to make scams more convincing. Employees may be expected to identify fraudulent messages that closely resemble legitimate requests, even when they’re working under significant time pressure. Shai Gabay, CEO at Trustmi, points to a Trustmi survey in which 71% of employed respondents said they had spotted an error or suspicious detail after already responding to, sharing or acting on it. And of those surveyed, 43% reported experiencing this multiple times.

“General cybersecurity training isn’t enough to stop increasingly sophisticated fraud attacks,” Gabay says. He argues that employers need appropriate technology and training tailored to employees’ specific roles. Richard Ford, CTO at Integrity360, similarly warns that AI is helping cybercriminals create persuasive phishing messages and impersonate trusted colleagues. Security awareness remains important, he says, but it definitely can’t be an organisation’s primary defence.

The challenge also, if not especially, extends to employees who are using AI tools at work. Martin Hartley, Group Chief Commercial Officer at emagine, says organisations that encourage AI adoption without providing approved tools or practical guidance can actually create the conditions for unsafe behaviour. The increasing prevalence of shadow AI is becoming more and more problematic by the day.

 

Accountability Must Go Beyond the Individual

 

That doesn’t mean employees have no responsibility at all. According to Tobias Ander, Founder of Securebyme, deliberately ignoring a reasonable security requirement is completely different from making an understandable mistake under pressure. But, repeated errors or workarounds should prompt management to examine whether secure working practices are realistic and whether expectations encourage shortcuts.

Adam Currie, CISO at HCLSoftware, also emphasises the need for context, which includes whether an employee was trained and understood their actions. Accountability should help organisations learn, rather than become an exercise in finger-pointing, because at the end of the day, the objective is to keep the organisation and employees safe.

“If one person’s mistake can expose everything, the mistake was in the system,” says Roman Oliinyk, Founder and CEO of PayCore Media. He argues for practical safeguards such as requiring a second person to approve large data exports and alerting security teams to bulk data transfers.

Daz Preuss, Chief Operating Officer (UK) at CybExer, also distinguishes between accountability and scapegoating. “A cyberattack is not the failure of any one individual; it is a business risk,” he says.

And that risk becomes harder to manage as organisations introduce autonomous AI agents, something that is happening increasingly often. Dave Allan, Chair of CREST’s UK Council and CEO of Cysiam, argues that these systems need clear ownership, proportionate access, continuous auditing and the ability to disable them when necessary. Michael Heinrich, Co-Founder and CEO at 0G Labs, also highlights the importance of limiting access, monitoring unusual activity and ensuring that compromised accounts can’t expose entire organisations.

 

What Companies Should Really Learn From Cybersecurity Incidents

 

Ultimately, employee awareness matters a lot, but it can’t compensate for weak systems, inadequate investment or unrealistic expectations. Organisations must assume mistakes will happen (because humans are human, after all) and build defences that limit their consequences.

As Will O’Donnell, Client Relationship Manager (Technology and Data) at Robert Walters, puts it, effective cybersecurity depends on balancing employee awareness with strong technical controls. Blaming an employee may explain what happened at one point in an attack, but it doesn’t necessarily explain why the attack succeeded. It’s a lot more useful to figure out how it can all be avoided in the first palce.

 

Calling all cybersecurity startups and SMEs! Enter TechRound’s Cybersecurity40 today. 

 

Our Experts:

 

• Dray Agha: Senior Manager of Security Operations at Huntress
• Shai Gabay: CEO at Trustmi
• Lianne Potter: Chief AI Security and Ethics Officer of NorthStar Intelligence
• Daz Preuss: Chief Operating Officer (UK) at CybExer
• Michael Heinrich: Co-Founder and CEO at 0G Labs
• Roman Oliinyk: Founder and CEO, PayCore Media
• Tobias Ander: Founder of Securebyme
• Richard Ford: CTO at Integrity360
• Dave Allan: Chair of CREST’s UK Council and CEO of Cysiam
• Kevin M. Coles: Author and Fractional CIO
• Martin Hartley: Group Chief Commercial Officer at emagine
• Will O’Donnell: Client Relationship Manager (Technology and Data) at Robert Walters
• Adam Currie: CISO at HCLSoftware

 

Dray Agha, Senior Manager of Security Operations at Huntress

 

 

“We often see companies blame their staff for security incidents that stem from poor corporate planning and inadequate security controls. People will make mistakes, especially when they’re busy, distracted or faced with convincing phishing attempts. Attackers know this and deliberately exploit those moments.

“A strong security programme should anticipate human error and have the right technical controls in place to limit the damage. If one employee clicking a malicious link can bring down an entire network, there are much bigger problems that need addressing. Training is important, but it can only go so far. Businesses need to take responsibility for building systems that can withstand mistakes, rather than expecting employees to get everything right every time.”

 

Shai Gabay, CEO at Trustmi

 

 

“In a recent Trustmi survey, 71% of employed respondents said they’ve spotted an error or suspicious detail after already responding to, sharing, or acting on it. In fact, 43% report having this experience multiple times.

To me, the message is clear. Employees are under tight deadlines and extreme stress that make it easy for errors to slip by. They need technology that makes speed possible without sacrificing confidence. In cybersecurity, that means catching errors and fraud before money moves.

Blame can’t rest on employees when the systems around them aren’t designed for Gen-AI enabled fraud. Fraudsters are moving fast with AI in hand, and attacks are becoming nearly indistinguishable from legitimate requests. General cybersecurity training isn’t enough to stop increasingly sophisticated fraud attacks. Employers need to arm their teams with the right tools and specialized training to spot fraud in their specific roles before it’s too late.”

 

Lianne Potter, Chief AI Security and Ethics Officer of NorthStar Intelligence

 

 

“Are employees being blamed for cybersecurity failures that companies should have prevented?

“Often, yes, and the language gives it away. “Weakest link”, “user error”, “insider threat”. Each phrase puts the individual under scrutiny while pushing the wider system into the background.

“Cybersecurity failures rarely come down to one click in isolation. Legacy technology, underfunding, poor organisational culture and controls that fail to account for human behaviour can all contribute. Yet it is much easier to blame an employee than to examine why one mistake could cause so much damage.

“Training plays a role, but another phishing awareness course is no substitute for effective security controls. People will make mistakes. Organisations need to design systems that anticipate that, rather than rely on employees to compensate for weaknesses elsewhere.

“If one click can bring down an organisation, we should be asking why the system allowed it. Calling it “user error” shouldn’t bring the investigation to a close. It should be the beginning of a much wider conversation about responsibility.”

 

Daz Preuss, Chief Operating Officer (UK) at CybExer

 

 

“There should be accountability for cyber-resilience at every level, through investment, culture and preparation. But accountability is not the same as scapegoating.

“A cyberattack is not the failure of any one individual; it is a business risk, as routine and as inevitable as fire, flood or fraud. The modern attack surface spans thousands of employees, suppliers, systems and culture.

2Punish an employee and you let the real culprit, the attacker, off the hook. Effective incident handling depends on a no-blame culture. As cyber first-aid practitioners point out, dwelling on past mistakes drags people toward depression and dreading the consequences fuels anxiety – yet good response demands calm, present-focused thinking.

“Companies should treat cyberattacks as the shared business risk they are, and then we will all respond better.”

 

Michael Heinrich, Co-Founder and CEO at 0G Labs

 

 

“The recent PHP vulnerabilities show how AI is changing cybersecurity. AI tools helped uncover two serious flaws, which were responsibly disclosed, but attackers can access similar capabilities. Companies can’t expect employees to catch every threat when vulnerabilities can be discovered and exploited so quickly. Blaming individuals for breaches misses the point if the business hasn’t invested in adequate safeguards.

“Cyber resilience starts with limiting access to sensitive systems, continuously monitoring unusual activity and ensuring one compromised account can’t expose an entire organisation. As businesses give AI agents greater autonomy, they also need clear permissions and infrastructure where actions can be verified and audited. At 0G Labs, we’re working on verifiable AI infrastructure because companies need to know what their systems are doing and be able to prove it. Employees still have responsibilities, but leadership must build systems that can contain mistakes, withstand attacks and recover quickly when something goes wrong.”

 

Roman Oliinyk, Founder and CEO, PayCore Media

 

 

“Most breaches blamed on an employee were designed to need one.

“The newest scams don’t trick people into breaking rules. They give instructions. A fake “verify you’re human” box tells you to paste a command, and the employee who follows it takes the blame for a trap professionals built.

“In ten years of building data-leak protection for large companies, I’ve learned that training lowers the odds, but only design limits the damage. Regular staff shouldn’t be able to open a command box at all. Exporting a whole customer list should need a second person. And data leaving in bulk should trigger an alarm in minutes, not show up in next quarter’s report.

“If one person’s mistake can expose everything, the mistake was in the system. Fix that, and the click becomes a non-event.”

 

Tobias Ander, Founder of Securebyme

 

 

“Yes. But the useful question is not whether the employee or the company is to blame. It is what made the failure possible.
If someone understands a reasonable security requirement and deliberately ignores it, individual responsibility matters. But when the same mistakes or workarounds keep appearing, management should look at the conditions around them.

“Was the secure way of working practical? Did time pressure or management expectations encourage shortcuts? Could one ordinary mistake cause far more damage than it should?

“Employees do not make security decisions in a vacuum. They make them inside an organisation, under the pressures and constraints that come with the job.

“After an incident, identifying who made the mistake may be necessary. It should not stop the organisation from asking why it happened and what needs to change.”

 

Richard Ford, CTO at Integrity360

 

 

“Employees are often blamed for clicking malicious links or falling for convincing scams, but that overlooks the responsibility organisations have to protect them. Cybercriminals are increasingly using AI to create persuasive phishing messages and impersonate trusted colleagues, making attacks much harder to recognise. Security awareness training remains important, but it cannot be an organisation’s primary defence. If a single employee mistake can give an attacker unrestricted access to sensitive systems, that points to a wider failure in how security has been designed.

“Businesses need to assume that people will occasionally make mistakes and put controls in place to limit the consequences. Strong identity verification, least privilege access and effective monitoring can prevent one compromised account from becoming a major incident. The question shouldn’t simply be why an employee fell for an attack, but why the organisation’s defences allowed that mistake to cause serious harm.”

 

Dave Allan, Chair of CREST’s UK Council and CEO of Cysiam

 

 

“Data from the Cyber Security Breaches Survey paints a concerning picture. Less than a quarter (24%) of businesses actively engaging with AI have dedicated cybersecurity processes to manage AI technology risk. Meanwhile, AI-related incidents, like hyper-personalised deepfakes targeting CISOs or unmanaged shadow AI agents operating outside of IT oversight, are on the rise. This highlights a fundamental lack of AI understanding that businesses must urgently address.

“Many organisations have historically struggled to trace and define credentials, accounts and processes within their systems. Introducing autonomous, unowned, or poorly understood AI agents only accelerates the difficulty of identifying these vulnerabilities.

“Risk is founded in a lack of understanding, so companies must build their foundational understanding of AI on the basic principles of identity. In order to have transparency and trust, each identity needs to be given a clear owner, purpose, proportionate access and a kill switch that removes the threat but preserves business operations. As well as this, identity trust needs to be earned, validated, continually reassessed and bound in a scope as with any human identity. To reflect the current AI landscape, all existing cybersecurity and identity standards must be urgently reviewed and redefined. Putting these updated standards into practice requires CISOs to establish a clean, fully traceable baseline and a clear vision for AI prior to its adoption. This should be backed by continuous real-time auditing and informed by actionable threat intelligence, to rapidly isolate automated attacks and maintain control.”

 

Kevin M. Coles, Author and Fractional CIO 

 

 

“Yes, constantly. A breach happens, someone clicked a link, and the story becomes about that one person. But if one click can take down a company, the click wasn’t the failure. The failure was a system where one click was all it took.

“Employees didn’t decide to skip multifactor authentication on the finance mailbox. They didn’t give everyone admin rights or leave a vendor’s account active two years after the contract ended. Leadership made those calls, usually by never making them.

“Training matters, but it’s the last layer, not the first. If your security plan depends on nobody ever having a bad day, you don’t have a security plan.

“Blame the person and you fix nothing. Ask why one mistake was enough, and you fix the company.”

 

Martin Hartley, Group Chief Commercial Officer, emagine

 

 

“Employees can become convenient scapegoats for cybersecurity failures rooted in organisational decisions. Shadow AI illustrates this: encouraging employees to embrace AI without providing approved tools or practical guidance creates the conditions for unsafe use.

“We see organisations investing enthusiastically in AI but defaulting to generic awareness training. They are conflating awareness with capability, and that can be a costly mistake because employees need guidance and training that are specific to their roles, alongside secure tools that fit their workflow.

“Safe adoption requires clear policies, appropriate access controls, and oversight from IT, security, legal and compliance teams. Employees have a responsibility to follow those policies, but leaders cannot delegate accountability for security while leaving gaps in tools, oversight, and training.

“After an incident, the question must extend beyond who clicked or uploaded something: did the organisation provide a workable, secure alternative, and safeguards against a foreseeable mistake? Blame alone will not prevent the next cybersecurity incident.”

 

Will O’Donnell, Client Relationship Manager (Technology and Data) at Robert Walters

 

“Human error can often leave the door open for cyber incidents to take place, but they are rarely the main reason behind attacks. Organisations are responsible for implementing the security training, systems, and safeguards needed to stop mistakes becoming major breeches. Effective cybersecurity measures rely on a balance of employee awareness and strong technical controls. When either one of these areas fall short, the best leaders will act quickly, focusing on how they can protect their infrastructure rather than blaming individual usage.”

 

Adam Currie, CISO at HCLSoftware

 

 

“When it comes to employee accountability, there are key questions we need to ask. Were they trained? Were they aware of the actions they were taking? It really is a case-by-case basis and it’s different for each organisation. You need to understand that landscape, identify the appropriate chain of responsibility and accountability, and ensure teams are enabled to be successful.

“If you have too much bureaucracy, it becomes a finger-pointing exercise and you don’t actually learn from the experience. Taking accountability means asking, how do we learn from this and how do we ensure it doesn’t happen again? That’s the most critical piece.”

 

Calling all cybersecurity startups and SMEs! Enter TechRound’s Cybersecurity40 today.