What percentage of data breaches are caused by human error?

Roughly two-thirds. The Verizon 2024 Data Breach Investigations Report found a human element, such as error, credential misuse, or falling for social engineering, in about 68 percent of breaches. That share has stayed high for years despite better security technology.

How do attackers impersonate IT support?

They contact a user directly through chat or remote-support tools such as Microsoft Teams or ScreenConnect, claim to be from IT or a trusted vendor, and request remote access to fix an urgent issue. Once granted, they can install malware and steal data within minutes. Because it avoids email, it bypasses phishing filters and training, so staff should verify every unexpected access request through a known internal contact.

Can security awareness training reduce social engineering risk?

Yes, measurably. Organizations that run short, regular training alongside realistic simulations typically see engagement with test attacks fall from 20 to 30 percent into the single digits within a few cycles, while reporting of suspicious messages rises. Frequency and practice matter more than a single annual session.

Does multi-factor authentication stop social engineering?

It stops most automated credential attacks but not all social engineering. Microsoft reports MFA blocks over 99.9 percent of automated account-compromise attempts, yet attackers can still trick users into approving a fraudulent prompt or granting remote access. Phishing-resistant MFA such as hardware keys or passkeys closes much of that gap.

What is the most common social engineering threat?

Phishing is still the most common entry point, but direct impersonation of IT support over chat and remote-support tools is rising fast. Both rely on getting a legitimate user to act, and a single success often becomes the foothold for a wider attack.

Blog

Insights on cybersecurity, managed IT, and technology strategy for Canadian businesses.

Cybersecurity

Human Error Remains the Biggest Cybersecurity Risk

You can spend six figures on firewalls, endpoint protection, and round-the-clock monitoring and still get breached because one employee granted access to someone they believed was IT support. That is…