Richard Humphreys |
Many organisations continue to focus on the technology aspect of cyber defence, which is crucial, but often at the expense of people risks, which represent the largest source of data breach claims. That’s according to data from Willis Towers Watson, which shows that employee negligence or malicious acts account for two-thirds (66%) of cyber breaches where, by contrast, only 18% were directly driven by an external threat, and cyber extortion accounted for just 2%. The data further show that approximately 90% of all cyber claims are the result of some type of human error or behaviour.
As a result, Willis Towers Watson is urging businesses to focus more on employees and company culture to manage cyber risk. To help in these efforts, it has launched a Cyber Risk Culture Survey solution. The offering connects human capital and workplace culture to employer cyber risk vulnerability. The solution addresses companies’ leading challenges around cyber risk, such as tracking the extent of risk inherent in their people’s behaviours, determining ways to mitigate this factor and ultimately building a cyber smart workforce.
“Evidence suggests that many businesses are taking an overly technocratic approach to cyber risk and are in danger of missing the bigger picture,” said Anthony Dagostino, head of global cyber risk at Willis Towers Watson. “While technology has an important role to play, it really needs to be linked with an understanding of the human element. The simple truth is that a data compromise is more likely to come from an employee leaving a laptop on the train than from a malicious criminal hack. We believe employees and companies with a strong culture and cyber aware workforce are the first line of defence against cyber risk.”
The Cyber Risk Culture Survey solution has three different models, tailored to a company’s needs. The tool measures an organisation’s cultural elements of cyber risk related to human capital awareness and frequency of supportive employee actions. The survey results provide a clear picture of an organisation’s internal risk culture, with a particular focus on where it might be most vulnerable to employee-driven cyber incidents. These results allow senior leadership to take decisive action to create solutions, including cultural changes, and talent and reward interventions, to mitigate cyber risk.
“When we talk to clients about cyber risk, they tell us bridging their operational silos is one of the biggest hurdles within their organisations,” said Patrick Kulesa, director of employee survey research at Willis Towers Watson. “Our offering is relevant to many audiences within the organisation – not only corporate risk managers, data security teams and human resource professionals, but the entire executive suite – all of whom are crucial links in the chain of cyber risk management and mitigation.”