10 Ways Employees Are Sabotaging Your Cybersecurity Stance

The threat landscape is evolving, and attack surfaces are expanding. Still, one of organizations’ weakest links is often well-meaning employees making inadvertent mistakes. 

“Well-intentioned employees continue to use consumer grade software tools to make their work easy and more productive,” says Eric Schmitt, global chief information security officer at Sedgwick, a global claims administrator which offers technology-enabled risk, benefits and integrated business solutions. “These tools include cloud storage services, file-sharing apps, messaging platforms, video conferencing tools and personal devices. While these tools may seem harmless and convenient, they can pose serious risks to your business’ cybersecurity.” 

One notable threat is the fact that consumer-grade products and services weren’t designed for enterprise-grade security and compliance, which can cause data leakage, unauthorized access and compliance breaches. 

“To address this threat, employees need training on IT policies, emphasizing the risks of shadow IT and the importance of consulting IT before adopting new tools. Enterprises can deploy cloud access security brokers (CASBs) to monitor and control unauthorized cloud services, ensuring adherence to security policies,” says Omer Cohen, CISO at customer authentication and identity management platform Descope, in an email interview. “Given the numerous data breaches and compliance violations stemming from shadow IT, this proactive approach is crucial for maintaining cybersecurity.” 

Employees may also be lax about software updates, which can translate to unpatched vulnerabilities. 

“Exposing sensitive information, even if inadvertently, could lead to noncompliance and put the organization at risk of facing corresponding penalties from regulatory bodies. Additionally, threat actors often scan for known vulnerabilities and once identified, can gain access to an employee’s device through this vulnerability, and leverage that access to then gain entry to the organization’s networks and systems,” says Jordan Rae Kelly, a senior managing director and head of cybersecurity for the Americas at business consulting and global advisory firm FTI Consulting in an email interview. “Even with robust protections in place, a cybersecurity incident can make the organization appear to have a poor cybersecurity program. This harms value to investors and reputation to customers.” 

To discover, monitor, and manage shadow IT, Kelly says businesses should: 

Following are some more ways employees undermine cybersecurity and what to do about them.