Human Error Is Still the #1 Cyber Risk — Build an Office That Survives Mistakes

A survey released today by Kaseya, based on 1,132 MSPs and IT professionals in more than 60 countries, lands on a familiar answer: people, not exotic malware, are the biggest unsolved problem in cybersecurity. 68% of respondents named human error (social engineering and plain distraction) as the threat they worry about most over the next 12 months, with email close behind at 55%.

The useful part is not the scare stat. It's the advice to stop expecting perfection and engineer the business so one bad click doesn't become a bad week.

What the numbers say

• Among organizations that had an incident in the last three years, four of the top five causes were people-related, led by poor user practices (41%) and a lack of security training (40%).
• About 65% said they could pass a compliance audit today without preparation, but 49% admitted incomplete documentation or policies would cause trouble, and 34% pointed to controls that aren't fully in place.
• Only 20% of IT teams say their security budget is keeping pace with real risk, and 65% of MSPs say their clients are underinvested relative to their risk.
• 15% of MSPs have no incident response plan at all. The strongest providers test their clients' plans quarterly.

Why this matters for small businesses

Many small-business incidents start the same way: a believable email, a rushed employee, and nothing behind them to catch the mistake. Training helps, but it's the safety net, not the wall. The goal is a setup where a stolen password or a wrong click gets contained instead of spreading to email, files, and payroll.

Practical next steps (this week)

1. Make MFA mandatory everywhere — email, payroll, banking, and remote access. Prefer app-based or passkey sign-in over text codes for admins.
2. Shrink the blast radius — no one works daily from an admin account, and shared logins get replaced with named accounts.
3. Run short, frequent training — five-minute phishing refreshers monthly beat one long annual video.
4. Write a one-page incident plan — who to call, how to cut off a compromised account, and where backups live. Then test it once a quarter.
5. Keep compliance continuous — update policies and documentation as things change instead of scrambling before an audit or cyber-insurance renewal.

For South Texas teams on-site: pick one shared workstation or front-desk PC this week and confirm it uses named logins, MFA, and current updates. For remote-managed clients nationwide: ask your MSP for your incident plan and the date it was last tested. If nobody can answer, that's the first fix.

Nice2GeekYou is based in San Antonio, serving all of Texas, and our managed IT plans support remote clients across the U.S. with MFA rollout, user training, backups, and documented incident response. Mistakes will happen; the goal is a business that shrugs them off. Request a quote or see our monthly plans.

Sources: Kaseya Cybersecurity Report press release (Oct 6, 2026).