Exposing Human Risk

Exposing Human Risk uses Mimecast telemetry to measure how often employees click on phishing, run malware or break browsing policy, and who they are. Just 5% of users account for 75% of those risky events, and 52% of employees had a clean record. The detections behind the analysis span more than 42,000 organizations.

Most employees aren’t the problem, and the ones who are tend to be repeat offenders. Users who already click rarely showed no improvement after training, while habitual clickers cut their click rates noticeably, so a targeted approach looks more useful than training everyone the same way. Simulated phishing also gets clicked far more often than the real thing (the two distributions hardly overlap), which raises the question of whether simulations are calibrated to actual attacks. And some users are high risk because attackers target them heavily, as with executives, managers and long-tenured staff, rather than because they’re careless.

The full report gives per-user rates for each behavior, modeled annual frequencies for a 1,000-person organization, sector comparisons of phishing and malware subtypes, and how risky behaviors overlap. It profiles risk by role, department and tenure and closes with recommendations.

Key Findings

• The 5/75 Rule: 5% of users are behind 75% of all detected phishing, malware and browsing events.
• 48% Engaged in Risky Behavior: Almost half (48%) of users clicked a phish, triggered malware or violated browsing policy during the observation period.
• 1% Drive 92% of Malware: Just 1% of users account for 92% of malware download and execution events, and 98% of users had none.
• 48 per 1,000 Phished Yearly: In a modeled 1,000-person organization, 48 users click at least one real phishing email per year and nine click two or more.
• 25% Fewer Clicks After Training: Users prone to clicking cut their click rates by an average of 25% after training; low-risk users showed no change.
• Targeted vs. Tricked: Executives, sales and board members receive the most phishing, while lab employees receive the least but are the most likely to click.

Independent analysis by Cyentia Institute of Mimecast telemetry on user phishing, malware and web browsing behavior, drawn from detections spanning more than 42,000 organizations worldwide.

Cite this report: Cyentia Institute and Mimecast (2024). Exposing Human Risk. https://www.cyentia.com/publication/exposing-human-risk/