Amidst the growing complexity of cyber threats, one truth remains evident: People–including authorized users and external attackers–are at the center of cybersecurity risk. Although the human element of cybersecurity risk is widely known, the complexities of the modern workplace make it increasingly challenging for individuals to make informed decisions about sensitive data, digital risks, and security protocols:
- For every message they receive, they must quickly assess whether it is legitimate, often relying on cues as subtle as tone, spelling, grammar, and formatting.
- When handling sensitive data, they must balance the need to access and use information with the imperative to protect it from unauthorized parties.
- When navigating the cloud, they must make high-stakes decisions about trust and risk in real time when they encounter authorization prompts.
The sheer volume of these decisions–often made under duress or with limited information–can lead to suboptimal decision-making. Furthermore, there are inherent cognitive biases that influence the human decision-making process, including:
- Confirmation bias, the tendency to prioritize familiar patterns over suspicious anomalies.
- Availability bias, the reliance on recent experiences rather than objective evidence.
- Cognitive fatigue, the diminished ability to reason effectively after prolonged exposure to security alerts and warnings.
These factors create a perfect storm of uncertainty, where even the most well-intentioned individuals can inadvertently compromise organizational security. Furthermore, attackers constantly seek to exploit these vulnerabilities, often using sophisticated social engineering tactics that manipulate users into taking actions that might seem benign. This uncertainty has been intensified even further by recent advances in genAI, which attackers use to engage with their victims in a manner that is even more personalized and convincing.
This report examines some of the most significant risks facing organizations worldwide and explores the successful cybersecurity strategies those organizations have adopted to manage those risks. It centers on four types of cybersecurity risk:
- Social engineering risk: Adversaries attempt to exploit human behavior and bypass security measures using phishing messages over various channels, malicious websites, Trojans, and other tactics.
- Personal app risk: The ubiquity of personal cloud apps in the enterprise has created an environment where users knowingly or unknowingly use personal apps to process sensitive information, leading to the loss of organizational control over data and potential data breaches.
- Generative AI risk: The promises of genAI have inspired a growing percentage of people and organizations to use a variety of genAI to improve their productivity or work quality, often resulting in sensitive information being disclosed to unauthorized third parties.
- Adversarial risk: Highly motivated adversaries are generally well-resourced, sophisticated, and persistent in their attempts to infiltrate an organization.
The remainder of this report explores these four risks in more detail, focusing on trends observed throughout 2024 and into 2025.
Back 
