What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Human error was the most frequently selected answer—20%—when 3,066 IT professionals worldwide were asked what they expected to be their top security-management challenge over the following 12 months, according to the Kaseya Security Survey Report 2023 as summarized by ID Agent on November 24, 2023. That result makes human error the leading individual response in that survey, not proof that it causes most breaches or affects every organization in the same way.
What the survey actually found
The survey question was: “What do you anticipate will be your top security management challenge in the next 12 months?” Human error received 20% of responses, only slightly ahead of IT and security skills at 18%. Insider risk followed at 15%, while budget constraints accounted for 13% and security awareness training for 11%.
As an Amazon Associate I earn from qualifying purchases.
| Anticipated challenge | Share of respondents |
|---|---|
| Human error | 20% |
| IT and security skills | 18% |
| Insider risk | 15% |
| Budget | 13% |
| Security awareness training | 11% |
| Building a security culture | 9% |
| Staffing | 6% |
| Supply-chain risk | 6% |
Because the leading responses were close and no option reached a majority, the finding is better understood as a priority signal than a definitive ranking of cyber risk. The summary identifies the respondents as IT professionals worldwide, but it does not provide enough sampling detail to claim that the results represent every business, region or industry.
“Human error” is broader than employee mistakes
The survey summary does not define human error narrowly enough to say whether respondents meant phishing clicks, weak passwords, misconfigured systems, mishandled data or other behavior. In practice, people’s actions are shaped by the systems around them. Confusing policies, excessive workload, poorly designed access controls and missing safeguards can all make an error more likely.
#1 Best Overall
For that reason, organizations should avoid treating the statistic as a reason to blame individual workers. A useful investigation asks what combination of process, technology, training and working conditions allowed an unsafe action to occur.
Training and support appear in the same findings
ID Agent’s summary says 53% of respondents identified a lack of end-user or administrator training as a major reason behind their cybersecurity issues. Its displayed root-cause table reports separate figures: 28% cited a lack of end-user cybersecurity training, 28% a lack of antivirus defenses, 26% insufficient security support for user devices and 25% a lack of administrator cybersecurity training.
Rank #2
Those figures use different wording and appear to represent different measures, so they should not be combined into one percentage. Together, they indicate that respondents associated security problems with both human preparation and the technical support surrounding users.
Why another 2024 survey produces a different result
A 2024 CompTIA State of Cybersecurity report excerpt for the United States, hosted on Scribd, gives a different view. It lists cybersecurity skill gaps among internal employees at 39% and the belief that current security is “good enough” at 39% as the leading challenges to cybersecurity initiatives.
| Source and year | Population or scope stated | Question focus | Leading result |
|---|---|---|---|
| Kaseya Security Survey Report 2023, summarized by ID Agent | 3,066 IT professionals worldwide | Expected top security-management challenge in the next 12 months | Human error, 20% |
| CompTIA State of Cybersecurity 2024 excerpt | U.S. report excerpt | Challenges to cybersecurity initiatives | Internal skill gaps, 39%; belief that security is “good enough,” 39% |
These percentages are not a head-to-head comparison. The surveys differ in year, geography, respondent population and question wording. One asks about an anticipated management challenge; the other concerns obstacles to cybersecurity initiatives. Neither measures the percentage of breaches caused by human error.
What organizations can do about the people-related risk
- Make risky actions harder. Use multifactor authentication, least-privilege access, secure defaults, patching and device protections so one mistake does not immediately become an incident.
- Train for the work people actually do. Cover phishing, credential handling, data sharing, remote access and reporting procedures. Short, role-specific exercises are more actionable than a once-a-year generic presentation.
- Test and improve. Phishing simulations and other exercises can show where users need help, but results should be used for coaching and control improvements rather than public punishment.
- Measure reporting, not only failure. Track how quickly suspicious messages are reported, how many accounts use strong authentication and whether high-risk findings are remediated.
- Review the surrounding process. When an incident occurs, examine permissions, interface design, staffing, workload, policy clarity and administrator practices alongside the individual action.
Employee-awareness guidance from STC Business likewise presents training as part of cybersecurity preparation. That is vendor-authored guidance, not independent evidence that training alone prevents breaches. Awareness work is most effective when paired with technical controls, clear policies and responsive support.
Rank #4
What the 20% figure does—and does not—say
- It identifies the most common individual response to one Kaseya survey question.
- It does not mean a majority of respondents chose human error.
- It does not establish a universal share of breaches attributable to human error.
- It does not show that training by itself will eliminate cyber incidents.
- It should not be used to rank organizations without considering their industry, geography, controls and threat profile.
The practical lesson is narrower and more useful: people-related weaknesses were a prominent concern for respondents, alongside skills, insider risk, budgets and security culture. Reducing that exposure requires designing systems and processes that help employees make the safe choice consistently.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- This fun, nerdy, geeky, retro Cybersecurity Awareness Month design is perfect to wear this October. Great for cyber security professionals and experts who keep people safe on the internet, safe online, and safe online.
- Wear this for October National Cyber Security Awareness Month this October, raise awareness about cyber security on smartphones, laptops at your school, in the classroom or on your college or university campus. Be safe online and make sure others are too!
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
