Your employees are not the weak link in your security. That framing is popular and it is mostly wrong, because it blames people for a setup that was never built to survive an ordinary bad morning.
What is true is that ordinary mistakes cause a lot of damage. The OAIC’s figures for January to June 2025 recorded 532 data breach notifications, with human error behind 37% of them, 193 notifications, up from 29% in the previous six months. Malicious or criminal attack accounted for 59%.
So the question is not how to make people more careful. It is which five mistakes keep happening, and what you can change so they stop mattering.
1. One password, used everywhere
People reuse passwords because remembering fifteen different ones is genuinely impossible. Telling them to try harder does not work and never has.
The Australian Signals Directorate’s guidance is that length beats complexity: a long passphrase takes far more time and effort to crack than a short password with a symbol jammed in. ASD also points straight at password managers, both for storing passwords and for generating long random ones, with a different one for every account.
Roll out a business password manager and the problem largely solves itself, because the easy path becomes the safe one. Do it before you write the policy, not after.
Over the year to August, 18 tickets across 15 of the businesses we support were password resets or locked accounts. None of those were incidents. They are just the everyday friction that makes people reuse a password in the first place.
2. Acting on a message because it sounded urgent
This is the big one, and it is not about being gullible. ASD’s guidance on social engineering describes attackers going to real lengths to look legitimate, and notes that AI tools have made voice cloning and convincing text much easier to produce.
The patterns to know by name:
- Chief executive or chief financial officer fraud, where someone impersonates a senior person and urgently asks for a high value payment.
- Vishing, a phone call impersonating a colleague or executive to extract information or get a password reset done.
- Unexpected attachments and links, especially where the message creates a reason to hurry.
ASD’s advice is the practical bit: if a message is unexpected, do not click the link. Go to the organisation’s site or app yourself and sign in the way you normally do. If you are unsure, confirm with the sender on a contact method you already had, not one supplied in the message.
Across the same year, 18 tickets from 14 businesses were staff sending us a suspicious email or asking about something in quarantine. Every one of those is a good outcome. Someone stopped and asked, which is exactly the behaviour you want, and it only happens when people know it will not be treated as a nuisance.
3. Doing work on a device nobody manages
Hybrid work made this normal. A personal laptop that opens company email, a phone with the file app signed in, a home desktop used for one urgent quote on a Sunday.
Microsoft’s own shared responsibility model is clear that endpoints stay your responsibility no matter who runs the software. If a device touches business data, it needs to meet the same standard as the ones you bought: current updates, disk encryption, screen lock, and the ability to be wiped remotely if it goes missing.
The fix is a decision more than a technology. Either the device is managed, or it does not get access. Half measures here are how a business ends up unable to answer a simple question after a theft: what was actually on it.
4. Putting off updates
“Remind me later” is the most reasonable looking mistake on this list. ASD’s guidance on updates puts it plainly: criminals look for the easiest way in, and software weaknesses are one of the most common ways they find it.
The reason people defer updates is almost always that the restart comes at a bad time. So take the choice away politely. Enforce updates centrally, set the restart window outside working hours, and make sure someone is checking which machines have quietly stopped reporting in. A patching policy that nobody verifies is a spreadsheet, not a control.
5. Being helpful to a stranger
ASD describes one of the simplest techniques there is: exploiting a person’s natural desire to be helpful. Someone posing as a colleague asks for copies of documents they say they deleted. Someone plausible asks for a small piece of information they could reasonably be expected to know.
Two specifics from the same guidance are worth telling every staff member this week. Never share registration PINs or verification codes for accounts or messaging apps, because attackers use them to add their own device. And your password reset process should never require anyone to tell someone else their current password, for any reason.
The social media angle from the original version of this advice still holds. Roles, holidays, project details and who is away this week are all useful to someone building a convincing story.
The control that sits under all five
Multi-factor authentication. ASD calls it one of the most effective ways to protect accounts against unauthorised access, because a stolen password on its own stops being enough.
If you only do one thing from this article, enforce it on every account that can reach email, files or money. Not “available to staff”. Enforced.
What to fix this month
- Turn on and enforce multi-factor authentication everywhere it is available.
- Put a password manager in front of every staff member, then stop asking them to memorise anything.
- Write down one payment rule: any change of bank details or urgent payment request gets a call back on a number you already had, no exceptions, regardless of who it appears to come from.
- Decide what happens with personal devices, and apply the answer consistently.
- Tell your team explicitly that reporting a suspicious message is always welcome and never a waste of anyone’s time.
None of those depend on your staff being more careful than they were yesterday. That is the point.
Start here: pick number three. It takes ten minutes, it costs nothing, and it stops the most expensive version of all five mistakes. If you’d like a second opinion on the rest, get in touch.