Most security stories focus on shadowy hackers, but the average data breach has a far less cinematic origin. According to IT Security Central's coverage of Cyber Security Awareness Month, the average breach cost has crossed $4 million for the first time, and an estimated 85% of breaches involve some form of human factor. That single statistic reframes the entire cybersecurity conversation.
Internal people, whether malicious, careless or simply uninformed, are now the dominant threat vector. The defenses that target them look different from the ones marketing teams sell.
Key facts
- The average data breach cost has crossed $4 million, according to the report cited by IT Security Central.
- Roughly 85% of data breaches involve a human factor, per the same coverage.
- 61% of surveyed employees failed a basic cybersecurity quiz.
- Cybersecurity is now a top spending priority for 61% of CIOs, per the Gartner 2021 CIO Agenda Survey.
- The average company spends only about 5% of its IT budget on staff training.
Four insider profiles worth knowing
The coverage groups insider risks into four buckets, and the framing is more useful than the usual "trust your employees" advice.
Malicious insiders are the ones the headlines imagine. They take credentials, customer lists or proprietary code and sell or trade them. Motivations range from financial pressure to revenge, and the recent shift to remote work has only increased the number of trusted individuals with sensitive access.
Accidental insiders do not intend harm but cause it anyway. A misaddressed email, a lost laptop, a misconfigured cloud bucket. These incidents are the bulk of the human-factor breaches referenced above. They are also the easiest to reduce with sensible defaults.
Uninformed insiders are people who do not know what a phishing email looks like, do not recognise a malicious attachment, and have no idea what to do when something looks off. With 61% failing a basic quiz, this bucket is larger than most teams realise.
Careless insiders know the rules and ignore them. They reuse "123456," never change passwords, skip multi-factor authentication. The same coverage notes that 35% of people never change a password even after a breach notification. That is not ignorance. That is indifference, and it is harder to fix.
What it means for you
For Agile and Scrum teams, the practical move is to fold cyber hygiene into the existing cadence. Treat phishing simulations and security reviews as sprint deliverables, not separate programs. A two-minute security retro at the end of each sprint raises the floor faster than an annual training video.
For managers handling remote or hybrid teams, the malicious insider risk deserves a second look. Economic pressure and burnout change behaviour in ways that no software can predict. Spotting early warning signs (sudden disgruntlement, unexpected access patterns, unusual hours) is a leadership task, not a tooling task.
For anyone evaluating security spending: tool stack and training budget should grow together. The cheapest defense is a workforce that knows what to do when something looks wrong. The most expensive defense is the same workforce waving through a fake login page.
A worked example
Say you run a five-person Scrum team that handles customer onboarding. One person handles email routing, two others share a database with PII, and the rest use read-only dashboards. The obvious move is to enable multi-factor authentication on every system. The less obvious move is to map exactly which files each role can access, then schedule a short training session on phishing every other sprint. Sixty days later, repeat. Track click rates on your internal test emails. Drop them quarter over quarter. That is a measurable improvement with no new product purchase required.
What to watch next
The economic backdrop matters. Recession talk and layoff cycles correlate with higher insider incidents, and remote work has expanded the surface that any bad actor can reach. Watch how your own team behaves through any future budget cycles. The standard tools, single sign-on, MFA, least-privilege access, are still the foundation. The cultural work above them is what changes outcomes.
Frequently asked questions
What is the largest source of data breaches?
Human factors, including mistakes and social engineering, are estimated to drive around 85% of breaches, per IT Security Central's reporting.
How much does the average data breach cost?
The figure cited in the coverage has crossed $4 million, including detection, escalation, notification and lost business.
What is the first step to reduce insider risk?
Turn on multi-factor authentication across every system, then map which roles can actually access which data. Training comes after that.
Do insider threats include contractors?
Yes. Anyone with legitimate access, including temporary staff and third-party vendors, falls under the umbrella.
Can software fully prevent insider threats?
No. Monitoring tools reduce blind spots, but culture, training and leadership attention are what closes the rest of the gap.