The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The World Economic Forum (WEF) has published several versions of a 95% human-error cybersecurity claim, but they do not all describe the same thing. Its 2025 article says that 95% of data breaches in 2024 were tied to human error; its 2022 Global Risks Report refers to 95% of “cybersecurity issues” being traceable to human error. Neither wording establishes that 95% of all cybersecurity incidents are caused by people.
What the WEF’s 95% figure says—and what it doesn’t
The most recent formulation in the reviewed WEF material appears in its 2025 article: 95% of data breaches in 2024 were tied to human error. That is an attributed statement about data breaches in a specified year—not a universal rate for every kind of cybersecurity incident. The WEF page links to a secondary publication for the figure and does not present the underlying dataset or methodology.
An earlier WEF source, the Global Risks Report 2022, uses different language: 95% of “cybersecurity issues” could be traced to human error. A WEF article from 2021 instead says human error was involved in 95% of successful cyberattacks, while a 2022 business-resilience article attributes a 95% breach figure to cybersecurity training company Cybint. These formulations have different denominators and attributions; they should not be combined into a single verified incident rate.
So, is it true that 95% of cybersecurity incidents are caused by human error? That exact claim is too broad to treat as established by these WEF publications. The defensible version is narrower: the WEF’s 2025 article says that 95% of data breaches in 2024 were tied to human error, while an underlying dataset and methodology are not provided on that page.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11#1 Best Overall
Why the numbers differ
“Cybersecurity issue,” “successful cyberattack,” “breach,” and “incident” are not interchangeable categories. A breach involves unauthorized access or disclosure of data; broader incident or issue categories may include events that did not result in a breach. The wording also shifts between “caused by,” “involved,” “traced to,” and “tied to” human error. Those phrases can describe different degrees of connection, so the statistic should be quoted with the source’s own wording and year.
| WEF publication or source | Reported figure | What it describes |
|---|---|---|
| Global Risks Report 2022 | 95% | “Cybersecurity issues” that could be traced to human error |
| WEF article, 2021 | 95% | Successful cyberattacks in which human error was said to be involved; the article cites a secondary publication |
| WEF business-resilience article, 2022 | 95% | A breach figure attributed to Cybint |
| WEF article, 2025 | 95% | Data breaches in 2024 said to be tied to human error; the article links to a secondary publication |
These are reported claims, not a set of directly comparable measurements. The available WEF pages do not establish one original dataset that verifies a universal 95% rate for cybersecurity incidents.
What other WEF figures tell us
The WEF’s Global Cybersecurity Outlook 2025 offers separate measures of organizational experience and preparedness. It reports that 42% of organizations saw an increase in phishing and social-engineering attacks in 2024, and that 35% of small organizations believed their cyber resilience was inadequate. Those survey findings describe reported attack trends and perceptions of resilience; they do not validate the 95% human-error claim.
A separate comparison illustrates why year and source matter: the WEF reported in 2022 that Verizon put the share of cybersecurity breaches in the prior year due to a “human element” at 82%. That is a different figure with a different formulation and reference period, not evidence that the 95% statistic applies across all breaches or incidents.
Rank #3
What organizations can do about human-related risk
Human behavior is one part of cybersecurity risk, alongside technology and process. Treating employees as the problem misses how confusing interfaces, weak defaults, rushed workflows, or unclear reporting routes can make unsafe actions more likely. WEF materials favor a combined approach: leadership accountability, secure system design, effective controls, and training that helps people use those controls.
Make secure behavior easier by design
- Enable multifactor or second-factor authentication where accounts and services support it. For important accounts, a hardware security key is one option; check that the service supports the key’s protocol before choosing a model.
- Use automatic updates and encryption defaults where appropriate, rather than relying on each person to discover and configure protections.
- Design security steps around real tasks so protections are usable and do not force workers into avoidable workarounds.
- Give employees a clear way to report suspicious messages or possible mistakes, and make the reporting route easy to find.
Train for actual work and likely threats
Training should reach people outside IT, reflect the threats and decisions relevant to their roles, and continue over time. Practical exercises, including controlled phishing simulations, can give employees a chance to recognize and report suspicious messages. When assessing a training program, consider whether it offers practice and feedback, adapts to changing social-engineering tactics, is accessible across the workforce, measures outcomes in a privacy-respecting way, and complements technical controls. The WEF material supports ongoing education and exercises but does not establish that one training vendor outperforms another.
As Lisette Guittard’s WEF article quotes behavioral economist Richard Thaler’s book Nudge: “If you want to get people to do something, make it easy. Remove the obstacles.” The practical implication is to pair training with secure defaults and workable processes, not to expect awareness alone to compensate for weak systems.
Rehearse response, not just prevention
Organizations should identify the threats and risky processes most relevant to them, then establish and rehearse incident-response plans. Employees need to know whom to contact and what information to preserve if they suspect a compromise. A practiced process makes it more likely that a warning is reported promptly and handled consistently.
Recommended Free Tools
Quick Recap
Best Value
How to quote the statistic accurately
- For the current WEF wording, say: “A 2025 World Economic Forum article says 95% of data breaches in 2024 were tied to human error.”
- Do not rewrite that as “95% of cybersecurity incidents are caused by human error.” The category and causal wording are broader than the cited claim.
- When discussing the 2022 Global Risks Report, retain its term “cybersecurity issues” and identify the report year.
- Make clear that the 2025 article links to a secondary source and does not provide the underlying methodology on its page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
