iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a 2015 survey of IT and IT security practitioners in the United States and Germany, most respondents said security incidents were more often caused by unintentional employee mistakes than by intentional or malicious acts. That is a finding about practitioners’ perceptions—not a verified count of incidents, and not evidence that users are the biggest threat in organizations today.
What did the survey find?
Ponemon Institute surveyed 1,071 IT and IT security practitioners in the United States and Germany for a study commissioned by Raytheon|Websense. In its July 31, 2015 report on the study, SecurityWeek said 70% of U.S. respondents and 64% of German respondents believed more security incidents were caused by unintentional mistakes than by intentional or malicious acts. SecurityWeek’s report is the source for the figures below.
Those percentages describe what respondents believed about the causes of incidents; they are not a measured breakdown of confirmed incidents. The available report does not state the survey field dates, sampling method, margin of error, full questionnaire wording, or results by company size and sector.
How did U.S. and German responses compare?
| Survey question or concern | United States | Germany |
|---|---|---|
| More incidents attributed to unintentional mistakes than to intentional or malicious acts | 70% of respondents | 64% of respondents |
| Unable to tell whether employee-related incidents were careless or malicious | 49% of respondents | 44% of respondents |
| Concern highlighted in the report | 60% cited inadequate employee training; 50% said executives did not consider data security a priority | 54% cited insufficient safeguards against careless employees |
| More likely response to risky employee behavior, as described by the report | Monitoring behavior | Limiting risky practices |
These are differences in the responses reported in this survey, not evidence that national culture caused them or that they characterize every organization in either country. The report also said 79% of U.S. respondents and 81% of German respondents considered multitaskers more likely to be careless or negligent.
What did respondents say mistakes cost?
Respondents estimated that the time spent responding to incidents caused by human error could cost a U.S. company as much as $1.5 million and a German company €1.6 million. These are reported upper estimates, not typical losses, audited totals, or costs that apply to every company. The report also said practitioners in both countries spent almost three hours per day on average addressing security risks linked to employee mistakes or negligence.
On productivity, 73% of U.S. respondents and 67% of German respondents said employee negligence diminished the productivity of the IT function. As with the other percentages, these figures reflect survey responses rather than an independently measured effect across organizations.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
What response did the survey sponsor recommend?
Ed Hammersla, then president of survey sponsor Raytheon|Websense, attributed negligence to workplace stress, multitasking, long hours, and limited resources or budget. He said: “Workplace stress, multitasking, long hours and a lack of resources and budget are the biggest contributors to employee negligence.” He also argued for a combined response: “Having programs in place that include a mixture of training, policy and technology are vital to addressing insider threats before they become a major issue.”
That recommendation is the sponsor executive’s view, not a tested comparison of prevention programs in the survey. Its practical implication is broader than awareness training alone: organizations should consider whether employees have workable processes, clear rules, appropriate technical safeguards, and enough time and resources to follow them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How much should readers infer from a decade-old survey?
The headline captures the survey’s central perception finding, but “the biggest insider threat” overstates what the reported numbers establish. The study was published in 2015, covered practitioner views in two countries, and did not verify incident causes or provide a current estimate of risk. It cannot show whether the same views or proportions hold in 2026.
SecurityWeek also reproduced the report’s statement that “Germany is often seen as being on the cutting edge of deploying security technology and strictly enforcing security policies.” That is wording attributed to the report, not independent proof about German organizations. The survey’s country comparisons should be read just as narrowly.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
