Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Human error was the most frequently selected answer—20%—when 3,066 IT professionals worldwide were asked what they expected to be their top security-management challenge over the following 12 months, according to the Kaseya Security Survey Report 2023 as summarized by ID Agent on November 24, 2023. That is a survey finding, not proof that human error causes most breaches or that it is the leading challenge for every organization.
What the survey actually found
The survey question was: “What do you anticipate will be your top security management challenge in the next 12 months?” Human error led the individual responses, but only one respondent in five selected it. The results were closely clustered rather than dominated by a majority view.
| Anticipated security-management challenge | Share of respondents |
|---|---|
| Human error | 20% |
| IT and security skills | 18% |
| Insider risk | 15% |
| Budget | 13% |
| Security awareness training | 11% |
| Building a security culture | 9% |
| Staffing | 6% |
| Supply-chain risk | 6% |
ID Agent says the report surveyed 3,066 IT professionals worldwide. The available summary does not provide enough sampling detail to treat the respondents as representative of every company, industry or region.
Why “human error” needs careful interpretation
The survey summary does not define human error narrowly enough to say whether respondents meant phishing clicks, weak passwords, misconfigured systems, lost devices, unsafe data handling or another behavior. It also measures an anticipated management challenge, not the documented cause of a particular breach.
#1 Best Overall
That distinction matters. There is no supported percentage here for the share of breaches caused by human error. Treating the 20% response as “20% of breaches” would change both the question and the evidence.
People are part of a system
Calling an incident human error should not end the investigation with blame. Workload, confusing procedures, inaccessible tools, permissions, defaults, staffing and management decisions can all shape what an employee does. A durable response examines those conditions alongside individual actions.
Other surveys point to different leading problems
A 2024 CompTIA State of Cybersecurity excerpt for the United States reports two different challenges tied at 39%: cybersecurity skill gaps among internal employees and the belief that existing security is “good enough.” That question concerns challenges to cybersecurity initiatives, not the next year’s anticipated security-management problem. The excerpt is hosted on Scribd rather than an official CompTIA page, so it should be read as a qualified comparison rather than a definitive industry ranking.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe two results are not contradictory. Survey population, geography, year, wording, response choices and the type of challenge being measured can all change the ranking. An anticipated management concern, an obstacle to an initiative and a verified incident cause are separate measurements.
Rank #3
What the findings say about training
ID Agent’s summary says 53% of respondents identified a lack of end-user or administrator training as a major reason behind their cybersecurity issues. Its displayed root-cause table reports the following individual responses:
- Lack of end-user cybersecurity training: 28%.
- Lack of antivirus defense solutions: 28%.
- Insufficient security support for user devices: 26%.
- Lack of administrator cybersecurity training: 25%.
The 53% figure and the table percentages appear to represent different measures in the summary; they should not be added together or treated as interchangeable. The figures indicate that training is a recurring concern, not that training alone prevents attacks.
How organizations can respond without relying on training alone
Make safer behavior the easy behavior
- Use clear, short policies for passwords, multifactor authentication, data sharing, removable media and incident reporting.
- Configure technical controls—such as phishing-resistant authentication where practical, least-privilege access, secure defaults, patching and endpoint protection—to reduce the consequences of a mistake.
- Give employees a simple, non-punitive way to report suspicious messages, lost devices and accidental disclosures quickly.
Practice and measure
Awareness sessions and phishing simulations can show whether people recognize realistic requests and know how to report them. Results should be used to improve messages, workflows and controls, not to publicly shame individuals. Repeat training when roles, systems or threats change, and track useful outcomes such as reporting speed and remediation time.
Include administrators and leadership
The reported root-cause table includes administrator training, while the survey’s second-highest anticipated challenge was IT and security skills at 18%. Technical staff need role-specific practice in identity, cloud configuration, logging, backup recovery and incident response. Leaders need visibility into risk, staffing and budget so that security is not reduced to an employee-awareness campaign.
Best Value
How to read the headline responsibly
A precise version is: In one 2023 survey, human error was the most frequently cited anticipated security-management challenge. It was the leading individual response at 20%, with skills, insider risk, budget and awareness training close behind. The evidence supports treating employee awareness as one component of a broader security program, not as a universal explanation for breaches.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
