The Human Element: Why Your Biggest Security Risk Isn’t Your Technology

If your business has a firewall protecting its network, antivirus on every computer, and a spam filter catching the obvious junk, you’ve built a solid foundation against everyday threats. If you’ve never had a breach, it’s easy to read that clean record as proof your security is doing its job.

Those tools still depend on the person at the keyboard. Trond Aarflot, Director of Technology and Operations at Ironclad TEK, describes computers as “very effective, efficient, powerful machines” that follow instructions without any judgment of their own: “If you tell it to do something risky, if you click on a link that’s not safe, it will go there.” Verizon’s 2026 Data Breach Investigations Report found that 62% of confirmed breaches involved a human element, such as an employee falling for a phishing email or being talked into handing over access.

We see the same pattern with the Calgary businesses we support. Incidents often start with one person clicking a link or opening a file while the security tools keep working as designed. Reducing that risk starts with understanding how attackers earn that click in the first place. This article covers how attackers use public information to build believable, targeted attacks, how AI makes those attacks faster to launch, and what it takes to train your team to catch the attacks your tools miss.

Technology Does Exactly What It’s Told, and That’s the Problem

Security tools work by following rules. They block what they’ve been told is dangerous and let everything else through, which makes them fast and reliable against known threats. An attack that matches none of those rules, or that only needs a person to act on a request, can pass straight through.

What Your Security Tools Can and Can’t Catch

Your security tools each handle a specific job well:

• A firewall controls which traffic enters your network.

• Antivirus and endpoint protection recognize known malicious files and suspicious activity on devices.

• Email filters flag messages that match known spam and phishing patterns.

• Monitoring tools can alert your team to unusual behaviour, such as a login from another country at 3 a.m.

As Trond explains, the goal for businesses like yours should be to use technology to “basically remove the ability” for someone to take risky action in the first place, then flag it “when it happens anyway, so that you can respond right away.” That may mean blocking a link to a known malicious site, stopping a file that matches a ransomware signature, or locking a compromised account before an attacker can do more damage.

What these tools have in common is that each one looks for something it already recognizes. None of them can judge whether a message is honest, which is the question your team answers every time they open their inbox.

Human Error in Cybersecurity: How One Click Can Bypass Your Defences

Here’s what that looks like in practice. A convincing phishing email might link to a newly created website that has no bad reputation yet or simply ask an employee to share information or authorize a payment. If someone enters their Microsoft 365 password into a fake login page, the firewall sees an ordinary web visit, and antivirus sees an ordinary browser session. The tools have done their jobs, but the attacker can now sign in to that employee’s email, files, and Teams as if they were the employee.

As Trond puts it, “humans are kind of the weakest link.” That’s not a criticism of your staff. Unlike a firewall, people can’t be configured to block every threat by default. They make dozens of decisions each day about which emails to trust, which links to click, and which requests to act on. An attacker only needs one of those decisions to go wrong.

Attackers are “becoming so sophisticated in their attacks,” Trond says, that security awareness training has grown into a major part of keeping a business secure.

Ironclad TEK sells and manages many of the security tools described above. We also deliver security awareness training, because those tools can’t cover the decisions your team makes in their inboxes every day. The tools reduce how often your team faces a dangerous message and limit the damage when an attacker gets in. Training prepares the person reading the email to make the final call.

How Attackers Build a Message Tailored to You

An effective cyberattack doesn’t always start with a technical break-in. Sometimes, it starts with a quick search of information about you that’s already public.

Trond saw this firsthand when an identity-protection service alerted him that his name and home address had appeared online. On their own, those details might seem harmless. But as he explains, putting himself in an attacker’s shoes, “None of those can lead to an exploit on their own, but it can lead to me crafting a very tailored email that makes it seem like I really know you.” A little personal information can turn a generic scam into a message that feels familiar enough to trust.

Security researchers call this open-source intelligence, or OSINT: building a profile using publicly available information. Attackers can piece together details from data broker sites, LinkedIn profiles, company team pages, press releases, and social media posts about holidays or other personal activities. One analysis found that 99% of executives studied had personal information listed on more than three dozen data broker sites, and every listing hands an attacker a few more pieces to stitch together.

What a Business Email Compromise Attempt Actually Looks Like

Business email compromise (BEC) is a scam in which an attacker impersonates someone your staff already trusts, like an executive, coworker, or supplier, to trick them into sending money or sensitive information. Sometimes the attacker has broken into a real email account. Often, they register a lookalike domain, such as acrneplumbing.ca in place of acmeplumbing.ca, that passes a quick glance on a phone screen.

Here’s how the research described above can feed into one. Let’s say your company website shows that Sarah handles accounts payable. Her LinkedIn profile identifies her manager, and a recent press release names your software vendor. An attacker can use those details to email Sarah from an address resembling her boss’s, mention the real vendor, and ask her to update its banking details before Friday’s payment run.  The CAFC notes that spear phishing attacks are launched after identifying an accounts payable employee, the person whose job is to process routine payment requests quickly.

Some versions are even simpler. Chad Cunningham, Director of Business Development at Ironclad TEK, describes how ordinary it looks: “You get an email from me saying, ‘Can you pay this invoice for $20,000?’ And then you just go ahead and pay it, and then you realize it was fake.” Nothing in that exchange trips a security alert. There’s no attachment to scan and no malicious link to block, only a plausible request from a familiar name arriving in the middle of a busy week.

The financial stakes are significant. The Canadian Anti-Fraud Centre recorded $67.9 million in reported losses from spear phishing in 2025, the second-highest dollar loss of any fraud category that year. And because the CAFC estimates that only 5 to 10% of fraud victims report, this only captures a fraction of the problem. Once the money leaves, getting it back depends heavily on fast reporting. In one 2025 case, the CAFC worked with Hong Kong police to recover $2.3 million a Vancouver-area law firm had wired after a spear phishing email, an outcome that depended on investigators acting quickly before the funds disappeared.

AI Has Shortened the Timeline from Weeks to Hours

Preparing a cyberattack used to take time. Attackers had to research their targets, write believable messages, and find weaknesses to exploit. AI has sped up many of those steps, shrinking the time defenders have to react.

Trond has seen that timeline change firsthand. Creating a targeted attack, from researching someone to sending them a convincing message, “used to be six weeks,” he says. “They’re launching attacks on you within 20 hours.” He sees a similar acceleration in the development of zero-day exploits, which target software vulnerabilities the vendor doesn’t yet know about. These can now be built “in less than a 24-hour cycle.”

The barrier to entry has dropped, too. In Trond’s experience, some attackers are just 16 to 18 years old. “They’re just kids,” he says. With AI tools that are cheap or free and information readily available online, people with limited technical experience can attempt attacks that once required more time and skill. Some attacks that cause serious damage need little technical skill at all. In July 2025, UK authorities arrested four people aged 17 to 20 in connection with attacks on Marks & Spencer, Harrods, and the Co-op. The group involved was known for calling IT help desks, impersonating employees, and persuading staff to reset passwords, a reminder that a convincing phone call can open the same door as a legitimate-looking email.

AI can help attackers research a business and write polished, personalized messages that include accurate details about its staff, suppliers, or operations. The old warning signs, such as broken grammar, generic greetings, and awkward formatting, are no longer reliable indicators of a scam. Your team needs to judge unexpected requests by what they’re asking them to do, however convincing the message looks.

Reducing Human Error Takes More Than “Be Careful”

So, what can your team do when a message feels unusually personal or plausible? Slow down and verify before acting. Even Trond, despite years of security experience, still looks at some messages “two or three times” before deciding whether they’re legitimate. Pausing to question an unexpected request is good judgment, so make it part of your workplace culture, especially when a message asks someone to share information, change payment details, or act urgently.

Telling people to “be careful” only goes so far. Without clear rules and regular practice, even good advice gets forgotten when someone is rushing to clear their inbox before a meeting. Reducing human risk takes two approaches: helping people recognize and avoid suspicious requests, and limiting the damage when someone does get tricked.

Train People Until Caution Becomes a Habit

Good training gives your team clear answers to questions they face every day: what to look for, which requests need verification, and what to do when something feels off.

KnowBe4’s 2026 Phishing by Industry Benchmarking Report, based on tens of millions of simulated phishing tests, found that the average share of employees who engage with a phishing test drops from 33.2% before training to 4.2% after a year of ongoing training. That’s a drop from roughly one in three employees to about one in 24.

The key word is ongoing. A single annual training video won’t build the same habits as regular practice. Simulated phishing emails, brief refreshers based on current scams, and immediate feedback when someone clicks can help employees recognize suspicious messages over time.

Ironclad TEK delivers this kind of program as part of its cybersecurity services. Training is customized to each business, and progress tracking shows how your team improves from one campaign to the next.

Verify Unexpected Requests Before Acting

Before acting on an unexpected request involving a payment, a banking change, or a login, confirm it through a separate channel you already trust. Call the person at a number you already have on file, since a number listed in the email may lead straight back to the attacker. In Chad’s $20,000 invoice example, a 60-second phone call would have exposed the scam. Make this check company policy, so employees know they’re expected to verify a request even when it appears to come from the owner.

Contain the Damage When Someone Clicks Anyway

Even well-trained employees can be fooled, especially by messages built from real details about your business. That’s where your security tools play their second role: detecting suspicious activity, blocking further access, and limiting the damage.

• Endpoint and network protection can block malicious files and help prevent a compromised computer from communicating with other devices or systems.

• Multi-factor authentication (MFA) adds another layer of protection, making a stolen password alone less likely to be enough to access an account.

• 24/7 monitoring can flag warning signs, like a login from an unfamiliar location or a mailbox suddenly forwarding messages externally, so your IT team can investigate and respond before the problem spreads.

• Tested backups let you restore your files after a ransomware attack without relying on the attacker to return them. The backups need to be recent, protected, and tested to confirm they can be restored.

Your reporting culture matters, too. If an employee clicks a suspicious link or shares information they shouldn’t have, they need to feel safe reporting it immediately. Fast reporting gives your IT team more options to secure accounts and stop further damage. Waiting until the end of the day, or worse, until Monday morning, can give an attacker more time to act.

Frequently Asked Questions About Phishing and Social Engineering

What is social engineering?

Social engineering is the practice of manipulating a person, rather than a technical system, into taking action that compromises security. This includes clicking on a malicious link, replying with sensitive information, or approving a fraudulent payment. Phishing is the most common form, but attackers also use phone calls, text messages, and impersonation of IT support staff.

Can security awareness training really make a difference?

Yes, when the training is ongoing. KnowBe4’s 2026 Phishing by Industry Benchmarking Report tracked how employees responded to simulated phishing emails over a year of training. Before training, about one in three engaged with a simulated phish. After 90 days, that fell to 20.1%, and after a full year it fell to 4.2%. Most of the improvement came between month three and month twelve, which is why regular simulations and short refreshers produce results a single annual session can’t.

What should I do if I think I clicked on a phishing link?

Act quickly, because the first few minutes matter most.

1. Disconnect the device from the network (unplug the cable or turn off Wi-Fi) to limit any spread.
2. Report it to your IT or security contact right away. Speed matters more than having every detail, so don’t wait or try to fix it on your own first.
3. From a separate device you trust, change the password for any account you entered credentials into, along with any other account that uses the same password.
4. Turn on multi-factor authentication for those accounts if it isn’t already active.
5. Watch the affected accounts over the following days for unfamiliar logins, password reset emails, or new forwarding rules.

Is having antivirus and a firewall enough to stop phishing?

No. Antivirus and firewalls look for known threats: malicious files, dangerous websites, and suspicious network traffic. A phishing email that asks someone to log in, reply with information, or approve a payment often contains none of those, so it gets through. Protection against phishing comes from adding layers that account for people: email filtering to reduce how many phishing messages arrive, multi-factor authentication so a stolen password alone can’t unlock an account, a rule that staff confirm payment or banking changes by phone, and a culture where people report a suspicious click right away.

The Bottom Line: Your Team Is Part of Your Security System

When a plausible message makes it through, your security can depend on one person deciding whether to trust it.

This matters more as attackers get faster and harder to recognize. A targeted scam that once took weeks to prepare can now be assembled in hours, with a message polished enough to look like it came from your controller or a trusted supplier. The answer is preparation: train your people regularly so they become an active part of your security plan, and make it clear you expect them to stop and verify any unusual request. TWhen someone takes that extra moment to check, thank them for it. That response tells the rest of your team the pause is expected.

Understanding how attackers get in is only part of the picture. What would a successful breach actually cost your business? Downtime, recovery work, and shaken client confidence each carry a price. The figures behind the real cost of a cybersecurity breach make a strong case for preparing your people well before an attack ever happens.

Want to understand how prepared your team is to handle a convincing phishing attempt? Ironclad TEK can help you look at both sides of the equation: the technical protections you have in place and your team’s ability to recognize and report suspicious messages. If training is where the gaps are, we can walk you through how our security awareness program works and what it would look like for your team. Start a conversation with us to identify potential gaps and where to focus next, with no pressure to buy anything.