We are in Cybersecurity Awareness Month, a time to emphasize not only the broad topic of cybersecurity but also the everyday, perhaps less exciting, aspects of information security that are important all year round. When we think about Information Security, or InfoSec in short, it is necessary to understand the framework, which is best illustrated with a few key numbers.

Cyber fact: 95% of data breaches start with human error.

Globally, phishing attacks remain the dominant threat, with an estimated 80% of security incidents attributed to phishing, making it the number one attack vector. Statistics show that only 8% of employees are responsible for 80% of security incidents. Besides these, other statistics indicate that such attacks, which then escalate into security incidents, are often not technically complex but rather target the human factor— a little carelessness, a short lapse in concentration, leading to escalation.
Here, we can conclude that our security chain is only as strong as its weakest link.

Various Types of Cyber Attacks Aimed at People

Looking at the situation not only from the InfoSec perspective but also from the organizational aspect, people are the greatest asset and also the biggest potential attack vector for every company. There are various types of attacks aimed at people: Phishing, Business Email Compromise (BEC), Spear phishing, Vishing (voice phishing), AI social engineering, Smishing (phishing via SMS), social engineering, and similar.

In a world that is becoming increasingly insecure daily, whether through the rapid expansion of AI, the rise of various types of warfare in an increasingly tense geopolitical situation (Including Information and psychological warfare, cyber warfare, and hybrid warfare), or cybercrime driven by simple motives such as pure financial gain. In this worsening situation, the question remains: how to invest in people?

Some of the methods that we practice and recommend to every organization are:

1. Attack simulations (phishing tests)
2. Regular education and training
3. Developing security awareness and culture
4. Valid risk assessment and compensatory measures
5. Developing a good security culture within the organization, measurement and control, and adjusting security measures

I would like to note here that organizational security does not rely only on InfoSec, ICT or other technical departments but is the responsibility of all of us, especially in the context of human and organizational security measures.

How to Raise Awareness About Phishing Among Employees

Phishing remains the most common type of cyberattack, and as a company, we are not exempt from this threat. That is why ASEE has implemented regular training and exercises for employees through the Cybeready platform, and we are pleased to see increasingly better results and faster response times within our organization.

We have also launched an initiative Cyber secure @ ASEE where each month is dedicated to a specific topic related to everyday situations. One such topic is the use of corporate email.

The Phishing Trends Report published by HoxHunt shows just how prevalent and sophisticated such attacks continue to be. Below is a brief reminder of the acceptable and unacceptable uses of corporate email, as it represents one of the primary lines of defense against phishing.

In this blog, I am sharing with you the ASEE Group guidelines for the use of email, which should be universal across any organization:

Acceptable use of email services:

Unacceptable use of email services:

Conclusion

Cybersecurity is everyone’s responsibility. By staying informed, cautious, and proactive, we can all contribute to building a safer digital environment — both for ourselves and our organization. It’s a continuous process of learning, adapting, and staying vigilant. We’ll continue to regularly share useful insights and reminders on these topics to help all of us stay informed and alert.