New year, the same shared responsibility for information security.

We often view Information Security as someone else’s responsibility—Management, InfoSec department, IT department, team manager, security Champion—anyone but ours. This subconscious shifting of responsibility makes us vulnerable. The fact that over 90% of information security attacks occur due to human error is something we tirelessly repeat, but have we truly internalized it? Do we realize that all organizational, technical, physical, and similar measures mean little if the human factor remains our greatest attack vector?

The Human Factor as the Weakest Link

A single moment of inattention—a click on the wrong link, a weak password, a lack of MFA, or discussing sensitive topics in the wrong place or at the wrong time—can open the door to attackers, allowing them free entry into our organization. Unfortunately, there is still no tool that can prevent an incident if an employee consciously or unconsciously disregards processes or takes shortcuts to seemingly ease their work.

That shortcut, which seems small and insignificant, can cost our organization dearly. InfoSec and IT are there, together with Management, to set the rules of the game, but it is up to each of us to follow those rules and prevent a small mistake from turning into a major incident.

Information Security as a Foundation, Not a Department

Information Security is not just a tool, measure, procedure, process, policy, or department—it is the foundation of shared responsibility across the entire organization, serving as the bedrock for progress and excellence in a world that is increasingly challenging from a security perspective.

Steps to Strengthen Information Security Awareness

Five steps to help us become better and more aware on the path to security in our organization:

Conclusion

Information Security goes beyond technologies, policies, and formal procedures—it relies on the collective awareness and responsible behavior of everyone in the organization. Small, everyday decisions can either reduce risk or create serious vulnerabilities. By understanding our role, applying good practices, continuously learning, and reporting anything suspicious, we actively contribute to a safer and more resilient organization in an increasingly complex security landscape.

To strengthen your knowledge further, we encourage you to read Phishing Awareness: How to Spot and Prevent Attacks and Password Security Essentials for Safer Accounts.