Why most successful attacks still start with a person, not a system
Hybrid working is now normal for many organisations. Staff move between the office, home and public spaces, often using personal devices and home networks. That flexibility brings real benefits, but it also creates new ways in for attackers. Hybrid working cyber security depends as much on staff behaviour as it does on technology.
The research on this is consistent, and it is not reassuring.
What the research shows
When Cisco polled more than 1,000 UK professionals about hybrid working, many said they did not feel cyber security was their responsibility. One in ten admitted actively trying to get around their organisation’s security measures, and one in five used the same password for several accounts.
More recent figures show the scale of the problem. The UK Government’s Cyber Security Breaches Survey 2025 found that 43 percent of UK businesses identified a breach or attack in the previous 12 months, rising to 67 percent of medium businesses and 74 percent of large ones. Phishing was by far the most common attack, affecting 85 percent of the businesses that identified one.
Verizon’s 2025 Data Breach Investigations Report, which analysed more than 12,000 confirmed breaches, found that around 60 percent involved a human element, such as a mistake, a misused password or a successful phishing email. The message from every source is the same. Most successful attacks still start with a person.
Home network and personal devices
Home routers are rarely updated or secured to the standard of an office network. Personal laptops and phones may have outdated software, shared users and no security monitoring. When these devices connect to company systems, they extend your network into places you cannot see and do not control.
Passwords, phishing and social engineering
When staff reuse passwords, a breach of one personal account can give an attacker access to company systems. Stolen credentials remain one of the most common ways into an organisation.
Remote working makes phishing more effective too. Staff working alone cannot easily turn to a colleague to check an unusual request, and attackers know it. Emails and calls that impersonate IT support, senior managers or suppliers are far harder to spot without someone nearby to ask.
Workarounds and public spaces
When security measures feel inconvenient, people find workarounds: personal email, unapproved file-sharing services or messaging apps. Each one moves company data outside your control. Working in cafés, trains and hotels adds another layer of exposure, with screens and conversations visible to others and public wi-fi that may not be secure.
Improving hybrid working cyber security
The technical controls are well understood. Multi-factor authentication on email, remote access and key systems stops most attacks that rely on stolen passwords. A company password manager makes strong, unique passwords practical. Company devices should be patched and managed, with clear rules for personal ones, and remote access should be secured and limited to what each user actually needs.
The human controls matter just as much. Staff need training to recognise phishing and social engineering, and a simple way to report it. They also need to understand why each security measure exists, so they see it as part of their job rather than an obstacle to it. Finally, systems should be tested regularly to find weaknesses before an attacker does, and an incident response plan should be in place so everyone knows what to do if something goes wrong.
How we help
Our cyber security services help organisations find and fix weaknesses before they are exploited. Our vulnerability assessments and penetration tests examine your internet-facing systems, internal networks and web applications from an attacker’s point of view, and rank each finding by its impact on your business. Every test is designed not to disrupt your systems, and a retest is included to confirm your fixes have worked.
If something has already happened, our digital forensics and incident response team can contain the incident, establish what took place and preserve the evidence. Because so many attacks start with people, we also train staff. Our Security & Behavioural Awareness and Countering Corporate Espionage courses show staff how attackers target them and what they can do about it.
People and controls together
Hybrid working is here to stay, and so are the risks that come with it. Good hybrid working cyber security combines sound technical controls with staff who understand their part in protecting the organisation. Testing both regularly is the best way to know where you stand.
If you would like your systems tested, or need help with an incident now, contact our cyber security team.