Many organisations continue to focus on the technology aspect of cyber defence, which is crucial, but often at the expense of people risks, which represent the largest source of data breach claims. Comment from Anthony Dagostino, Head of Global Cyber Risk – Willis Towers Watson.

Data show that employee negligence or malicious acts account for two-thirds (66 percent) of cyber breaches, where by contrast only 18 percent were directly driven by an external threat, and cyber extortion accounted for just 2 percent. The data further shows that approximately 90 percent of all cyber claims are the result of some type of human error or behaviour. In response to these research findings, Willis Towers Watson has launched a Cyber Risk Culture Survey solution. This innovative new tool, a cyber risk employee survey, is the first of its kind in the marketplace. The offering connects human capital and workplace culture to employer cyber risk vulnerability. The solution addresses companies’ leading challenges around cyber risk, such as tracking the extent of risk inherent in their people’s behaviours, determining ways to mitigate this factor and ultimately building a cyber smart workforce.

“Evidence suggests that many businesses are taking an overly technocratic approach to cyber risk and are in danger of missing the bigger picture,” said Anthony Dagostino, head of global Cyber Risk, Willis Towers Watson. “While technology has an important role to play, it really needs to be linked with an understanding of the human element. The simple truth is that a data compromise is more likely to come from an employee leaving a laptop on the train than from a malicious criminal hack. We believe employees and companies with a strong culture and cyber aware workforce are the first line of defence against cyber risk.”The Cyber Risk Culture Survey solution has three different models, tailored to a company’s needs. The tool measures an organisation’s cultural elements of cyber risk related to human capital awareness and frequency of supportive employee actions. The survey results provide a clear picture of an organisation’s internal risk culture, with a particular focus on where it might be most vulnerable to employee-driven cyber incidents.

These results allow senior leadership to take decisive action to create solutions, including cultural changes, and talent and reward interventions, to mitigate cyber risk. “When we talk to clients about cyber risk, they tell us bridging their operational silos is one of the biggest hurdles within their organisations,” said Patrick Kulesa, director, Employee Survey Research, Willis Towers Watson. “Our offering is relevant to many audiences within the organisation – not only corporate risk managers, data security teams and human resource professionals, but the entire executive suite – all of whom are crucial links in the chain of cyber risk management and mitigation.”