Cybersecurity Visual

Around 8 in 10 breaches involve a human element — a phishing click, a weak password, a simple mistake. Training directly shrinks your biggest attack surface.

In practice: Year after year, the major breach-investigation reports attribute roughly 70–90% of incidents to the human element: stolen or reused credentials, phishing and plain error. The same research shows trained employees spot and report attacks dramatically faster, cutting how long intruders stay inside your systems.

The average data breach costs millions in investigation, recovery, downtime, legal fees and lost business — far more than prevention ever would.

In practice: IBM's annual Cost of a Data Breach study put the global average at roughly $4.9 million per breach in 2024. That figure excludes the long tail — higher insurance premiums, customer churn, credit-monitoring for victims and years of regulatory scrutiny. Compare that with the cost of an awareness course per employee.

Regulators can fine up to €20 million or 4% of global annual turnover, whichever is higher — and they use those powers routinely.

In practice: The GDPR has two penalty tiers: up to €10m or 2% of worldwide turnover for lesser failures, and up to €20m or 4% for serious ones. European regulators have issued several billion euros in fines since 2018, and the UK ICO can fine up to £17.5m or 4% under the UK GDPR. Five of the ten cases below were punished under exactly these powers.

Customers take their business elsewhere after a breach, and headlines outlive the incident. Reputation damage often costs more than the fine.

In practice: Consumer surveys consistently find a majority of people would stop dealing with a company that mishandled their data, and breached firms routinely underperform their sector for months afterwards. The telecoms case below lost around 100,000 customers and a fifth of its share price — the £400k fine was a rounding error by comparison.

A single infection can freeze ordering, payroll and production for days or weeks. Many victims never fully recover their data — or their customers.

In practice: Commonly cited industry figures put average ransomware downtime at about three weeks, with recovery costs running into millions even when no ransom is paid. In the worst cases — like the shipping company below — the entire global IT estate has to be rebuilt from scratch while the business runs on paper.

Fraudulent emails remain the most common entry point for attackers. Staff who can spot them are your most effective security control.

In practice: The UK government's Cyber Security Breaches Survey repeatedly finds phishing involved in over 80% of reported attacks. It only takes one: in case 9 below, a single forwarded email attachment ended in the encryption of HR databases covering 113,000 people and a £4.4m fine that explicitly cited insufficient staff training.

Breaches end careers: executives resign under scrutiny, staff face dismissal, and in serious cases individuals have been prosecuted and jailed.

In practice: In the cases below, a chief security officer was criminally convicted for concealing a breach, an insider was jailed for eight years for leaking payroll data, and a manager was convicted of insider trading around an undisclosed breach. CEOs and CISOs across several cases lost their jobs. The law reaches people, not just companies.

Supply-chain due diligence now routinely asks for evidence of security awareness training. No proof, no contract.

In practice: Frameworks such as ISO 27001, SOC 2 and Cyber Essentials all require security-awareness training, and enterprise procurement questionnaires ask for the evidence. Attackers know suppliers are the soft way in — two of the cases below began in an acquired or third-party system. Per-employee certificates make your answer easy.

Home networks, personal devices and public Wi-Fi put company data outside the office perimeter. Habits, not firewalls, protect it there.

In practice: Default router passwords, unpatched family devices, coffee-shop Wi-Fi and voice assistants in earshot of confidential calls: none of it is covered by the office firewall. Awareness training is the one security control that travels with the person — which is why our first training scenario is set in a 3D home.

Cyber-insurance eligibility and premiums — and how a regulator judges your breach — hinge on whether you can demonstrate regular staff training.

In practice: GDPR Article 83 tells regulators to weigh the "technical and organisational measures" you had in place when setting a fine — documented, regular training is exactly such a measure, and its absence was called out in enforcement decisions below. Most cyber-insurers now ask for evidence of it before they will quote at all.