The 10 most common mistakes employees make (and how to avoid them)

In today's digital world, a large share of cyberattacks are not caused by complex technical failures but by human error. In fact, according to a study by IBM Security, 95% of cybersecurity incidents involve some kind of human error. And this is where many companies, especially small and medium-sized ones, face their greatest vulnerability: their own people.

At Ciberseguridad 720 we have supported many SMEs in different regions of the world, and we always find patterns that repeat. This article is not about pointing fingers but about raising awareness and empowering people. Because yes, human error is inevitable… but it is also preventable with the right strategy.

Here are the 10 most frequent mistakes we have identified and how to avoid them:

1. Using the same password everywhere

This is the classic one. Many employees, out of convenience or lack of awareness, reuse the same password for corporate email, the intranet, Netflix and even online banking. When one of those passwords leaks, all the others are exposed. The solution? Password managers such as Bitwarden or KeePass, and policies that require unique passwords.

2. Downloading files or clicking links without checking where they come from

Phishing is still attackers' favourite technique. According to Check Point's 2024 Cyber Security Report, more than 80% of cyberattacks start with a malicious email. Training the team in basic threat awareness and spotting suspicious emails is key.

3. Leaving sessions open on shared or public devices

It may seem basic, but it still happens, especially in hybrid or remote work environments. Implementing automatic session locking and multi-factor authentication (2FA) significantly reduces the risk.

4. Connecting insecure personal devices to the corporate network

The famous "I'll just bring my USB stick to print something quickly" can cost a company millions. Every external device must be managed with clear BYOD (Bring Your Own Device) policies and access control tools.

5. Sharing sensitive information via WhatsApp, email or sticky notes

Critical data must travel through encrypted, approved channels. This includes not sending passwords over WhatsApp or writing them on sticky notes attached to the monitor.

6. Not knowing the company's security protocols

Many employees do not know who to turn to when an incident happens or how to report it. That is why it is essential to have clear, simple and accessible processes, and to run regular drills to keep everyone prepared.

7. Using unauthorised software ("shadow IT")

From browser extensions to PDF editing tools, unapproved software may contain malware or open backdoors. Controlling and monitoring installed applications should be a priority.

8. Not updating software or postponing security patches

Yes, that "restart to update" message matters more than it seems. Updates fix vulnerabilities that attackers know about and exploit quickly. An automatic updates policy is a basic but critical measure.

9. Underestimating the importance of backups

Many employees do not make backups or do not even know whether their files are backed up. In an era dominated by ransomware, having up-to-date, offline copies can be the difference between business continuity and shutting down completely.

10. Thinking cybersecurity "is not their responsibility"

This may be the most serious mistake of all. Security is not just the IT team's job. It must be part of the culture of the whole organisation. Continuous training and leading by example are the foundation for real change.

What now?

The good news is that all these mistakes can be prevented with an accessible, progressive approach tailored to each type of company. At Ciberseguridad 720 we do not believe in magic solutions or in creating dependence on our services. Our 720 methodology combines open-source tools, automation and hands-on mentoring so that every company becomes self-sufficient in its cybersecurity.

So far in 2025 we have already helped more than 25 SMEs reduce their level of risk, with visible results from the very first assessment. You don't need a big budget; you need to start.