TLDR: A new report from Arctic Wolf, the 2025 Human Risk Behavior Snapshot, highlights a critical disconnect: despite a global surge in cyber breaches (up 8% from 2024), IT leaders remain overly confident in their organizations’ security postures. The report reveals that nearly two-thirds of IT leaders and half of employees admit to clicking malicious phishing links. Furthermore, the widespread adoption of generative AI tools introduces new data leak risks, with 60% of leaders and 41% of staff admitting to feeding confidential data into these platforms. The study emphasizes that human behavior is a significant and unpredictable variable in cybersecurity, often exacerbated by a lack of fundamental security practices like universal MFA enforcement.
EDEN PRAIRIE, Minn. – October 15, 2025 – Arctic Wolf®, a prominent global leader in security operations, has released its second annual Human Risk Behavior Snapshot. This independent survey, encompassing over 1,700 IT leaders and end-users worldwide, uncovers a concerning trend: a persistent overconfidence among organizations regarding their cybersecurity defenses, even as employee behaviors continue to fuel breaches and expose sensitive data.
The report’s findings underscore that the human element has become one of the most unpredictable factors in the cybersecurity landscape, particularly with the escalating threat activity and the increasing integration of generative AI into daily work. This blend of leadership overconfidence and employee missteps or circumvention of basic safeguards is significantly widening the chasm between perceived resilience and actual vulnerability.
Key revelations from the 2025 Human Risk Behavior Snapshot include:
-
Global Breach Surge: A striking 68% of IT leaders reported that their organizations experienced a cyber breach in the past year. This represents an 8% increase compared to 2024, with Australia, New Zealand, and the U.K. & Ireland witnessing the most substantial year-over-year rises.
-
Phishing’s Pervasive Reach: Even security professionals are not immune to phishing attacks. Nearly two-thirds of IT leaders and half of all employees confessed to clicking on malicious links. Despite this, three-quarters of leaders maintain a belief in their organizations’ safety. Alarmingly, one in five leaders who clicked a malicious link failed to report the incident.
-
Executives as Prime Targets: Senior leadership teams remain a high-value target for cybercriminals. The report indicates that 39% of executives were subjected to phishing attempts, and 35% faced malware infections, directly jeopardizing high-value accounts.
-
AI as a Data Leak Vector: The rapid adoption of generative AI tools for work is introducing new risks. A significant 80% of IT leaders and 63% of employees are utilizing these tools. Critically, 60% of leaders and 41% of staff admitted to inputting confidential data into these AI platforms, creating a substantial data leak risk.
-
Training Over Termination: The inclination to terminate employees who fall victim to scams is on the rise, with 77% of IT leaders favoring this approach, up from 66% in 2024. However, the report highlights a more effective strategy: companies prioritizing corrective training have reported an impressive 88% reduction in risk.
-
Neglect of Security Fundamentals: Basic security measures are still being overlooked. Only 54% of organizations enforce Multi-Factor Authentication (MFA) for all users, leaving entry-level accounts vulnerable and providing attackers with an easy entry point.
Adam Marrè, Senior Vice President and Chief Information Security Officer at Arctic Wolf, commented on the findings: “The rise of generative AI has created powerful new tools—but also powerful new risks. When leaders are overconfident in their defenses while overlooking how employees actually use technology, it creates the perfect conditions for mistakes to become breaches. Progress comes when leaders accept that human risk is not just a frontline issue but a shared accountability across the organization. Reducing that risk means pairing stronger policies and safeguards with a culture that empowers employees to speak up, learn from errors, and continuously improve.”
Also Read:
- India Grapples with Over 3,000 Weekly Cyberattacks Amid Surging Generative AI Threats, Check Point Reports
- Wharton Study Reveals Widespread Generative AI Adoption and Positive ROI Among Enterprise Leaders
The full 2025 Human Risk Behavior Snapshot is available for download from Arctic Wolf’s website, along with additional insights from Marrè on the report’s implications for security leaders.
