TLDR: A new report from the SANS Institute reveals that human factors continue to be the primary entry point for cyberattacks, with 80% of organizations identifying social engineering as their leading human-related cybersecurity risk. The report emphasizes that artificial intelligence is significantly enhancing these threats, enabling attackers to deploy more sophisticated and widespread deception tactics, thereby increasing the potential for human error.
The SANS Institute has released the 10th edition of its Security Awareness Report, a crucial benchmark for cybersecurity teams aiming to bolster human defenses against evolving threats. The comprehensive report, based on feedback from over 2,700 security awareness practitioners across more than 70 countries, underscores a critical finding: 80% of organizations now consider social engineering their number one human-related cybersecurity risk. This persistent vulnerability highlights that humans remain the primary attack vector in the cyber landscape.
The report specifically points out that artificial intelligence (AI) is ‘supercharging’ these already formidable threats. Attackers are leveraging AI to craft more convincing and scalable deception tactics, which in turn elevates the stakes for human error. This technological advancement means that traditional social engineering methods, such as phishing, are becoming increasingly sophisticated, alongside a notable rise in smishing (SMS phishing) and vishing (voice phishing) attacks.
Beyond social engineering, the report identifies other significant human risks. In a shift from previous years, the incorrect handling of sensitive data has emerged as the second-highest risk, followed by weak passwords and poor authentication practices. These evolving patterns underscore the continuous need for targeted, behavior-focused training to mitigate human-centric vulnerabilities.
Also Read:
- AI-Enhanced Social Engineering Emerges as Strategic Threat to Operational Technology Sector
- AI Red Teaming: Uncovering Vulnerabilities and Top Tools for 2025
Lance Spitzner, Technical Director of SANS Workforce Security & Risk Training, commented on the report’s significance, stating, ‘The launch of the 10th edition of our Security Awareness Report is a major milestone for us and our most ambitious and far-reaching report to date.’ He further described the report as a ‘dual-purpose playbook,’ designed not only to empower security awareness professionals to drive organization-wide behavior and culture change but also to advance their careers. Spitzner concluded by highlighting the report’s timely, data-driven insights into how security teams are adapting to rising threats like generative AI and deepfakes, emphasizing its role in shedding light on one of cybersecurity’s most urgent challenges.
