The Human Element Just Went Up

Verizon's 2026 Data Breach Investigations Report is out. The human element now sits behind 62% of breaches.

Last year it was 60%.

So.. let's just sit with that for a second. In the twelve months between those two reports, the industry ran millions of hours of security awareness training. Modules were completed. Quizzes were passed. Dashboards glowed a reassuring green in board packs across the land.

And the number went up.

The Machine Is Working. The Outcomes Aren't.

Nobody can accuse the awareness industry of not delivering. It delivers constantly. More content, better platforms, more reminders, more reports. The machine gets more efficient every single year.

The outcomes don't move. Or rather, they do. The wrong way.

This is the point where someone usually argues the training just needs to be more frequent, or shorter, or gamified, or fronted by a cartoon hedgehog. But the uncomfortable truth is that the model itself is broken, and the evidence has stopped being ambiguous.

People do not lack information. Proofpoint found that 96% of employees who took a risky action knew it was risky when they took it. The knowledge gap that awareness training exists to close? Already closed. People know. They did it anyway.

Because knowing what a phishing email looks like is not the same as the thing that makes your hand pause before you click one at 4pm on a Friday when you're tired and it looks almost right. One is awareness. The other is instinct. And no amount of content produces instinct.

What the New Number Actually Tells You

The 62% isn't a verdict on your people. It's a verdict on how we prepare them.

Most organisations spend 3 to 5% of their security budget on human risk, while the human element sits behind 62% of breaches. The technical stack gets millions. Human behaviour gets a line item and an annual module. Then we act surprised when the annual module loses to a well-timed phone call.

And the conditions are getting harder, not easier. This year's DBIR shows attackers moving to the channels nobody rehearses for: voice, SMS, mobile. The attack surface is increasingly a person having an ordinary moment under ordinary pressure.

You cannot patch that with a PDF.

Behaviour Doesn't Change by Being Told

And here's what the industry keeps refusing to absorb: you cannot change behaviour by telling people to behave differently. You can only change behaviour by reshaping the moment itself. Pressure, stakes, consequence, story, repetition. The conditions decisions actually get made in.

People don't rise to the level of their training. They fall to the level of their instinct. And instinct is built through rehearsal, not instruction.

So when the 2027 DBIR lands and the human element is still sitting at 60-something percent, the question won't be "why didn't the training work?" It will be "why did we keep buying the same thing and expecting a different number?"

Stop training people. Start rehearsing them.