Train employees to fortify systems against cyberattacks

Since human vulnerabilities are now being exploited, the best defence lies in employee behaviour

- SIDDHARTH PAI

The internet can be more dangerous than even the roughest part of a big city. Consider this: Over the Easter weekend, British retailer Marks & Spencer (M&S) fell victim to a cyberattack that proved not only costly in financial but also reputational terms. It stemmed not from a failure of firewalls or malware detection tools, but AI-enabled social engineering. A hacker group known as Scattered Spider is being probed for breaching M&S's systems through a third-party IT services contractor. The attackers may have used impersonation techniques to gain unauthorized access to internal systems, resulting in leaked customer data, operational disruptions and an estimated financial hit of over £400 million.

It underscores an increasingly common theme in today's cybersecurity breaches: the exploiting of humans, rather than hardware or software. Cyber-safety is no longer just a technical issue to be left to the IT department; it's a human issue, deeply embedded in behaviour, awareness and preparedness.

Human resource training is a pressing challenge in today's context. Organizations are facing an onslaught of evolving cyber threats—ransomware attacks, phishing scams, deepfake impersonations, credential stuffing and more. These don't merely target infrastructure, but also people. Employees get emails from attackers posing as executives, vendors or even co-workers. They're tricked into clicking malicious links, giving away login credentials or transferring money to fake accounts. So the front-line isn't the server room, but everyone's inbox.