How hackers exploit our vulnerabilities

Issue 7 2023 Information Security, Security Services & Risk Management


Anna Collard.

Human error is responsible for a massive 95% of cybersecurity issues worldwide. Mistakes made by people are the primary cause of these problems. In South Africa, a recent Sophos report revealed that exploited vulnerabilities were the leading cause of cyberattacks for organisations in 2023, closely followed by compromised credentials. In the past year, the average cost incurred by South African companies as a result of cybersecurity breaches is a staggering R14 million ($750 000). It does not stop there. South Africans also face higher rates of depression and anxiety compared to other countries, in addition to getting less sleep on average.

With this combination of factors, it is no wonder that distracted, tired, and stressed South Africans often find themselves clicking on the wrong links and unknowingly introduce security risks.

Hacking humans

Bad actors target individuals because they are more vulnerable to hacking compared to advanced security technology. This practice, commonly known as the science of hacking humans, involves using deception and manipulation as common methods of social engineering. These tactics serve as the primary means of initiating attacks. In fact, in 2022, 74% of all data breaches included a human element.

While it may not be possible to completely eliminate stress and sleep deprivation, there are ways to mitigate their impact and protect against psychological attacks. Investing in tools and adopting specific approaches can make a significant difference. The first and most important of these is to foster critical thinking and cultivate skills that enhance situational and self-awareness. These skills are set to become even more vital as the world transitions into the metaverse and artificial intelligence (AI) tools become increasingly prevalent.

Know the warning signs

One of the core considerations for users is to pay attention. Multitasking is a myth. In fact, it is actually detrimental to individuals as it leads to human error, impairs long-term memory, and diminishes the ability to stay focused and creative. Moreover, multitasking increases the likelihood of behaving inappropriately and is often the cause of security mistakes. For instance, talking on the phone while reading emails? You’re not paying attention and could inadvertently click on the wrong link.

Another risk is emotions. Hackers heavily exploit this vulnerability through phishing emails and scams, crafting their content to trigger the amygdala and elicit a fight-or-flight response. The amygdala bypasses critical thinking and is the root cause of potentially dangerous decision-making. It is also the reason why fake news is more likely to be reshared, as it directly taps into people’s emotions.

The power of mindfulness

Combine distraction and emotion with speed, and you have a potent cocktail for hackers. Human beings tend to make quick decisions, and if they are not mindful of their reasoning, they may click on a phishing email, open an attachment, or share sensitive information. That is why many attacks employ tactics that create a sense of urgency, urging people to take immediate action, and unfortunately, people often comply.

Mindfulness serves as a powerful tool in managing immediate and emotional responses, reducing the risk of being distracted. When individuals practice mindfulness, they are less prone to making mistakes, pay closer attention to their tasks, and, as a bonus, experience less stress. By approaching work mindfully, individuals are less likely to fall victim to attacks. If organisations incorporate mindfulness into their training programmes, individuals become more aware of potential threats and are less likely to be caught off guard.

One way to incorporate this, is via mindful moments, allowing people to end meetings five minutes earlier to take time to decompress and use breathwork or movement and focus on the present moment before starting the next task. A mindful organisational culture enables people to slow down, focus, and effectively manage their reactions. This not only minimises risks but also helps people get more done, and be more productive and happier.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

71% of organisations suffered an identity breach
News & Events Information Security
The State of Identity Security 2026 report from Sophos finds human error and poor non-human identity management are the root causes of most attacks, as agentic AI accelerates the risk.

Read more...
Global security in 2026
Editor's Choice News & Events Security Services & Risk Management Industrial (Industry) Mining (Industry)
The World Security Report 2026 states: “In a world of increasing volatility, physical security has evolved. It is no longer just a defensive measure; it is a critical driver of corporate value.”

Read more...
Who is to blame for autonomous mistakes?
Editor's Choice Security Services & Risk Management Industrial (Industry) Mining (Industry)
Most supply agreements for AI-integrated equipment still closely resemble plant hire contracts from ten years ago: bilateral, human-focused, and silent on who bears the risk when a machine makes a decision on its own.

Read more...
Cyber resilience is the real defence
Security Services & Risk Management Information Security Infrastructure
Cyber resilience has evolved into a form of strategic agility, ensuring that when an interruption occurs, the business does not just survive; it snaps back into place before the market even notices a pause.

Read more...
You will not get your files back with VECT
Information Security
If the newbie to the ransomware scene, VECT, comes knocking at your organisation’s door, do not pay the ransom! The decryption keys simply do not exist. They were discarded at the moment of encryption by the malware itself.

Read more...
Industrial sector is a primary cyber target
Information Security
Threats in industrial environments are distributed with striking uniformity: APT-driven incidents constitute 17,8%, malware 14,9% and social engineering 13,9%. This pattern suggests that industrial organisations attract a broad range of adversaries with different capabilities and objectives.

Read more...
Key attributes of an effective cybersecurity leader
BlueVision Information Security
In an evolving technology landscape, an effective cyber leader must combine technical acumen, foresight, and adaptive leadership to mitigate risks, and risks can only be mitigated once accurately identified and remedial processes are in place.

Read more...
Employees are SA’s biggest cyber threat
Security Services & Risk Management Information Security
South Africa experienced a 46% increase in insider cyber risk in 2026, surpassing the global average of 44%. What is more, 63% of South African companies surveyed expect insider-driven data losses to increase.

Read more...
The post-Q1 security checklist
Asset Management Security Services & Risk Management
By this time of year, employees have changed jobs or roles, suppliers may have changed, and devices have moved between offices, homes, and sites. This is the right time for businesses to run a practical post-Q1 security check.

Read more...
PoPIA turns its attention to gated access
News & Events Security Services & Risk Management
The Information Regulator has gazetted its proposed Code of Conduct for the processing of personal information at gated access points. At 65 pages long, the code signals a significant shift in how personal information is collected and managed at entry points.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.