How hackers exploit our vulnerabilities

Issue 7 2023 Information Security, Security Services & Risk Management


Anna Collard.

Human error is responsible for a massive 95% of cybersecurity issues worldwide. Mistakes made by people are the primary cause of these problems. In South Africa, a recent Sophos report revealed that exploited vulnerabilities were the leading cause of cyberattacks for organisations in 2023, closely followed by compromised credentials. In the past year, the average cost incurred by South African companies as a result of cybersecurity breaches is a staggering R14 million ($750 000). It does not stop there. South Africans also face higher rates of depression and anxiety compared to other countries, in addition to getting less sleep on average.

With this combination of factors, it is no wonder that distracted, tired, and stressed South Africans often find themselves clicking on the wrong links and unknowingly introduce security risks.

Hacking humans

Bad actors target individuals because they are more vulnerable to hacking compared to advanced security technology. This practice, commonly known as the science of hacking humans, involves using deception and manipulation as common methods of social engineering. These tactics serve as the primary means of initiating attacks. In fact, in 2022, 74% of all data breaches included a human element.

While it may not be possible to completely eliminate stress and sleep deprivation, there are ways to mitigate their impact and protect against psychological attacks. Investing in tools and adopting specific approaches can make a significant difference. The first and most important of these is to foster critical thinking and cultivate skills that enhance situational and self-awareness. These skills are set to become even more vital as the world transitions into the metaverse and artificial intelligence (AI) tools become increasingly prevalent.

Know the warning signs

One of the core considerations for users is to pay attention. Multitasking is a myth. In fact, it is actually detrimental to individuals as it leads to human error, impairs long-term memory, and diminishes the ability to stay focused and creative. Moreover, multitasking increases the likelihood of behaving inappropriately and is often the cause of security mistakes. For instance, talking on the phone while reading emails? You’re not paying attention and could inadvertently click on the wrong link.

Another risk is emotions. Hackers heavily exploit this vulnerability through phishing emails and scams, crafting their content to trigger the amygdala and elicit a fight-or-flight response. The amygdala bypasses critical thinking and is the root cause of potentially dangerous decision-making. It is also the reason why fake news is more likely to be reshared, as it directly taps into people’s emotions.

The power of mindfulness

Combine distraction and emotion with speed, and you have a potent cocktail for hackers. Human beings tend to make quick decisions, and if they are not mindful of their reasoning, they may click on a phishing email, open an attachment, or share sensitive information. That is why many attacks employ tactics that create a sense of urgency, urging people to take immediate action, and unfortunately, people often comply.

Mindfulness serves as a powerful tool in managing immediate and emotional responses, reducing the risk of being distracted. When individuals practice mindfulness, they are less prone to making mistakes, pay closer attention to their tasks, and, as a bonus, experience less stress. By approaching work mindfully, individuals are less likely to fall victim to attacks. If organisations incorporate mindfulness into their training programmes, individuals become more aware of potential threats and are less likely to be caught off guard.

One way to incorporate this, is via mindful moments, allowing people to end meetings five minutes earlier to take time to decompress and use breathwork or movement and focus on the present moment before starting the next task. A mindful organisational culture enables people to slow down, focus, and effectively manage their reactions. This not only minimises risks but also helps people get more done, and be more productive and happier.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Want effective Attack Surface Management? Think like an attacker.
Information Security
Effective ASM requires companies to think like attackers, anticipate risks, and act decisively to reduce exposure by knowing their environment, deploying a structured approach, leveraging capable tools, and addressing both internal and external risks.

Read more...
Your Wi-Fi router is about to start watching you
News & Events Surveillance Security Services & Risk Management
Advanced algorithms are able to analyse your Wi-Fi signals and create a representation of your movements, turning your home's Wi-Fi into a motion detection and personal identification system.

Read more...
The growing role of hybrid backup
Infrastructure Information Security
As Africa’s digital economy rapidly grows, businesses across the continent are facing the challenge of securing data in an environment characterised by evolving cyberthreats, unreliable connectivity and diverse regulatory frameworks.

Read more...
POPIA non-compliance puts municipalities at risk
Information Security Government and Parastatal (Industry)
Digital responsibility must go beyond POPIA compliance to recognising that privacy and service delivery are fundamentally linked. Despite this, only 51 out of 257 municipalities submitted their mandatory data protection and access to information reports in 2024.

Read more...
Choicejacking bypasses smartphone charging security
News & Events Information Security
Choicejacking is a new cyberthreat that bypasses smartphone charging security defences to confirm, without the victim’s input or consent, that the victim wishes to connect in data-transfer mode.

Read more...
Most wanted malware
News & Events Information Security
Check Point Software Technologies unveiled its Global Threat Index for June 2025, highlighting a surge in new and evolving threats. Eight African countries are among the most targeted as malware leaders AsyncRAT and FakeUpdates expand.

Read more...
Welcome to the new cyber battleground
Information Security
The Iran-Israel conflict is rapidly redefining modern warfare, pushing the boundaries of cyber capabilities and creating a new, borderless digital battlefield. Fortinet’s CISO, Dr Carl Windsor, offers a critical, in-depth analysis of the escalating tactics and global implications in his latest report.

Read more...
African industries may overestimate cyber defences
Information Security
] A significant perception gap exists in security awareness training: 68% of leaders believe training is tailored to roles, yet only a third of employees feel adequately trained. Many organisations only conduct annual or biannual generic training that may not effectively change behaviour.

Read more...
SMARTpod talks to Sophos and Phishield
SMART Security Solutions Technews Publishing Sophos Videos Information Security News & Events
SMARTpod recently spoke with Pieter Nel, Sales Director for SADC at Sophos, and Sarel Lamprecht, MD at Phishield, about ransomware and their new cyber insurance partnership.

Read more...
Cybersecurity and insurance partnership for sub-Saharan Africa
Sophos News & Events Information Security Security Services & Risk Management
Sophos and Phishield Announce first-of-its-kind cybersecurity and insurance partnership for sub-Saharan Africa. The SMARTpod podcast, discussing the deal and the state of ransomware in South Africa and globally, is now also available.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.