Why Your Staff Are Your Biggest Security Risk, Not Your Software

Your accountant gets a WhatsApp message from the managing director.

It’s urgent. A supplier is waiting, the MD is supposedly in a meeting, and the message contains new bank details and an instruction to pay immediately.

The profile picture looks right. The tone sounds like the boss. The amount isn’t unusual for the business. So the accountant makes the transfer.

An hour later, the real managing director asks why money has gone to an account he has never heard of. The accountant shows him the message. The photo was copied from his real profile. The number was new. The account belonged to a fraudster.

Now look at what didn’t happen. Nobody hacked the website. The accounting software worked perfectly. No malware was involved. One employee was simply persuaded to carry out an authorised action for the wrong person.

This is an illustrative scenario, not a documented Easy World Techs client incident.

I start here because most business owners treat security as a shopping list: antivirus, a firewall, website protection, cloud backups, someone to watch the network. Those are all worth having. But none of them would have stopped that payment, and the thing that made the fraud possible, a business that moves large sums on the strength of a chat message, was never a software problem.

01 What the Numbers Say, and What They Don’t

Verizon’s 2026 Data Breach Investigations Report found that 62% of breaches involved the human element. That category covers social engineering, errors, misuse of access, and stolen credentials.

It does not mean 62% of breaches were caused by careless staff. An employee fooled by a well-built phishing message isn’t necessarily careless. Someone whose login was stolen from a third-party service may have followed every rule the company gave them. And sometimes the real gap is that management never wrote the rules.

So the title of this post is a provocation, not a law of nature. Your staff are not automatically a bigger risk than your software in every company. The sharper claim is this: the way people, permissions and daily routines are set up creates openings that no security product can close, and most small businesses give those openings far less attention than they give the software.

02 The Accountant Who Could Do Everything

Picture a growing Nigerian retail company. (This is a composite scenario, not a real client.) When it started, there were five people and the owner watched everything personally. The accountant handled payments, refunds, payroll and supplier records. The operations manager could see inventory, customer data and admin settings. When someone needed a login, the owner shared his.

It worked, so nobody questioned it.

Then the company grew to thirty staff, two branches and several business applications. The access arrangements never changed. The accountant still holds permissions granted years ago. Former employees’ accounts are still active. A few people share one administrator login because creating individual accounts felt inconvenient.

Management sees no problem, because everyone is trusted. But security isn’t only about whether you trust people. It’s about what happens when someone’s account is compromised, when they make an honest mistake, or when their job changes.

Take two attackers. One compromises an ordinary staff account. The other compromises an account that can export the entire customer database. The employee may have made exactly the same mistake in both cases. The damage differs because of the permissions management handed out.

This is the principle of least privilege: give people the access their job requires, and nothing more. It sounds obvious, and it quietly falls apart in any business that grows without anyone owning access management.

The security problem isn’t who clicked the wrong link. It’s what that click allowed an attacker to do.

03 When the Official Process Is the Problem

Here is the side of this story that rarely gets discussed: staff often bypass security because the approved route makes their job harder.

Imagine a sales team that needs to share customer details. The company has a central customer platform, but reaching it means a slow VPN and repeated logins. Someone discovers that sending a spreadsheet through personal WhatsApp takes thirty seconds. Within a month, customer records are scattered across personal phones.

The instinctive reaction is to ban WhatsApp and threaten discipline. That treats the symptom. If a task takes fifteen minutes the official way and thirty seconds the unofficial way, people under pressure will pick the fast one, every time.

None of this excuses mishandling sensitive data. It means security rules have to be designed around how people actually work. Find out what the team is trying to get done, then give them a secure way to do it: better software, simpler authentication, adjusted permissions, or an approved messaging tool.

The goal isn’t to make security invisible. It’s to make secure behaviour the easy behaviour.

04 One Message Should Never Be Enough to Move Money

Back to our accountant. It’s tempting to say the failure was hers, because she didn’t verify the sender. Verification does matter. But ask a different question: why was a single chat message enough to authorise the payment?

If a business routinely approves large transfers through informal messages, it has already built the opening for an impersonator. The attacker doesn’t need to defeat any software. They only need to imitate an ordinary business conversation.

A stronger process separates the request from the approval. A few examples of what that can look like:

The right level of control depends on your size, transaction volume and risk. A small firm doesn’t need an enterprise approval system. It does need clear rules about who can request a payment, who can approve it, and how unusual instructions get checked.

And leadership has to follow the rules too. A managing director who regularly says “just do it, it’s urgent” is teaching the whole company that controls are optional. Eventually someone pretending to be that managing director will use the same habit against you.

05 The Ex-Employee Who Still Owns Your Facebook Page

Say your marketing manager resigns. She hands over campaigns, returns the laptop and works her final week. Everyone wishes her well.

Three months later you discover she is still an administrator on your Facebook page, your advertising account, your website dashboard and your shared cloud folder.

Perhaps nothing bad has happened. But why does she still have the keys?

In small businesses, access piles up informally. Someone needs the website, so an admin shares the credentials. Someone needs to run ads, so they’re added to the ad account. Someone needs a financial document, so they’re given the shared folder. Over time, permissions drift away from job roles. When people leave, management remembers the laptop and forgets the logins. The same drift happens when people change roles: the person promoted from customer support to operations quietly keeps access to systems they no longer need.

A sound offboarding routine lists every company account, shared resource, device, authentication method and third-party platform tied to that person. Individual accounts get disabled or removed. Shared credentials and recovery details get changed. Company data is handed over through proper channels. Move quickly for privileged accounts and sensitive departures.

None of this is an accusation. It’s as ordinary as collecting a company laptop or updating payroll. Your control over your systems shouldn’t depend on the goodwill of someone who no longer works for you.

06 Training Once a Year Doesn’t Stick

Many companies treat security awareness as a box to tick. A consultant presents on suspicious links and strong passwords, everyone signs the attendance sheet, and management considers the matter closed.

Six months later, someone receives a scam that looks nothing like the slides. They fall for it. Management concludes that staff weren’t paying attention.

Good training is tied to the situations people meet in their own work:

Short, regular exercises work better than one long presentation. You could hand the finance team a mock supplier bank-detail change and ask how they’d verify it. The aim is to expose confusion and fix procedures, not to embarrass anyone.

That last point matters more than it sounds. If admitting a mistake means humiliation or dismissal, people stay quiet. An employee who clicked a bad link and tells you within minutes gives you a manageable incident. One who hides it for a week gives you a crisis.

07 Your Staff Are Already Using AI. Have You Told Them the Rules?

This is the newest part of the problem. Staff now have tools that summarise documents, draft messages, analyse spreadsheets and help with code. Most of that use is well meant, and a lot of it is genuinely useful.

But consider an employee who uploads a spreadsheet of customer names, phone numbers, purchase histories and payment details to an AI service nobody has vetted, just to get help with a sales report. Their intention is harmless. The company, though, has never checked how that service stores data, who can access it, or what protections apply.

Verizon’s 2026 report points the same way. It identified unauthorised AI use as the third most common non-malicious insider action in its data loss prevention datasets, a fourfold increase from the year before.

Banning every AI tool is rarely realistic. A better move is to decide which tools are approved, what kinds of information may go into them, and which tasks need extra care. Can staff upload customer records? Financial statements? Contracts? Source code? Sometimes removing identifying details or using an approved business-grade tool is enough. Sometimes the data should not leave the company at all.

You can’t expect people to follow rules nobody has explained.

08 The Law Has a View on This Too

If your business handles personal data, security is also a legal matter. The Nigeria Data Protection Act 2023 sets requirements for how personal data is processed and protected, and the Nigeria Data Protection Commission’s General Application and Implementation Directive stresses appropriate technical and organisational measures.

The distinction is worth understanding. Technical measures are things like access restrictions, authentication and system security. Organisational measures are policies, procedures, accountability and staff training. Buying security software covers the first group. It does not give you a data protection programme.

A company that stores customer records securely but lets any employee export them freely still has a serious governance problem. So does one that gives staff unrestricted access to sensitive personal data with no operational reason.

Your exact obligations depend on your role, what data you process and which provisions apply to you. I’m not a lawyer, so take proper advice and assess your position rather than assuming a generic privacy policy or an antivirus subscription is enough.

09 Where to Start on Monday Morning

You don’t need an expensive security transformation. Start by understanding how people reach information and make sensitive decisions in your business.

Pick a handful of critical systems: company email, banking and payment platforms, the customer database, website administration, cloud storage. Then find out who can access them. Not who should have access. Who actually does. Look for former employees, shared passwords, excess administrator rights, and services registered on personal email addresses.

Next, test how sensitive actions get approved. Could one person change a supplier’s bank details and authorise payment alone? Could someone export the customer list with no business reason? Could a fake “MD” talk your staff out of the normal procedure? A software vulnerability scan won’t answer those questions.

Then put in place a few rules people can understand and follow:

None of this is a complete security strategy. It doesn’t replace patching, backups, endpoint protection, secure development or incident response planning. It covers a different gap: how legitimate users interact with your systems. For a growing SME, that is a sensible place to begin.

10 Stop Calling Them the Weakest Link

I don’t like the familiar line that employees are the weakest link in cybersecurity. It’s too convenient. It lets management blame individuals while ignoring the conditions that shaped their behaviour.

If staff share passwords because nobody created individual accounts, that’s a management decision. If payment instructions are accepted through unverified WhatsApp messages, that’s a process failure. If former employees keep access for months, that’s an access management failure. If people use unapproved tools because the official ones are impractical, the workflow needs fixing. And if staff are punished for reporting mistakes, leadership has paid them to hide incidents.

Employees do have responsibilities. They should follow procedures, protect their credentials, question odd requests and report anything unusual. But the business has to supply the training, systems, permissions and environment that make those responsibilities achievable. You cannot hand accountability for security to your least technical employee.

So the better question isn’t whether your staff can be trusted. It’s whether your business is built so that one ordinary mistake doesn’t become a major incident. Because sooner or later, someone will misread a message, open the wrong attachment, share something with the wrong person, or forget to question a strange request.

Your security should expect that, and limit the damage when it happens.