Cyberattacks are widespread, but the bigger challenge is knowing who's exposed. Research from Verizon, Mastercard, Eurostat, and national cybersecurity authorities reveals why connected human risk data matters.

Key takeaways

• 62% of confirmed data breaches analyzed by Verizon involved a non-intentional human element, according to its 2026 Data Breach Investigations Report.
• 86.8% of US SMBs surveyed had implemented multifactor authentication (MFA), but only 51.1% required it across all key business accounts, according to findings from the National Cybersecurity Alliance's 2026 survey.
• 32% of New Zealand SMEs surveyed took no action to upskill or train staff in cybersecurity, according to the country's National Cyber Security Centre (NCSC).
• Only 18% of SMEs surveyed across Latin America and the Caribbean felt highly prepared to protect their businesses against cyber threats, despite 93% reporting familiarity with cybersecurity.
• Training completion doesn't equal reduced exposure. The greatest risks can emerge when weaknesses in awareness, identity hygiene, and access overlap around the same identity.

Cyber incidents ranked as the world's number one business risk in the Allianz Risk Barometer 2026, selected by 42% of surveyed risk management experts.

The concern is justified.

Small businesses face phishing, credential theft, and other attacks. Larger organizations manage sprawling digital identities and access permissions. Security teams must protect people and accounts across an expanding attack surface.

But there's a problem that conventional security reports often miss.

A business can have strong training completion rates, improving phishing simulation results, and documented security controls while still having employees with exposed credentials or unnecessary privileged access.

The data exists. It just isn't connected.

That's one of the central findings of usecure's 2026 Human Risk and Compliance Outlook Report.

Understanding employee exposure isn't just about knowing which security weaknesses exist. It's about knowing which identities carry them, how they overlap, and what needs attention first.

1. What do the 2026 cybersecurity statistics reveal worldwide?

Cyber threats affect businesses across international markets, but the scale and nature of exposure vary.

The research reveals three recurring challenges: widespread cyber incidents, inconsistent security practices, and gaps between awareness and preparedness.

The figures reveal different sides of the same challenge.

In New Zealand, almost one-third of surveyed SMEs reported taking no action to train or upskill their employees in cybersecurity.

Across Latin America and the Caribbean, Mastercard found a striking confidence gap. While 93% of surveyed SMEs said they were familiar with cybersecurity, only 18% felt highly prepared to protect their businesses.

The broader exposure is significant, too.

Mastercard's 2025 research across four continents found that 46% of surveyed SMB owners had experienced a cyberattack on their current business.

And in the European Union, Eurostat found that only a quarter of businesses provided compulsory ICT security training in 2024.

Different markets. Different measures.

The common challenge is turning cybersecurity awareness, controls, and risk data into a clearer understanding of exposure.

2. Why does the human element remain central to cybersecurity?

The non-intentional human element in a data breach refers to people's involvement through actions such as falling for social engineering, making errors, or having credentials stolen. It doesn't mean an employee caused the incident through carelessness.

According to Verizon's 2026 Data Breach Investigations Report, 62% of confirmed breaches in its dataset involved a non-intentional human element.

Attackers exploit trust. They impersonate colleagues, steal credentials, and look for weaknesses in authentication and access controls.

Phishing remains an important part of that picture.

The UK Government's Cyber Security Breaches Survey 2025/2026 found that 38% of businesses identified phishing attacks in the previous year, making phishing the most commonly reported attack type.

These findings reinforce why organizations need ongoing security awareness training and phishing simulations.

Employees need to recognize suspicious messages, understand how attackers operate, and know how to respond.

But phishing susceptibility is only one factor in a person's overall exposure.

Consider two employees who fail the same phishing simulation.

One has limited access to non-sensitive systems.

The other controls payment approvals, holds privileged permissions, and has credentials exposed in a known breach.

Same phishing outcome. Very different potential consequences.

The behavior matters. The identity behind it matters just as much.

3. Why doesn't security data show who's most at risk?

The Visibility Gap is the disconnect between individual security signals and an organization's ability to identify which people carry the greatest combined risk.

It's one of five blind spots identified in usecure's 2026 Human Risk and Compliance Outlook Report.

Most organizations already collect valuable security information.

Training platforms show course completion and learning performance. Phishing simulation tools reveal how employees respond to simulated attacks. Breach monitoring identifies exposed credentials. Identity systems provide information about authentication, accounts, and permissions.

Each system answers a different question.

What they don't automatically explain is how those weaknesses overlap around the same identity.

The 2026 US small-business research provides a useful example of the difference between adopting a control and enforcing it consistently.

The National Cybersecurity Alliance's 2026 survey, developed in partnership with CISA, found that 86.8% of surveyed SMBs had implemented MFA.

But only 51.1% required it across all key business accounts.

Having MFA available isn't the same as requiring it everywhere that matters.

And knowing an account lacks MFA still doesn't tell you the full risk.

Does it belong to someone with privileged access? Are their credentials exposed? Have they previously struggled with phishing simulations?

Without connected data, those questions require investigation across separate systems.

Security teams can see individual weaknesses while missing the identities that need attention first.

4. What are Toxic Combinations in human risk?

Toxic Combinations are risk factors that become significantly more dangerous when they overlap around the same identity.

An exposed password is concerning. Missing MFA increases exposure. Privileged access raises the potential impact if an account is compromised.

Put them together, and the risk becomes much more serious.

Picture a finance manager responsible for approving large payments.

They've completed their mandatory security awareness training. Their record looks fine.

But look closer.

Their credentials have appeared in a known data breach. MFA isn't enabled on a sensitive account. They still hold administrative permissions from a project that ended months ago.

Individually, these weaknesses might appear as separate findings across several security systems.

Together, they create a potentially serious exposure.

An attacker doesn't evaluate the finance manager through a training dashboard alone. They look for an opportunity to compromise the account, bypass protections, and exploit the access attached to it.

That's why Toxic Combinations matter.

As explored in our article on Toxic Combinations in Human Risk Intelligence, connecting risk signals changes how security teams prioritize remediation.

A failed phishing simulation may justify additional training.

But a failed simulation combined with exposed credentials, missing MFA, and privileged access demands a different level of attention.

Not every employee vulnerability carries the same consequences. The context determines the priority.

5. Does more security awareness training mean less risk?

The Outcome Gap is the difference between measuring security activity and demonstrating that an organization's underlying human risk is actually decreasing.

It's another major blind spot highlighted in usecure's 2026 report.

Training completion rates, phishing simulation results, and policy acknowledgments remain valuable. They show participation, performance, and progress.

But they don't tell the whole story.

Consider an employee whose phishing simulation performance improves over six months.

Good progress.

But what if their exposed credentials remain unresolved? Or they still hold administrative permissions they no longer need?

Their awareness has improved. Their broader exposure may not have.

This distinction matters when businesses are trying to understand whether their security investments are working.

It also raises more useful questions for security teams:

• Which identities carry the greatest combined risk?
• What specific factors are driving their exposure?
• Which weaknesses should be addressed first?
• Are those risks improving after action is taken?

This is where the difference between Human Risk Management and Human Risk Intelligence becomes important.

Human Risk Management (HRM) provides the foundation through security awareness training, phishing simulations, policy management, and breach monitoring.

Human Risk Intelligence (HRI) builds on that foundation by connecting those signals with identity and access information to show where risk is concentrated and what to prioritize.

It brings together four pillars:

• Target Value: Who is most attractive or valuable to an attacker?
• Awareness: Who may struggle to recognize or respond to threats?
• Hygiene: Whose identities have weaknesses that make compromise easier?
• Access: What could an attacker reach if an identity were compromised?

Together, these pillars provide a more complete picture of human risk.

The goal isn't to replace security awareness reporting. It's to put those results into context so teams can make better decisions.

Explore how Human Risk Intelligence works.

6. What do these findings mean for MSPs?

For MSPs, the opportunity is to move from reporting security activity to explaining where customer risk is concentrated and what needs attention.

Across international markets, smaller businesses often face a difficult balance between growing digital operations and maintaining consistent security controls.

The research illustrates the challenge from several angles.

From untrained staff in New Zealand to inconsistent MFA enforcement in the US and a confidence gap in Latin America, the weaknesses differ by market.

These findings aren't interchangeable. They point to different weaknesses that MSPs may encounter across their customer portfolios.

Managing those weaknesses at scale introduces another challenge.

More customers. More dashboards. More findings competing for attention.

Consider two customers with identical security awareness completion rates.

One has employees with strong authentication controls and appropriate access permissions.

The other has several privileged identities with exposed credentials and unresolved phishing weaknesses.

Their training reports might look similar.

Their risk profiles don't.

For MSPs, understanding that difference changes the customer conversation.

Instead of simply reporting how many people completed training, they can show which identities carry the greatest exposure, why those risks matter, and which actions should come next.

It also creates a stronger basis for quarterly business reviews.

Less time walking customers through disconnected metrics. More time explaining what's been addressed, where gaps remain, and whether the risk picture is improving.

7. How does uHealth help identify hidden human risk?

uHealth is usecure's Human Risk Intelligence layer, connecting risk signals across Target Value, Awareness, Hygiene, and Access to show where risk is concentrated and what needs attention.

Rather than evaluating awareness, phishing outcomes, breach exposure, and identity weaknesses independently, uHealth connects those signals around each identity.

It helps IT teams and MSPs:

• Identify high-risk identities: Understand which identities carry the greatest combined risk and what's driving it.
• Uncover Toxic Combinations: Find overlapping weaknesses that may be missed when reviewing individual security tools.
• Prioritize remediation: Focus on the most significant risks first.
• Track risk trends: Monitor how human risk changes over time instead of relying on activity metrics alone.

Take the finance manager from earlier.

In uHealth, their exposed credentials, missing MFA, and leftover administrative permissions can be assessed together rather than treated as three unrelated findings.

That context helps security teams understand why the identity needs attention and which issues to prioritize.

For MSPs, it also provides a clearer way to explain customer exposure and track whether risks are improving.

Not another disconnected report. Intelligence that helps turn findings into action.

The real question: who's still exposed?

The international cybersecurity research tells a consistent story.

Cyber threats affect businesses across regions. Security awareness and identity controls remain uneven. And human involvement continues to feature prominently in confirmed data breaches.

But implementing more security activities is only part of the challenge.

Organizations also need to understand how employee vulnerabilities overlap, where exposure is concentrated, and whether their efforts are addressing the greatest risks.

That's the shift from measuring security activity to managing human risk with intelligence.

Because knowing that an employee completed training is useful.

Knowing they're still exposed, why they're exposed, and what to fix first is what makes the data actionable.

See where hidden human risk sits with uHealth

For more on the research behind these challenges, read usecure's 2026 Human Risk and Compliance Outlook Report.

Frequently asked questions

What percentage of data breaches involve the human element?

According to Verizon's 2026 Data Breach Investigations Report, 62% of confirmed data breaches analyzed involved a non-intentional human element, including social engineering and human error. This measures human involvement, not solely employee mistakes.

What do global cybersecurity statistics reveal about small businesses?

Mastercard's 2025 survey of more than 5,000 SMB owners across four continents found that 46% had experienced a cyberattack on their current business. In a separate 2026 US survey, the National Cybersecurity Alliance found that only 51.1% of surveyed SMBs required MFA across all key business accounts. Together, these findings illustrate both cyberattack exposure and gaps in security control enforcement, although the studies measure different populations.

Why is employee exposure difficult to measure?

Employee exposure is difficult to measure when training, phishing, breach monitoring, identity hygiene, and access data remain disconnected. Each system identifies different weaknesses, but the greatest risks may emerge when those weaknesses overlap around the same identity.

What are Toxic Combinations in cybersecurity?

Toxic Combinations are security risk factors that become significantly more dangerous when they occur together around the same identity. Examples include exposed credentials, missing MFA, and privileged access. Connecting these signals helps security teams identify which identities need attention.

Does completing cybersecurity training mean an employee is less exposed?

Not necessarily. Training completion shows that someone finished a course. It doesn't establish whether their credentials are exposed, their account has weak authentication, or their access permissions are appropriate. Understanding exposure requires connecting awareness outcomes with identity, hygiene, and access data.

What is the difference between Human Risk Management and Human Risk Intelligence?

Human Risk Management (HRM) covers activities such as security awareness training, phishing simulations, policy management, and breach monitoring. Human Risk Intelligence (HRI) builds on HRM by connecting those signals with identity and access data to show where risk is concentrated, what to prioritize, and whether exposure is improving.