Skip to main content

Report: 60% of orgs have experienced data loss due to employee mistakes

Laptop and envelope with document and skull icon. Virus, malware, email fraud, e-mail spam, phishing scam, hacker attack
Image Credit: Getty Images

Join us in Atlanta on April 10th and explore the landscape of security workforce. We will explore the vision, benefits, and use cases of AI for security teams. Request an invite here.


Three in five organizations have experienced data loss or exfiltration caused by an employee mistake on email in the last 12 months, according to a new survey from Ponemon Institute, sponsored by email security company Tessian. The survey of 614 IT security practitioners across the globe also revealed that email was the riskiest channel for data loss in organizations, according to 65% of security practitioners. 

The survey found employee negligence (because of not following policies) to be the leading cause of data loss incidents, while over a quarter (27%) of incidents are from malicious insiders. Intentionally stealing data also causes strain on IT teams as the data revealed it takes up to three days for security and risk management teams to detect and remediate a data loss incident caused by a malicious insider on email.  

The most common types of confidential and sensitive information lost or intentionally stolen include: customer information (61%); intellectual property (56%); and consumer information (47%). User-created data (sensitive email content, text files, M&A documents), regulated data (credit card data, Social Security numbers, national ID numbers, employee data) and intellectual property emerged as the three types of data that are most difficult to protect from data loss. 

Organizations cannot protect what they can’t see, and a lack of visibility of sensitive data that employees transferred from the network to personal email was cited as the most common barrier (54%) to preventing data loss. Further, the majority of organizations (73%) are concerned that employees do not understand the sensitivity or confidentiality of data they share through email.

VB Event

The AI Impact Tour – Atlanta

Continuing our tour, we’re headed to Atlanta for the AI Impact Tour stop on April 10th. This exclusive, invite-only event, in partnership with Microsoft, will feature discussions on how generative AI is transforming the security workforce. Space is limited, so request an invite today.
Request an invite

Despite these risks, organizations do not have adequate training in place. While 61% have security awareness training, only about half of IT security leaders say their programs properly address the sensitivity and confidentiality of the data that employees can access on email. 

According to Josh Yavor, Tessian’s CISO, security awareness training that directly addresses common types of data loss and a security culture that builds trust and confidence among employees will ultimately help limit the amount of data that flows out of an organization.

Read the full report by Tessian and the Ponemon Institute.

VB Daily - get the latest in your inbox

Thanks for subscribing. Check out more VB newsletters here.

An error occured.