Home / ITRM Insights / Blog / Why one click is still your biggest Cyber Risk
13 Jul 2026
You might expect the greatest cyber risk to come from something complex. A sophisticated, targeted attack. Something buried deep within a network. In practice, it is often far simpler than that. A single click. A small, routine interaction. The kind of moment that barely registers at the time. Yet that is still where many incidents begin.
Many organisations today have already invested heavily in cybersecurity. Firewalls, endpoint protection, monitoring tools, and secure configurations. The foundations are in place, and in many cases, they are robust.
And that investment is essential.
These controls reduce risk, prevent a large number of attacks, and form the backbone of any effective security strategy. Without them, organisations would be significantly more exposed. But even with strong technical measures in place, breaches can still occur. Not because those systems have failed, but because there are moments that sit outside of what technology alone can prevent.
Those moments are often small. An email is opened. A link is followed. A request is accepted without being questioned. Phishing shows this clearly. Despite the range of threats organisations face, most cybercrime still comes back to phishing, with over 90% of affected businesses and charities reporting it as part of the attack, far outweighing other methods.
It persists not because organisations lack the right tools, but because it is designed to work around them.
Rather than attacking systems directly, it targets people. It relies on familiarity, urgency, and trust, all of which exist naturally in day-to-day work.
There is sometimes an assumption that cyber risk can be reduced primarily through technology. In reality, modern attacks often do not try to force their way in. They present themselves as legitimate and wait to be let through.
Emails are well-written. Branding looks credible. Requests reflect real business scenarios. Under those conditions, the decision to act is not careless. It is reasonable. That is what makes these attacks effective. They fit into normal workflows rather than interrupting them.
This is where the conversation shifts slightly.
Cybersecurity is not only about systems and controls. It is also about behaviour. Most employees are aware that phishing exists. The challenge is not knowledge alone. It is recognising risk in the moment, often under pressure, distraction, or time constraints.
Our experience consistently shows that human actions contribute to a significant proportion of security incidents. Not as a failure of individuals, but as a reflection of how modern attacks are designed.
This is why effective security does not rely on either technology or people alone. It depends on both working together.
Traditional approaches to cyber training can fall short here.
Annual training modules provide useful knowledge, but they are often removed from real situations. By the time a genuine threat appears, that information can feel distant.
There has been a shift in how organisations approach this.
More are moving towards continuous, behaviour-focused awareness. Short interventions, realistic simulations, and regular reinforcement. The aim is not simply to inform, but to influence how people respond in small, everyday moments. Because that is often where the difference is made.
A single click may seem insignificant. It takes seconds. It feels routine. It is easily forgotten. Yet that action can grant access, expose information, or trigger a wider incident. This is what makes it such a persistent risk. Not because it replaces other threats, but because it exists alongside them and can interact with them. Strong security controls may already be in place. But if the initial interaction allows a threat through, those controls are then working reactively rather than preventatively.
It would be incorrect to suggest that one click is the only risk organisations face. Threats are varied. Attack methods evolve. Technical vulnerabilities remain a key concern. However, what is consistent is that many attacks still rely on an initial point of access. And often, that point of access is simple. Familiar. Routine. Easy to overlook.
The most significant cyber risks are not always the most complex. They are often the ones that sit closest to everyday behaviour. The email that looks normal. The request that feels expected. The moment that does not seem urgent enough to question. And sometimes, it starts with nothing more than a click.
Effective cybersecurity is not about choosing between technology and people. It is about strengthening both.
Building a culture of defence does not mean turning every employee into a security expert. It means helping people make the right choice when they are busy, tired or caught off guard. By delivering short, relevant learning moments as part of the working day, organisations can keep security top of mind without causing disruption.
Small, consistent interventions help employees recognise warning signs, question unusual requests and pause before taking action. Over time, these behaviours become habits, creating a stronger first line of defence against modern cyber threats.
At ITRM, we help organisations build this security culture through engaging, AI-driven cyber security awareness training. Using the world's largest library of security awareness content, we help organisations to:
If you would like to explore a more balanced approach to managing cyber risk, complete the form below and a member of our team will be in touch.