88 percent lack the awareness to stop preventable cyber incidents, says the results of a new survey testing employee data privacy and cybersecurity knowledge.

The 2016 State of Privacy and Security Awareness Report revealed employee knowledge trends across eight risk domains, ranging from working remotely to identifying phishing attempts, and assigned three risk profiles indicating employees’ privacy and security awareness IQ.

These risk profiles are Risk, Novice, and Hero, based on the number of proper behaviours correctly identified. The more correct behaviors an employee can identify, the less of a privacy or security risk they represent.

MediaPro, recognized by Gartner as a Leader in the 2014 and 2015 Magic Quadrant for Security Awareness Training Vendors, surveyed more than 1,000 employees across the U.S. to quantify the current state of privacy and security awareness.

Key findings include:

• 16 percent of respondents scored low enough to warrant a “Risk” profile by exhibiting behaviours that put their organizations at serious risk for a privacy or security incident.
• 72 percent of respondents were given a “Novice” profile, meaning they understand the basics but are dangerously close to one wrong decision or mistake leading to a security or privacy incident.
• Only 12 percent of respondents were given a “Hero” profile, indicating a strong knowledge of security and privacy best practices, and are likely well-prepared to deal with many cyber threats.

“This survey clearly shows the human threat vector is still largely unsecured, and most organizations don’t really know whether their employees have the necessary level of data protection awareness to avoid preventable incidents,” said Steve Conrad, MediaPro’s founder and managing director.

See: Cyber Security Sector in Asia Pacific to reach US$26 billion in 2017

Other notable findings from the report include:

• Nearly 40 percent of respondents chose to discard a potential password hint in an unsecure manner rather than disposing of it by secure means.
• 25 percent of respondents failed to recognize a sample phishing email with a questionable “From” address and attachment.
• More than 26 percent of respondents thought it was acceptable to use a personal USB drive to transfer work documents when working remotely.

“The risk landscape for employees is constantly changing, and this survey illustrates that employees are having trouble keeping up,” said Tom Pendergast, MediaPro’s chief strategist, for security, privacy, and compliance.

“The clear solution is the implementation of an adaptive awareness program that is flexible enough to adjust not only to today’s threats, but the threats of tomorrow. Without an adaptive program, you’re going to have a hard time surviving, let alone thriving, in today’s tumultuous data protection landscape.”

A recent study from CompTIA found that human error accounts for more than 50 percent of security breaches. Enterprises face threats that compromise the security of critical information due to unintentionally risky behaviour from employees with poor privacy and security hygiene.

Left unchecked, these employees are putting their companies at serious risk of material loss due to a data breach or other cyber incident.

Also read: Hacking the Cybersecurity Skills Shortage