2023 Cybersecurity Trends: Human Factor

Cybersecurity remains a hot topic

Information security-related incidents continue to rise, with several reported in the press every few days. Behind them are various causes, such as the exploitation of vulnerabilities in computer systems, social engineering attacks, or employee negligence.

If organizations want to protect themselves from the terrible losses these incidents entail, they must take action and proactively defend against the threats that constantly lurk. While information security can be compromised for multiple reasons, one is becoming increasingly important — and it does not always receive the attention it deserves: the human factor.

Attackers are targeting people with increasing frequency. This means that employees remain a gateway to organizations, as they have access to the systems and the information they handle. But they can also become a barrier against cybercriminals — if they are aware of the risks and are equipped with effective mitigation measures.

From Kymatio, we present five cybersecurity trends for 2023 related to the human factor, so organizations can design preventive strategies to protect against different threats and risks.

1. Rise of ransomware

We are experiencing a wave of ransomware attacks that “hijack” files by encrypting them, later demanding payment for their release. Often, it is the organization’s own employees who unknowingly allow this danger to materialize.

Cybercriminals are creating increasingly sophisticated attacks that exploit human vulnerabilities. Fraudulent emails — particularly targeted phishing campaigns — are gaining credibility and can even be paired with phone calls (vishing). If employees do not maintain a high alert level year-round, the probability of falling victim to these schemes skyrockets.

2. Deepfakes

Phishing is not the only threat. The rise of deepfakes brings a new and powerful weapon to cybercrime. These AI-generated fake videos or audio recordings can replicate the appearance and voice of known individuals, reducing our ability to distinguish between truth and deception.

Helping the workforce learn to detect such threats — and preparing them for their inevitable arrival — is crucial for organizations seeking to protect their assets.

3. Remote work

The pandemic forced many employees to work from home, and remote work is here to stay, at least partially. While this offers better work-life balance and comfort, it also introduces security risks.

Home environments often lack the robust security measures of an office, and the heavy reliance on digital communication creates more opportunities for cybercriminals. Attackers are exploiting these vulnerabilities to target remote workers directly.

4. Zero trust

While often seen as a technological approach, Zero Trust is also about people. It ensures that sensitive information is accessible only to those who truly need it, and only for the minimum amount of time necessary.

If an attacker were to steal an employee’s credentials, strict permission controls would limit the potential damage. The same applies to human error — inevitable mistakes have far less impact when access is restricted.

5. Mobile risks

Mobile phones keep us connected at all times, but they also increase our exposure to cyber threats. Despite security filters in official app stores, malicious apps sometimes slip through disguised as harmless tools (e.g., flashlights, language dictionaries).

In addition, smishing — fraudulent SMS or messaging app communications — continues to spread. These messages often appear to come from banks, delivery companies, or even friends and family whose accounts have been compromised. Without vigilance, it’s easy to become a victim.

The solution: awareness and culture

To strengthen organizational security, measures must focus on human risk management. Cybercriminals view the human factor as a primary target, yet only 3% of security spending is dedicated to it.

Employees can be either the organization’s weakest link or its first line of defense. The difference lies in their level of alertness — which must be maintained throughout the year.

Effective awareness is personalized and continuous, not generic or delivered only once or twice a year. Programs should be adapted to each employee’s needs and focus on strengthening their weak points through short, recurring sessions.

Promoting a cybersecurity culture means putting employees at the center and helping them stay protected both professionally and personally.

Kymatio® helps organizations stay safe through its SaaS human risk management platform, offering:

• Automated, personalized awareness plans (5–7 minutes per month).
• Phishing and neurophishing simulations tailored to each employee’s vulnerabilities.
• Monitoring of exposed credentials to manage risks from third-party breaches.