83% of surveyed UK and US IT security leaders see staff as the biggest cyber risk as rising insider threats, AI‑driven attacks and third‑party breach reporting expose gaps in visibility and control
Organisations are facing a growing insider security threat, with malicious insiders now among the leading causes of data breaches, according to new research from Apricorn, the leading global provider of quantum-resistant hardware-encrypted external storage solutions.
Apricorn’s 2026 survey of 400 UK and US IT security decision-makers found that 29 per cent of UK organisations surveyed, identified employees with malicious intent as one of the leading causes of data breaches, almost double the level recorded two years ago (15%). At the same time, 28 per cent of UK respondents say employees unintentionally putting data at risk remains one of the biggest contributors to breaches.
Jon Fielding, Managing Director, EMEA at Apricorn, said, “Organisations need to rethink what an insider threat looks like. It’s no longer just about the disgruntled employee. Organised criminal groups are increasingly recruiting insiders to steal sensitive data or provide privileged access, while everyday actions such as using an unauthorised USB drive, sharing files through unapproved cloud services or accessing corporate data on personal devices can expose organisations to the same risks. The distinction between malicious and accidental insiders matters far less than ensuring sensitive data is protected wherever it goes.”
This growing concern is reflected throughout the research, with almost 80 per cent[1] of UK IT Security decision makers citing that, whether remote or office-based, their staff are the biggest cyber security threat. Additionally, 52 per cent1 of UK respondents say their remote or mobile workers have knowingly put corporate data at risk during the past year, while 52 per cent1 of UK respondents expect mobile/remote workers to expose the organisation to the risk of a future breach, down from 61 per cent in 2025. Meanwhile, 51 per cent1 of UK respondents believe employees are willing to comply with security policies but simply do not have the technology or skills needed to protect sensitive information effectively.
“For years, organisations have concentrated on preventing external attacks through stronger perimeter security, but data is constantly moving between offices, homes, cloud platforms, mobile devices and third parties. Organisations must continue to recognise that protecting information now depends just as much on controlling how trusted users interact with data as it does on keeping attackers out,” Fielding added.
The changing nature of breach causes may suggest organisations are becoming more effective at defending against traditional cyber threats. Phishing, cited by 37 per cent of UK organisations as a leading cause of breaches in 2025, has fallen to 19 per cent this year, while ransomware has also declined to 20 per cent as a reported cause, down from 26 per cent in 2025. This may reflect continued investment in awareness training, email security and endpoint protection.
Instead, organisations are increasingly concerned by newer operational challenges, with AI-related attacks and ineffective patch management both cited by 26 per cent of UK respondents as now among the leading causes of a breach. The findings suggest AI is accelerating the speed at which vulnerabilities can be identified and exploited, leaving organisations with less time to deploy critical security updates and making effective patch management more challenging than ever.
The survey also indicates that organisations may be losing visibility of incidents within their own environments. While 48 per cent of UK respondents say they have notified the Information Commissioner’s Office (ICO) of a breach or potential breach, 37 per cent say they became involved because somebody else reported them. This marks a significant shift from last year’s findings, when organisations were far more likely to self-report than be reported externally.
The growing proportion of third-party reporting, up from eight per cent in 2025, suggests that breaches are increasingly being identified by customers, suppliers, business partners or other external stakeholders before organisations discover them internally. As supply chains become more interconnected and data is shared across multiple platforms and organisations, businesses have less opportunity to contain incidents before they become visible to others.
“The increase in third-party reporting isn’t simply a compliance issue. It raises questions about visibility. If another organisation identifies your breach before you do, it suggests you may not have sufficient oversight of where sensitive information resides, how it is being used or when it leaves your control,” stated Fielding.
Despite these growing concerns, UK and US organisations continue to invest in cyber security with almost all (99.5 per cent[2]) now having an information security strategy/policy that covers employees’ use of their own IT equipment for mobile/remote working, while 98 per cent2 have increased the implementation of encryption during the past year.
However, the research suggests organisations increasingly recognise that policies alone cannot prevent breaches. In fact, 42 per cent of UK respondents now say one of their biggest challenges is that employees who understand the risks will still lose data and expose the organisation to the risk of a breach, up from 30 per cent in 2025.
Fielding concluded – “Organisations have made progress in strengthening cyber security policies and educating users but the next step is making security less dependent on human judgement. Businesses need controls that protect data wherever it travels and regardless of who is handling it. The most resilient organisations won’t be those that expect people to never make mistakes, they’ll be the ones that assume mistakes are inevitable and build security that keeps sensitive data protected regardless.”
