The State of Human Risk 2026

Human risk has firmly established itself as the defining cybersecurity challenge as demonstrated in the findings of our SOHR 2026 Report. Based on a survey of 2,500 IT security and IT decision makers across nine countries, we discovered that despite continued investment in technology stacks, breaches continue unabated, mostly due to human error. In fact, insider threats, credential misuse, and human missteps now account for most security incidents.

$13.1M average estimated cost per insider-driven incident, with organizations experiencing six such incidents per month — equating to $943.2M in annual exposure. Solving the challenge of human risk requires a dedicated approach to identifying, assessing, and mitigating these risks tailored to each user.

71% expect negative business impact from collaboration tool attacks in 2026 and 96% expect to see email security challenges throughout 2026, demonstrating the continued need for strong email and collaboration tool security.

80% are concerned about sensitive data leaks through generative AI tools and 60% are NOT fully prepared with specific strategies for AI-driven threats, demonstrating the continued need for organizations to implement their own AI-based platforms.

Human risk is one of our most complex problems, as it stems from social engineering, which is difficult to mitigate. Therefore, we conduct active training and propose tools to block, control, and monitor humans, including AI tools for pattern detection. - Security Leader, Financial Services

More Key Topics

In addition to the stats above, the report addresses key topics from cybersecurity professionals working tirelessly to protect their organizations.

Email & Collaboration

96% expect email security challenges in 2026, but the threat landscape has expanded: 53% report increased phishing volume, 48% see a rise in business email compromise, and 45% experience increased cyberattacks on collaboration tools—yet 38% still rely solely on native security controls.

Artificial Intelligence

55% of organizations now use AI for threat detection and real-time monitoring, up from 46% the previous year. Yet a 29-point gap persists between the 69% who see AI attacks as inevitable and the 40% who are fully prepared with specific strategies.

Governance & Compliance