As part of a global survey, KnowBe4 asked 50 South African cybersecurity decision-makers to name the single biggest driver of human-related cyber risk inside their own organisation – and more than a quarter (28%) of them pointed at their own people, deliberately working around the controls that were put there to stop unsecure conduct.
No other country in the 13-country study – From Agentic Risks to Human Wins – came close to this figure: Colombia was next highest at 22,5%, followed by Netherlands at 22%.
South Africa’s decision-makers rank deliberate rule-breaking as a bigger problem than social engineering attacks, which only 12% named as their top cause.
The same report also surveyed employees as comparison points for the decision-maker data, and found that 59% of South African employees surveyed agree that even when they know the safe action to take, time pressure or distractions can lead them to make a “security mistake”.
But mistakes and intentional workarounds are very different measures.
“When I first saw the decision-maker cut of the data showing the percentage reporting intentional workarounds as their top human-related cyber risk, I nearly filed it under the same finding as the accidental-mistakes number,” says Anna Collard, senior vice-president: content strategy and CISO advisor at KnowBe4 Africa. “But it isn’t the same. An accident is something you fix with better tools and more forgiving processes. A deliberate workaround is more of a vote an employee is casting that tells you, with their actions, that the secure way of doing their job costs them more than they’re willing or able to pay.”
A more worrying number
Widen the lens slightly and the same survey shows why this particular number matters more than it looks like it should.
Only 14% of South African organisations have reached what the research calls a gold standard of security maturity – where secure behaviour is built into how work happens rather than delivered as a separate training exercise.
South Africa’s security leaders are not confused about the problem, and can name it, rank it above phishing, and describe it precisely enough to put a number on it. Knowing that people route around a control is an important finding, but building a system where routing around it isn’t the more alluring choice, is the part 86% of organisations have not done yet.
“The instinct in a lot of organisations is to treat this as a simple training problem,” says Collard. ” But if the secure process costs an employee 20 minutes they don’t have, they will find the two-minute version – and just telling them not to a second time doesn’t change the maths.”
What the finding does not say
“There’s a way of looking at this number that makes South Africa look worse than everyone else, and I don’t think that’s the right perspective,” says Collard. “The more useful conclusion to draw is that our security leaders have stopped pretending the problem is ignorance. They’ve correctly diagnosed a design failure and that the next step – namely, going from diagnosis to an actual fix – is where most organisations are stuck.”
Three things Collard argues follow from taking the finding seriously rather than filing it as just another concerning statistic:
- Audit the control your people are routing around, not the people routing around it. When your most engaged employees are choosing the fast path over the approved one, the slow path is the thing that needs redesigning.
- Ask “what does this cost the employee?” before adding a security step – the same way a finance team asks what a new approval step costs a transaction.
- Measure workarounds directly rather than inferring them from incident counts. An organisation that has never measured this cannot know whether its own number looks like South Africa’s 28% or nothing like it.
“Twenty-eight percent of our security leaders have told us exactly where their risk sits,” says Collard. “A lot can be built on that if assessed correctly.”
Download the South African data insights here and the Global report here.