A large share of cyber incidents begin with a person rather than a technical flaw. An employee
receives an email that looks urgent, clicks a link, or responds to a request that feels familiar.
That single action can open the door to business email compromise, credential theft, or direct
financial loss.
This excerpt from the Orange Hat Tech Summit focuses on human error and cyber attacks.
Speakers discuss a real example involving an emotional phishing message aimed at a parent,
the resulting monetary impact, and the practical steps the organization took afterward. They
also clarify the difference between broad phishing, targeted spear phishing, and smishing
through text messages.
Business owners and managers will recognize the tension between wanting to trust employees
and needing controls that do not rely solely on perfect judgment. The discussion emphasizes
education alongside process changes such as independent verification and built-in delays.
These are steps any organization can evaluate without waiting for a perfect technical solution.
Key Takeaways
A high percentage of cyber incidents start with a phishing email or someone clicking a link.
Emotional phishing messages, such as alerts about a child missing school, can override normal caution because they create personal urgency.
Business email compromise can produce losses in the millions; insurance may cover only a portion of the total.
Independent source verification and built-in time delays are practical process controls that reduce risk after a suspicious email arrives.
Phishing can be a wide net or a targeted spear phish; smishing is the same tactic delivered by SMS text message, often seen in toll and payment scams.
Education helps, but process design that does not place all responsibility on a single employee is more reliable.