As cybersecurity technology advances, cybercriminals are shifting their focus from technical vulnerabilities to exploiting human trust and weaknesses. According to Francis Mojoyinola, Chief Information Security Officer at Union Bank of Nigeria, attackers now aim at people both inside and outside institutions, making it essential for everyone to recognize these attempts. This approach has become more prevalent, with the Verizon Data Breach Investigations Report for 2026 finding a human element present in 62% of all breaches.
The report, which examined over 31,000 security incidents across 145 countries, revealed that most attackers now focus on persuading individuals to open the door, rather than exploiting technical vulnerabilities. This shift has made human awareness and education critical components of cybersecurity. However, researchers at the University of California, San Diego, found that traditional awareness training programs have limited effectiveness in reducing phishing risks. An eight-month experiment involving over 19,500 employees showed that embedded training reduced the likelihood of clicking on phishing links by only 2%.
The experiment also found that annual mandatory training showed no meaningful relationship with whether a person fell for phishing emails. This suggests that awareness programs, as commonly run, may not offer much practical value in reducing phishing risk. However, Mojoyinola emphasizes that awareness is still crucial, but it must be approached differently. He notes that awareness teaches people what a scam looks like in a calm environment, but attacks are designed to exploit moments of stress, urgency, or distraction.
Confidence can also be a risk factor, as individuals who believe they are too alert to be deceived may be more likely to fall victim to scams. Mojoyinola cites examples of security-conscious individuals being caught off guard by ordinary scams on busy days. He emphasizes that any defense relying on people never being deceived is fragile. The exposure to cyber threats is wider than most people imagine, with insider abuse and social engineering being significant concerns.
In Nigeria, digital payment fraud losses decreased by 51% in 2025, to ₦25.85 billion from ₦52.26 billion the previous year, according to the Nigeria Interbank Settlement System (NIBSS). However, NIBSS identified social engineering and insider abuse as the most prevalent techniques. Premier Oiwoh, NIBSS CEO, noted that insider involvement is high, and recent investigations have confirmed this. Insiders are often honest colleagues who were deceived or manipulated into divulging sensitive information.
The Verizon research also found that pretexting, where attackers build a believable scenario and role to play, accounted for 6% of breaches and is increasingly used in ransomware and extortion cases. A good pretext works by providing a reason to believe the rules do not apply on this one occasion. Mojoyinola values the behavior of colleagues who quickly admit mistakes, as this can significantly impact the scale and consequences of an incident. A positive culture that encourages openness and learning from mistakes is essential.
The most valuable credentials in banking do not reside in systems but with customers. Passwords, personal identification numbers, and codes sent to phones are the keys to accounts, and they live in the pockets of millions of people with jobs and distractions. These keys are often shared widely, and an attacker needs only to find the least careful person in the circle on their least careful day. The attack has also moved to where people live, with phishing simulations showing a median click rate of 6%.
Key points
- Cybercriminals increasingly target people, combining technical weaknesses with social engineering tactics.
- Human awareness and institutional culture are crucial in cybersecurity.
- Traditional awareness training programs have limited effectiveness in reducing phishing risks.
