In 2004, a group of cybercriminals orchestrated a sophisticated attack on a bank, exploiting human vulnerabilities to gain access to highly sensitive financial data. They infiltrated the bank’s network by leveraging social engineering tactics to trick an employee into disclosing crucial login credentials. This breach not only compromised confidential information but also resulted in a substantial financial loss for the bank. The 'Heist of Nordea Bank,' one of Scandinavia’s largest financial institutions, went down in history as one of the most notorious bank heists in digital security.
What made this heist particularly alarming was the fact that the criminals didn’t have to break through firewalls or bypass encryption—they simply exploited human error. This incident serves as a stark reminder that cybersecurity is no longer just an IT issue, but a business-wide concern. In today’s digital age, where organisations rely on a network of employees, vendors, and customers, everyone plays a role in maintaining security.
Why HR Holds the Key to Your Organisation’s Cybersecurity Defence
Cybersecurity is no longer just an IT concern, it’s a business imperative, and Human Resources (HR) department needs to be at the heart of the defense strategy. With the rise of remote and hybrid work environments, HR teams are now custodians of highly sensitive employee data. They handle large volumes of personally identifiable information (PII) and sensitive employee data, such as social security numbers, salary details, and health records. This makes them prime targets for cybercriminals who often seek this data for identity theft, financial fraud, or corporate espionage.
Sharda Tickoo, Country Manager - Trend Micro, India & SAARC emphasises that the role of HR professionals extends beyond recruitment and employee relations to ensuring the security of this data. “HR departments are often the primary point of contact for employees,” she explains. “Therefore, their involvement in promoting a cybersecurity culture is crucial to preventing breaches.”
Studies show that human error is still a leading cause of security incidents, and well-trained HR professionals can significantly reduce vulnerabilities, such as phishing and unauthorised data access, which might otherwise compromise critical data. A Gartner report predicts that by 2025, over half of significant cyber incidents will be attributed to human failure.
Another Gartner survey conducted in 2022 found that 69% of employees had bypassed their organisation's cybersecurity guidance in the past year, with 74% indicating they would do so if it helped achieve a business objective. This highlights the need for HR professionals to not only be trained but also to lead by example in implementing security protocols, guiding employees on safe practices, and fostering vigilance against cyber threats like phishing and social engineering. They can also ensure that the workforce adheres to security protocols and remains vigilant against rising cyber threats, including those targeting human vulnerabilities.
“It is critical for all members of an organisation – but especially for CHROs and HR professionals – to undergo continuous cybersecurity training, given the sensitivity of the data they have access to. By ensuring that all aspects of an organisation are aware of the threats potentially looming in their inboxes and how to report them to the appropriate sources, the entire company is much safer and better protected,” adds Dan Schiappa, Chief Products and Services Officer at Arctic Wolf.
Has Remote and Hybrid Work Added to the Cybersecuity Risks?
Remote and hybrid work models, which have become more widespread due to the COVID-19 pandemic, have expanded the cybersecurity risks for organisations. Employees working from home or on the move use a variety of devices, networks, and technologies to access sensitive information. This dispersed work environment has created more potential entry points for cyber attackers. According to Tickoo, “the rise of remote work has broadened the attack surface, exposing HR departments to new risks.” While only a small percentage of connected devices will interact with corporate networks, the global device count is expected to reach 18.2 billion by 2025. “Even a small percentage of unmanaged devices connecting to corporate networks can create substantial security challenges for SOC teams,” she adds.
According to Schiappa, remote work often leads to a lack of immediate access to colleagues or support systems when a suspicious email or alert arises. This creates additional risk. “The best way to combat this is to acknowledge and discuss potential threats, regularly update security protocols, and conduct simulated attacks on the organisation to reinforce employees' training and prepare them to respond effectively to emerging risks,” he advises.
Tickoo says CHROs and HR professionals must be skilled at identifying off-site risks, including unsecured networks and device vulnerabilities. “Effective training for HR professionals should emphasise secure remote access practices, such as VPN use, multi-factor authentication, and the importance of endpoint security protocols to safeguard against unauthorised device access. By equipping HR teams with these critical skills, organisations can strengthen the security of remote workflows and reduce the likelihood of breaches in these less controlled settings.”
Tickoo says CHROs and HR professionals must be skilled at identifying off-site risks, including unsecured networks and device vulnerabilities. “Effective training for HR professionals should emphasise secure remote access practices, such as VPN use, multi-factor authentication, and the importance of endpoint security protocols to safeguard against unauthorised device access. By equipping HR teams with these critical skills, organisations can strengthen the security of remote workflows and reduce the likelihood of breaches in these less controlled settings.”
What Cybersecurity Risks Are Unique to HR Professionals?
HR departments face unique cybersecurity challenges due to their role in managing large volumes of confidential data pertaining to both current and prospective employees. This data can attract attackers who seek to exploit it for identity theft or unauthorised access.
Highlighting the vulnerability of HR departments to social engineering tactics, Tickoo says, “HR professionals require targeted training to ensure secure data handling practices and recognise social engineering tactics that might compromise this information. Such training should include techniques for identifying suspicious requests, protecting digital identities, and implementing secure offboarding protocols to promptly deactivate former employees’ access.”
With the rise of artificial intelligence (AI), it’s also important that HR professionals stay aware of new forms of cyber threats. For instance, AI-driven attacks, such as deepfakes or phishing scams, are becoming more sophisticated and harder to detect. HR professionals may be targeted by AI tools that mimic legitimate communication or impersonate former employees to gain unauthorised access to sensitive data. “Additionally, it is imperative to equip HR staff with the skills to identify AI-powered phishing attempts and understand the impact of automation in cybersecurity. As AI technology evolves, HR departments must stay vigilant and update their training to recognise AI-generated threats. Addressing these HR-specific challenges, including those introduced by AI, through focused training enhances organisational defences at a crucial vulnerability point,” Tickoo adds.
How Can HR Implement Cybersecurity Best Practices After Training?
Cybersecurity training for HR professionals is essential, but it’s equally important to implement best practices post-training. Schiappa of Arctic Wolf stresses the need for HR teams to remain vigilant even after training is completed. “Company-wide tools can be implemented to help IT teams with stronger visibility, but at the end of the day, the most vulnerable part of a company from a security perspective is the risk that people bring. By better training teams, we are offering them the knowledge to see something suspicious and report it before a breach happens.”
HR departments can play a pivotal role in shaping a cybersecurity-conscious workforce by clearly communicating the critical importance of security practices to employees. As trusted voices within the organisation, HR professionals are uniquely positioned to translate complex cybersecurity topics into relatable, everyday language that resonates with employees across all levels.
“By weaving cybersecurity principles into regular communications—such as company newsletters, team meetings, and onboarding sessions—HR can emphasise that security is not just an IT responsibility but a shared organisational duty. They can also foster a culture of vigilance by consistently reinforcing that each employee’s actions have a direct impact on the organisation’s security. Initiatives like awareness campaigns, interactive workshops, and visible recognition programmes for employees who demonstrate strong security practices can make cybersecurity feel personal and relevant,” says Tickoo.
When employees understand that even a single lapse, like clicking a phishing link, can lead to serious repercussions for the entire organisation, they are more likely to take security seriously.
Mamta Sharma is a freelance journalist committed to sharing stories on talent management, DEIB, workplace culture alongside narratives on leadership, entrepreneurship, tech innovation and employee wellbeing.
