Employees acting maliciously are now cited among the leading causes of data breaches by 29% of UK IT security decision-makers, almost double the 15% recorded in 2024, according to research commissioned by Apricorn. Unintentional employee actions were also cited by 28% of respondents.
Research company Censuswide questioned 400 IT security decision-makers, comprising 200 in the UK and 200 in the US, between 1 and 6 July 2026. The results reflect respondents’ assessments of breach causes and security risks, rather than independently audited incident statistics.
Almost four in five UK respondents regarded staff, whether office-based or remote, as their organisation’s biggest cybersecurity threat. Meanwhile, 52% said their mobile or remote workers had knowingly put corporate data at risk during the preceding year, and 51% believed employees lacked the technology or skills to protect information effectively despite being willing to follow security policies.
Jon Fielding, managing director, EMEA at Apricorn, said: “The distinction between malicious and accidental insiders matters far less than ensuring sensitive data is protected wherever it goes.” He identified unauthorised USB drives, unapproved cloud services, and personal devices as routes through which company information can move beyond established controls.
Such transfers can involve legitimate access to engineering designs, customer records, maintenance documentation, and other sensitive files. Once a copy moves to unmanaged storage or an unapproved service, an organisation may lose the ability to restrict onward sharing or establish who accessed it. The National Cyber Security Centre (NCSC) recommends controls over removable media, access permissions, monitoring, and audit trails to reduce data exfiltration by trusted users, including contractors and suppliers.
Visibility is another concern. Some 37% of UK respondents said their organisation became involved in breach reporting after somebody else reported it, compared with 8% in 2025. That sits alongside 48% who said their organisation had notified the Information Commissioner’s Office (ICO) about a breach or potential breach. The figures describe reporting experiences; they do not establish that every externally reported incident was first detected outside the affected business.
Under ICO guidance, organisations must report personal data breaches that meet the notification threshold without undue delay and, where feasible, within 72 hours of becoming aware of them. Effective internal detection and escalation therefore affect both containment and compliance.
The pattern of reported breach causes has also changed. Phishing fell from 37% of UK responses in 2025 to 19% in 2026, while ransomware declined from 26% to 20%. AI-related attacks and ineffective patch management were each cited by 26% of UK respondents. Those comparisons indicate changing assessments, but do not by themselves demonstrate that AI has accelerated exploitation or that phishing incidents have fallen across the wider economy.
Across the combined UK and US sample, 99.5% reported having a security policy addressing employees’ use of personal IT equipment for remote working, while 98% said their organisations had increased encryption implementation over the past year. Nevertheless, 42% of UK respondents identified the risk of employees losing data despite understanding security requirements as a major challenge, up from 30% in 2025.
The NCSC distinguishes between preventing unauthorised transfers, monitoring activity, and retaining evidence for investigations. Encryption can protect information stored on lost portable media, but access restrictions and transfer monitoring are also needed to address deliberate misuse by someone already authorised to handle the data.
