Careless employees are UAE organisations’ biggest data loss problem

An astounding 94 per cent of surveyed organisations in the UAE experienced data loss in the past year, a study showed on Tuesday.

According to the inaugural Data Loss Landscape report by Proofpoint, Inc., a leading cybersecurity and compliance company, almost all (94 per cent) of those affected faced a negative outcome, such as business disruption and revenue loss (reported by 55 per cent of affected UAE organisations) or regulatory violation/fine (47 per cent).

The report explores how current approaches to data loss prevention (DLP) and insider threats are holding up against current macro challenges such as data proliferation, sophisticated threat actors, and generative artificial intelligence (GenAI). The findings reveal that data loss is a problem stemming from the interaction between humans and machines — “careless users” are much more likely to cause those incidents than compromised or misconfigured systems.

While organisations are investing in DLP solutions, Proofpoint’s report shows that those investments are often inadequate.

Emile Abou Saleh, senior regional director at Proofpoint Middle East, Turkey & Africa, said: “Data loss poses a severe threat, where a simple oversight can lead to the loss of critical data. It is, therefore, crucial for employees to understand the role they play in data protection and that it is not just an IT problem. As work models evolve, organisational strategies for securing data across all platforms must also adapt. By enhancing data loss prevention policies and insider risk strategies across the board—from endpoints and cloud apps to email and the web— organisations will be able to bolster their defences against the modern security landscape, ensuring a secure digital future for everyone involved.”

“This research illuminates the most critical aspect of the data loss problem: its human causes,” said Ryan Kalember, chief strategy officer of Proofpoint. “Careless, compromised, and malicious users are and will continue to be responsible for the vast majority of incidents, all while GenAI tools are absorbing common tasks—and gaining access to confidential data in the process. Organisations need to rethink their DLP strategies to address the underlying cause of data loss—people’s actions—so they can detect, investigate, and respond to threats across all channels their employees are using including cloud, endpoint, email, and web.”

The 2024 Data Loss Landscape report examines third-party survey responses from 600 security professionals at organisations with 1,000 or more employees across 17 industries from 12 countries. These insights were supplemented with data from Proofpoint’s Information Protection platform and Tessian, which Proofpoint acquired last fall, to convey the scale of the data loss and insider threats that organisations face.

Key global findings include:

• Data loss is a widespread yet preventable problem: organisations experienced the equivalent of two incidents per month (a mean of 24 data loss incidents per UAE organisation in the past year), and 75 per cent of respondents said the main cause was careless users. Carelessness includes misdirecting emails, visiting phishing sites, installing unauthorised software, and emailing sensitive data to a personal account. These all-preventable behaviors that could be mitigated with practices such as implementing data loss prevention policy rules for email, web uploads, cloud file synching, and other common data exfiltration methods.

• Misdirected email is one of the simplest and most significant sources of data loss: According to 2023 data from Tessian, about one-third of employees sent one or two emails to the wrong recipient. That means a business of 5,000 employees can expect to deal with around 3,400 misdirected emails per year. A misdirected email containing employee, customer or patient data can potentially trigger a significant fine under GDPR and other legal frameworks.

“Emerging channels underscore the importance of regularly reviewing DLP programs, as these types of rapid developments change user behaviors,” said Kalember. “Strategies such as implementing purpose-built DLP platforms can help advance security programs by enabling security teams to gain full user and data visibility into all incidents and address the full spectrum of human-centric data loss scenarios. Humans are a critical data security variable—and data loss prevention programs must recognise this.”