Your business may already have firewalls and antivirus software. But there’s another layer of security to consider, and it’s sitting at every desk in the office: your people. And in cybersecurity, staff can be a business’s weakest link or its greatest asset.

Cybercriminals know this. Rather than trying to get around sophisticated technology, many simply persuade someone in the business to do something for them. (And not necessarily a gullible technophobe — anyone can be caught out, particularly when they’re busy.)

Not every way in relies on sophisticated technology. Sometimes, all it takes is a convincing e-mail or a link to a fake website, which makes these attacks all the harder to catch. They look completely ordinary.

It's not a question of whether employees will come across these threats, but whether they'll recognise them and know how to handle them when they do.

Attacks exploit ordinary behaviour

So, we know what makes these approaches so effective: they play on perfectly reasonable instincts. We trust familiar names. We want to be helpful, particularly to a senior colleague. We respond to urgency, and we’re curious about the unexpected attachment.

It’s often through these more innocuous requests, say, an e-mail asking you to change a supplier’s bank details, or to pay an invoice immediately, that attacks bypass the usual checks. They don’t feel like a threat. They’re easily mistaken for a typical task.

The people on the receiving end aren’t careless. They’re doing their jobs, usually quickly. Attackers are banking on that.

From “human error” to “human defence”

When an attack does succeed, it’s easy to put it down to human error. But rather than looking at who’s to blame, businesses should ask whether their employees had the training and support to have acted differently.

Fear of getting into trouble for not picking up on a potential risk is itself a security risk. Take an employee who’s clicked a suspicious link, or sent a payment they now doubt. In some cases, staff might be tempted to keep quiet and hope for the best. Yet the sooner a problem is reported, the better the chance of keeping it contained.

Having a known point of contact for reporting issues makes it far easier, and similarly, staff should feel free to question an unusual instruction, even when it appears to come from the top.

Cybersecurity is a habit, not a tick-box

For many businesses, cybersecurity training means completing an online module once a year. While that's a useful starting point, it's unlikely to be enough on its own.

People forget what they’ve learnt, and cybercriminals are constantly changing their tactics. Keeping employees alert requires more regular reminders and practical guidance.

Short, regular reminders are better for keeping cybersecurity front of mind, especially if they include real examples of suspicious messages the business has received.

Some senior leaders are reluctant to share information about potential breaches, but a degree of transparency can help employees recognise similar attempts. Simulated phishing e-mails can also show just how convincing these messages can be.

It’s best to tailor training by department or role. For example, your finance teams should be well-versed in payment diversion fraud, while HR may be more concerned with attempts to get hold of confidential employee details.

Whatever the role, the aim isn’t to turn everyone into a cybersecurity expert, but to help them recognise when something doesn’t look right. A good litmus test is whether spotting a suspicious request has become as natural as double-checking the front door is locked.

Getting independently certified can help businesses verify these habits are actually being rolled out. IASME Cyber Assurance, for example, is a risk-based scheme that looks at policies and governance, including staff training and support, and tests how effectively people and processes work together against attacks — a useful yardstick for island firms, where a single compromised inbox can have far-reaching consequences.

Your first line of defence

The firewall may guard the network, but it’s the person at the desk who decides whether to click. Businesses that invest in their staff, through training, sound governance and a workplace where concerns are raised early, tend to be better protected than those relying on software alone.

For businesses with data, infrastructure and systems to protect, cyber assurance could be the right route. For others, it may be a matter of making sure your staff know how to spot something suspicious.

• Louise Ralston is chief operating officer of Cyber Tec Security, a cybersecurity specialist business providing cyber certification-led resilience and adherence to regulatory compliance