Is the employee to blame? Or does cybersecurity start with a risk-based approach?
You often hear it said: “The end user is the weakest link in information security.” But is that really a fair assessment? Often, the root of the problem lies not with end users, but with the lack of clear policies, with systems that were set up without critical scrutiny, or with insufficient oversight of access rights. Security isn’t a matter of “someone making mistakes,” but of what you, as an organization, put in place structurally in advance to limit the impact of an unintended action. And that’s where things often go wrong.
Recent events in the Netherlands
In September 2024, the work-related contact list (names, email addresses, phone numbers) of employees at the National Police¹ was stolen by the hacker group Laundry Bear. At Clinical Diagnostics², an external laboratory, data on more than 485,000 participants in the cervical cancer screening program was also leaked. It later emerged that the number of people affected had risen to approximately 850,000. In addition, the Citrix systems³ of critical Dutch organizations were hacked, leaving these organizations vulnerable since May 2025.
These three examples show that accidents can happen in the blink of an eye, but above all, they highlight that every organization needs to consider how it can minimize the impact of a cyberattack. The underlying problem does not lie with the end user, but rather in system design, access control, and clearly defined responsibilities. How can you mitigate such risks? Be sure to read on.
But about structure
For many companies, information security is a challenging topic. You hear terms like “risk-based approach” or “cyber resilience,” but they often remain vague concepts without concrete details. Yet that is precisely what makes the difference between a policy that exists on paper and one that actually works.
Five Practical Steps
What can you do to prevent cyber incidents and ensure that the impact of an incident is minimized? These five steps will help you get started:
Step 1: Identify the risks—assess what you have and what you could lose
What happens if customers’ personal data or company information is exposed? Which systems are vulnerable? How are roles and permissions assigned? And who within the organization might cybercriminals target? Start with a thorough assessment of assets, processes, and dependencies. Without a clear overview, any plan is just a guess.
Step 2: Prioritize based on impact and likelihood
Not every risk carries the same weight. Which scenario really matters: reputational damage, legal fines, loss of trust, or a halt in production or service delivery? And how likely is it to happen? So prioritize based on what you believe makes this information valuable to a cybercriminal or to yourself.
Step 3: Choose measures that are appropriate for the risks
The measures you take must be tailored to your organization and the risks it faces. This isn’t (just) about checking off boxes on a list; rather, it’s primarily about considering technical, organizational, and human aspects:
- Technical: Keep systems up to date, implement good basic IT security practices, and ensure proper backups.
- Organizational: Determine who is authorized to do what and who is authorized to access what; establish procedures for approving sensitive actions; and don't forget to conduct periodic audits.
- Human: Make sure employees understand why policies exist, which policies apply within your organization, and what their own role is in that context. Training is only effective when people understand the context, recognize the benefits of their own safety, and the right culture is in place.
Step 4: Continuously monitor and learn
Cyber threats change every day, and attacks are becoming increasingly sophisticated. So standing still is not an option. Policies only work if they’re actively maintained: through simulations, audits, and incident analyses, you can determine whether measures are effective or if risks are still emerging somewhere. This way, information security remains a continuous learning process, rather than an annual checklist.
Step 5: Establish Clear Responsibilities and Governance
Who oversees operations? Who reports to the board? And who is truly responsible for risks? When responsibilities are clearly assigned, teams can work on information security with greater focus, trust, and predictability. Clear governance brings peace of mind, clarity, and a sense of ownership.
Let’s look at it another way. That’s essentially our message. When all the elements are in place—policy, technology, and organizational culture—a situation arises in which employees aren’t held responsible for every mistake, but are instead an active link in the security chain. These are employees who identify issues in a timely manner, ask questions, and follow the procedures they’re familiar with.
Working Together to Build Resilience
At OneXillium, we guide organizations along this path: together, we identify risks using a customized step-by-step plan, make policies practical, ensure that technology works in our favor, and make sure employees know what they can do. True security begins with insight, structure, and collaboration.