--- description: As data breaches run rife in Australia, do companies encourage employees enough to follow cybersecurity protocols and training? Read our survey results here. image: https://gdm-localsites-assets-gfprod.imgix.net/images/capterra/og_logo-e5a8c001ed0bd1bb922639230fcea71a.png?auto=format%2Cenhance%2Ccompress title: Data breaches: Report on cybersecurity habits of employees --- # Data breaches: Nearly half of Aussie employees use same password across multiple accounts Canonical: https://www.capterra.com.au/blog/4506/data-breaches-and-employee-behaviours-australia-report Published on 31/01/2024 | Written by Laura Burgess. ![Data breaches: Nearly half of Aussie employees use same password across multiple accounts](https://images.ctfassets.net/63bmaubptoky/5XDYjfwjcaK7HOYvbyobDi/cc57d3f9921c3f1101ea193052b81a7a/data-breaches-_AU-capterra-header_image.png) > Employee behaviour is a critical factor in companies preventing data breaches. Adhering to cybersecurity practices, such as regular training and communication with IT departments, can help to protect against severe security risks. But how seriously do companies in Australia take cybersecurity culture? What measures do they have in place? Read our survey results to find out.  ----- ## Article Content Employee behaviour is a critical factor in companies preventing data breaches. Adhering to cybersecurity practices, such as regular training and communication with IT departments, can help to protect against severe security risks. But how seriously do companies in Australia take cybersecurity culture? What measures do they have in place? Read our survey results to find out. In this articleJust over a quarter of companies faced a data breach in 2023Most employees think their company takes cybersecurity seriously45% of employees use the same password for multiple accounts2FA is one of the most implemented cybersecurity measures by companiesThe majority of companies require cybersecurity training at least once a year, but employees want moreEveryone in a company, from leadership to frontline employees, shares the responsibility for cybersecurity. An organisation with a cybersecurity culture sets the tone for how employees perceive and prioritise risks and data breaches. Such practices reinforce that it’s not only the IT department’s responsibility but a collective effort that requires the participation of every worker. High-risk or thoughtless employee behaviour can make companies vulnerable to cyberattacks, especially during the age of remote work. For example, employees working remotely often use personal networks, which may lack the same level of security as corporate ones. Cybercriminals can exploit home network vulnerabilities to gain unauthorised access to sensitive information. In this case, employee awareness and virtual private networks (VPNs) are essential. Capterra’s first article in this two-part series examined the cybersecurity threats in Australia that companies are most concerned about. But are organisations aware of high-risk employee behaviours? Are they offering enough in the way of employee cybersecurity training programs? Capterra surveyed 714 people working for companies that use cybersecurity tools to learn more about their cybersecurity protocols. The full methodology is at the bottom of this article. Just over a quarter of companies faced a data breach in 2023At the end of 2023, The Office of the Australia Information Commissioner (OAIC) released its Notifiable Data Breaches report covering the first six months of the year. It highlighted that 409 data breach notifications were received in this time period, with 23 breaches affecting more than 5,000 Australians and two affecting more than 10 million. With this in mind, human error is one of the leading causes of data breaches, whether employees fall victim to phishing attacks, use weak passwords or inadvertently disclose confidential data. Capterra’s own Data Security Report found that over a quarter of employees (26%) said their company experienced a data breach in the 12 months prior to taking the survey (17% said they had one data breach, and 9% said they had multiple breaches). Whilst the majority (63%) said their company hadn't faced a breach, the outlook could still be better for businesses in Australia. When asked which types of data breaches their company experienced, survey takers mostly said that hackers or outsiders had maliciously accessed their systems (52%). Hackers can strike in various ways, such as gaining access to databases and extracting and transferring sensitive data from the network. Other ways in which companies experienced breaches include:A database or other online data source was accidentally left unsecured (46%)An employee or other insider stole company data (31%)A company device was lost or stolen (19%)Tips for businesses: Remote employees are often susceptible to malware threats when accessing the internet or using external networks. Firewalls help block malicious software and prevent it from reaching remote devices, safeguarding against viruses, trojans, and other forms of malware. They often support VPN functionality, providing a secure way for remote workers to connect to the corporate network. This is essential for maintaining the security and privacy of data transmitted over the internet.Most employees think their company takes cybersecurity seriously Employee confidence in their company prioritising security is a key factor in building a resilient cybersecurity culture, reducing human error and enhancing incident response capabilities. Capterra found that a combined total of 93% of employees have some level of confidence in their company taking cybersecurity seriously (35% said they were very confident, 38% said quite, and 20% said somewhat). When asked whether they had ever raised cybersecurity concerns with the company's IT department, only 36% of respondents said yes. Perhaps this is due to a lack of employee awareness of potential threats, and workers may need help understanding the significance of certain activities. Employees should be considered the first line of defence against data breaches as they may be the first to notice suspicious activities or other potential security risks within the company. Encouraging employees to report concerns allows businesses to detect and respond to potential threats early, preventing them from escalating into more significant security incidents. But how were employees received by their IT departments when they did report a security concern? Respondents most frequently said the IT team was open to communication (60%), encouraging them to voice any concerns and feedback on security measures. Encouraging employee involvement was the next most cited response: 49% of those who reported a cybersecurity concern said their IT department wanted workers to suggest ideas and report vulnerabilities. Other ways companies respond to employee security concerns include:Employee training (38%)Reminder of cybersecurity policies and guidelines (34%)Transparency about the incident from IT (34%)Tips for businesses: To facilitate effective reporting, companies should establish clear and accessible channels for employees to raise cybersecurity concerns with the confidence that they will be taken seriously. This may involve implementing anonymous reporting mechanisms, such as feedback surveys or forms, to encourage employees to speak out about concerns and to foster a culture that values and rewards vigilance in cybersecurity matters. 45% of employees use the same password for multiple accountsThe level of access that employees may have to company data varies and depends on factors such as responsibilities and data access policies. For example, employees in accounts will have access to financial systems, while those in HR can access personnel records. Most survey takers said employees in their company only have access to the data needed to perform their jobs (57%). A further 30% said they had access to more data than strictly necessary, and 9% said they had access to all company data. With almost 40% of employees having access to too much data, organisations should assess their permissions to reduce the risk of data breaches from insider threats, especially when it comes to trade secrets or proprietary data.Password management habits are also crucial, as poor practices can expose a company to various data breach risks and compromised systems. But what are the password management habits of employees when accessing their accounts? Nearly half of employees (45%) said they use the same password for multiple accounts. Cybercriminals often attempt to exploit password reuse, and compromising one account allows them to gain unauthorised access to additional ones, including those with sensitive data.A smaller group of survey takers (13%) said they had experienced an account takeover —where someone stole their username and password to access an online account— within the last year. Even though the majority (83%) said they hadn't experienced an account takeover, it highlights that companies need to tighten employee awareness and cybersecurity practices for the few who have been victims of a data breach.Tips for businesses: Employee adoption of password management practices can significantly contribute to maintaining a secure digital environment for both themselves and the company. For example, employees should avoid reusing the same passwords to prevent a domino effect, which could lead to multiple accounts being at risk. Password management tools can generate and store complex passwords as well as automatically fill in login credentials, saving time and the need for manual entry. 2FA is one of the most implemented cybersecurity measures by companies High-risk employee security behaviour is further revealed in our survey results, as over half of respondents (53%) said they or someone in their company had clicked on a malicious link in a phishing email. Employees may click on phishing links because the emails mimic the style and format of internal company communications. Employees may not carefully scrutinise emails in a busy work environment, especially if they receive a high volume of messages —again reiterating the need for cybersecurity awareness and regular training. But what other security measures should companies enforce to aid data breach prevention? Implementing strong authentication methods adds an extra layer of security beyond passwords. When asked what measures or policies their company has implemented to protect against cyber threats, two-factor authentication (2FA) (62%) and a password policy were most popular (61%). Enabling multi-factor authentication (MFA), such as 2FA, is useful for employees accessing company systems or email remotely, especially over public networks. It adds an extra layer of security for employees who connect from outside the corporate network, ensuring that even if login credentials are compromised, an additional factor is required for access. Regardless of whether a company has implemented password policies, it doesn't necessarily mean employees are adhering to the guidelines.Tips for businesses: A cybersecurity policy contains a set of rules defining how a company will protect its IT systems, networks and data from security threats, outlining the incident response and employee responsibilities.Policy management tools can help organise password policies and data protection guidelines so companies can manage their cybersecurity policies efficiently. Such tools can send automated notifications and alerts to employees regarding policy updates, reminders, or changes in cybersecurity protocols. They can quickly notify relevant personnel about security incidents or policy violations.The majority of companies require cybersecurity training at least once a year, but employees want moreThere are a multitude of reasons why regular employee cybersecurity training is crucial, especially as it keeps staff informed about the latest cyber threats, phishing techniques, malware and other types of attacks. This level of awareness enables workers to recognise and respond to emerging threats promptly. Respondents had varying answers when asked how often their company required them to undergo cybersecurity awareness training. A combined total of 64% of employees said they had training at least once a year (28% said once every six months and 36% once a year). For others, cybersecurity training proved to be less frequent:18% said they did not have it regularly8% said they only had it when they joined the company10% had never received any cybersecurity training However, it is apparent that employees want to learn more about cybersecurity practices. When they were asked how their company could better engage them in security efforts, education and training was the top answer (58%). Regular training contributes to building a strong security culture within an organisation, and once ingrained, employees are more likely to prioritise security measures in their daily activities. So, what measures should companies implement? The following are steps to enhance employee behaviours with cybersecurity:1. Comprehensive cybersecurity training: Provide regular cybersecurity training for all employees. Cover topics such as phishing awareness, password security, safe browsing practices, and reporting security incidents.2. Simulated phishing exercises: Conduct simulated exercises to test employees' ability to recognise and avoid phishing attempts. These exercises provide valuable insights into areas that may require additional training.3. Clear security policies and guidelines: Establish clear and concise cybersecurity policies and guidelines. Ensure employees understand the rules and expectations regarding data handling, access controls, and secure communication.4. Regular security reminders: Send regular security reminders and updates to keep security awareness in mind. These can include quick tips, examples of current threats, and reminders of key security practices.5. Provide secure communication tools: Offer and encourage using secure communication tools and platforms. This includes encrypted email services, secure messaging apps, and collaboration tools with built-in security features.Looking for cybersecurity software? Check out our catalogue\! ## Disclaimer > MethodologyData for Capterra's Security Report survey was collected in November 2023. Results comprise responses from 714 participants. The criteria to be selected for this study are as follows: Australian residentBetween 18 and 65 years oldEmployed full-time in a company with more than one employeeWorks for a company that uses cybersecurity software tools for protection and has some awareness of which tools are usedA subset (568) are involved/aware of their company’s cybersecurity measures  ## About the author ### Laura Burgess Laura is a Content Analyst at Capterra, researching and giving insight on tech trends to help SMEs. Graduate of Bath Spa University, UK. ## Related Categories - [Accounting Software](https://www.capterra.com.au/directory/1/accounting/software) - [Compliance Software](https://www.capterra.com.au/directory/30110/compliance/software) - [CRM Software](https://www.capterra.com.au/directory/2/customer-relationship-management/software) - [Network Security Software](https://www.capterra.com.au/directory/30003/network-security/software) - [Project Management Software](https://www.capterra.com.au/directory/30002/project-management/software) ## Related Articles - [5 Business New Year’s Resolutions To Boost Employee Happiness](https://www.capterra.com.au/blog/1124/business-new-years-resolutions-bemployee-happiness) - [Increasing workload is the most commonly reported cause of work-related stress](https://www.capterra.com.au/blog/2637/symptoms-and-causes-of-work-related-stress-in-sme-employees) - [Software buying trends in Australia 2026: Planning and user reviews boost ROI and lessen disruption](https://www.capterra.com.au/blog/7674/software-buying-trends-2026-australia) - [Why is Google removing third party cookies?](https://www.capterra.com.au/blog/2734/why-google-removing-third-party-cookies) - [Capterra Australia’s Best Product Lists Methodologies](https://www.capterra.com.au/blog/7620/best-product-lists-methodologies) ## Links - [View on Capterra](https://www.capterra.com.au/blog/4506/data-breaches-and-employee-behaviours-australia-report) - [Blog](https://www.capterra.com.au/blog) - [Home](https://www.capterra.com.au/) ----- ## Structured Data