Meet The Guest. Warm smile, firm handshake, and a mug with his name on it in permanent marker. He’s been in the office for about six years and waters the plants every Thursday. Nobody has ever asked who he is, because once you have a mug, you’re staff.
He didn’t break in. Someone held the door open for him back in 2020, in the form of a phishing email. That’s how most attackers arrive now. Breaking through a firewall is hard work. Talking their way past your people is cheap, and the numbers make that uncomfortably clear.
The front door is still your inbox
In Australia, phishing was the single most common technical root cause of ransomware attacks last year at 24.4%, with malicious email close behind at 23.5%, according to the Sophos State of Ransomware in Australia 2026 report. Put those together and email accounts for close to half of all Australian ransomware attacks.
The global picture tells the same story from a different angle. Sophos found that 79% of ransomware attacks started with an identity-based approach, either stealing credentials or using ones already stolen. The real target is the person who can log into your server.
And the people side is moving in the wrong direction. Globally, human error was the only operational root cause of ransomware that increased year on year while every other factor fell. The Office of the Australian Information Commissioner saw the same shift, with human error behind 37% of notified data breaches in the first half of 2025, up from 29% in the previous six months.
The red flags your filters won’t catch
Look at those numbers together. Email is how attackers get in, a person is what they’re actually after, and human error is the one cause that keeps growing. Email filtering has got very good at catching bad links and dodgy attachments. It can’t read intent. The most effective social engineering doesn’t need a misspelt domain, because it carries a plausible story instead, and a story lands with a person, not a filter.
Qantas found this out in 2025. Attackers targeted a contact centre and gained access to a third-party customer servicing platform, and 5.7 million customers were affected. No zero-day exploit was needed. A convincing phone call did the work.
When we run through real incidents with customers, the same signals come up again and again. None of them trip a spam filter. The Guest’s favourite is the bonus confirmation email: different name, same story, and it works because it looks like good news.
- Urgency that skips a step. ‘The CEO needs this paid before the board meeting.’ Pressure is designed to get people acting before they think.
- Authority from an unusual channel. A senior leader who normally emails suddenly messages on WhatsApp, or a supplier calls from a new number.
- A request to go around the process. Reset this password without the usual checks. Update these bank details just this once.
- Details that are almost right. Correct names, correct project, slightly wrong tone. Much of what an attacker needs sits on LinkedIn.
- A favour, not a threat. The friendly caller who just needs a quick hand is more dangerous than the scary one, because nobody wants to be rude.
Notice what these share. They exploit helpfulness, respect for seniority and a reluctance to slow things down. Those are traits you want in your team. Keep them, and give people a safe, simple way to pause.
Why annual training doesn’t move the number
Most organisations already run awareness training. Most of it happens once a year, runs for the best part of an hour, and is forgotten by lunch. That ticks a compliance box. It rarely changes what someone does at 4:45pm on a Friday when an ‘urgent invoice’ lands.
Behaviour changes with repetition, realism and feedback. People need to see phishing that looks like the phishing they actually receive, often enough that spotting it becomes habit, and they need to know what happened when they reported something.
That last part matters more than most programs admit. Click rate tells you who got caught. Report rate tells you whether your people have become a sensor network. A team with a modest click rate and a high, fast report rate is in far better shape than one with a low click rate and total silence, because a single early report can stop a campaign that has already landed in 50 other inboxes.
Six habits to start this month
You don’t need a new tool to start. You need a few deliberate habits.
- Measure report rate, not just click rate. Track how many people report a simulated phish and how quickly. That’s your real early warning system.
- Make reporting one click. If flagging a suspicious email means finding a policy document and an address, most people won’t bother.
- Harden your help desk. Verify callers using something an attacker can’t find online, and never reset credentials on the strength of a convincing voice alone.
- Put a pause into high-risk processes. Payment changes, access requests and password resets should all require a second check through a separate channel.
- Reinforce monthly, not annually. Short, realistic simulations with instant feedback build habits that a long module rarely does.
- Thank people who report. Even when it turns out to be nothing. Especially then.
The human firewall is a real thing
The Guest’s run ends when the office starts to stop, think and check. Someone even reports his thank-you card. That’s the culture worth building, one where pausing is normal and reporting is rewarded.
It’s tempting to see people as the weak link. We think that framing gets it backwards. Your people are the most targeted part of your organisation, and with the right reinforcement they are also the most adaptable defence you have. Filters catch what they’ve seen before. A well-trained person can catch what feels wrong.
ASAP, our managed security awareness program, runs realistic phishing simulations, short training and clear reporting all year round, so you can see behaviour move rather than hope it has. Our team handles the running of it, which matters when your IT team is already stretched.
The Guest got in with one clicked link. Would anyone in your team click it today? The Guest Prevention Program starts with a free staff awareness assessment. It shows how your people handle phishing, MFA prompts and reporting, so you find the gaps before an attacker does. After all, how long has your guest been staying?
