photo-1510915228340-29c85a43dcfe (1470×980)
When people think about the potential for security breaches and hacking attempts, they mostly think about overt attacks. For example, obvious phishing emails, compromised passwords, and other malicious acts. Yet, not much attention is given to the way user convenience allows many of these attacks to bear fruit.
This has particular relevance in situations where workers often access company information from outside the office. In this article, let’s look at
3 simple acts of convenience and low-friction tech use lead to Increases Risk in Business Operations
#1. The Risks From Shadow AI
Shadow AI is essentially a term for unsanctioned generative AI tools. Think free versions of the popular AI models used by people every day. Workers use them to save time and can automate tedious writing or coding tasks. The problem arises when employees send company data to shadow AI services.
IBM found that high levels of shadow AI, meaning workers using unapproved internet-based AI tools, added $670,000 to the global average breach cost. They also found that 63% of organizations had no AI governance policies to prevent workers from using shadow AI.
There are numerous AI services popping up everywhere today, and not all of them are legitimate. All it takes is a single breach at the AI vendor level to compromise company data that an employee uploaded. Sometimes, businesses might also unknowingly sanction shadow AI usage to avoid paying the high cost of Tier 1 AI models so it help to Increases Risk in Business Operations . However, as we can see, doing so comes at a potentially high cost.
#2. User Laziness and Trusted Backdoors
Today, many companies offer remote work options to their employees. At home, workers may have to access sensitive company information, and that’s where laziness can create risk. It’s convenient to just access data with your home network, but using a business VPN should be mandated.
It ensures a secure tunnel to internal resources and provides data encryption that prevents any malicious third party from intercepting data. The challenge is to ensure that workers use it instead of favoring convenience, which might even include logging in from the public network of a cafe.
Similarly, many companies find remote monitoring and management (RMM) tools an easy way to track employee work. Yet these convenient tools can also pose a great risk.
Microsoft reports that 79% of the ransomware cases its incident response team observed involved at least one remote monitoring and management (RMM) tool. The report also notes that AI-driven phishing is now three times more effective than traditional campaigns.
The reason for this is that instead of custom malware that triggers antivirus alarms, RMM tools are already approved once installed. If an RMM account is compromised, a hacker essentially has full access to the employee’s system and, as a result, the company’s as well. They can then deploy ransomware across all connected servers it help to Increases Risk in Business Operations .
#3. MFA Fatigue
Multifactor Authentication, or MFA, typically involves a password followed by a one-time code, push approval, or biometric check. However, for workers constantly signing into different accounts, this can get tiresome. As a result, some security companies have introduced one-tap push notifications that have become quite popular.
You simply click “Approve,” and the MFA process is completed. It’s super convenient, but it introduces risk via MFA Fatigue attacks. As Anna Collard, a cybersecurity and social entrepreneur, explains, MFA fatigue attacks are also known as prompt spamming or authentication bombing. They focus on the vulnerability of the human rather than high-tech hacking methods.
The attacks constantly push notifications to someone who has already provided their username and password. The goal is to annoy them to the point that they ‘Approve’ or enter details again, giving hackers access to their account or system.
The attacks often happen late at night or when the user is busy. This increases the odds of the user automatically approving a fraudulent MFA push notification.
Frequently Asked Questions
1. Why do employees often ignore cybersecurity policies?
Employees may view security procedures as obstacles to getting their work done, particularly when deadlines are tight. If approved tools feel complicated or slow, they may look for shortcuts. Businesses can address this by making secure practices easier to follow and explaining the risks behind each policy.
2. What is the biggest human error that leads to data breaches?
One common cause is employees falling for social engineering tactics, such as phishing messages or impersonation attempts. These attacks exploit trust, urgency, and routine behavior. Regular security awareness training can help workers recognize suspicious requests before they share credentials or expose sensitive company information.
3. How can businesses encourage employees to follow cybersecurity best practices?
Start by making security training practical and relevant to everyday tasks. Employees should understand how their actions affect company systems, rather than simply memorizing rules. Businesses can also introduce password managers, clear reporting procedures, and accessible IT support to make safer habits easier to maintain.
Key Numbers & Facts at a Glance
| Additional global average data breach cost associated with high levels of shadow AI | $670,000 |
| Organizations without AI governance policies | 63% |
| Ransomware cases involving at least one remote monitoring and management (RMM) tool | 79% |
| Effectiveness of AI-driven phishing campaigns compared with traditional campaigns | 3 times higher |
| MFA Fatigue Attacks | Use of repeated MFA push notifications to pressure users to approve fraudulent access |
The common denominator across all these areas is a misunderstanding of friction. For years, the tech industry has tried to reduce user friction by building systems that need the least amount of clicks or thinking. Yet, as we see, the convenience it brings can also remove security guardrails.
We don’t want to get rid of convenient design and tech, but it shouldn’t come with such high risk. As a business, it’s crucial that you recognize the potential of seemingly helpful tech and the way malicious actors can leverage it for harm so it help to reduce the Increases Risk in Business Operations .
Also Read :- The Role of Distributed Teams in Supporting Modern Business Operations
