With one-third of working adults in the U.S. admitting to potentially risky behavior at work, employee negligence poses major security concerns for U.S. businesses.

That’s according to Shred-it's State of the Industry Report, which exposes information and data security risks currently threatening U.S. enterprises and small businesses and includes survey findings from the Shred-it Security Tracker, conducted by Ipsos.

The report found that employee negligence or accidental loss is a main cause of data breaches.

Nearly half of C-suite executives (47%) and small business owners (42%) reported that human error or accidental loss by an employee was the cause of a data breach.

Additionally, one in four C-suite executives (28%) and one in five SBOs (17%) reported human error or accidental loss by an external vendor caused their organization to suffer a data breach.

"The study's findings clearly show that seemingly small habits can pose great security risk and add up to large financial, reputational, and legal risks," says Monu Kalsi, vice president, Shred-it.

"For companies looking to better protect their data, smart information security begins with giving employees access to smart information security practices and training.

"Through consistent training and education, businesses of all sizes can take back ownership of information security and create a more security-minded work culture among their employees."

The study also found that 78% of C-suite executives and just over one in four (28%) SBOs plan to train their staff on information-security procedures and policies over the next year.

Additional Findings

Additional findings from the report expose high-risk areas and activities businesses should consider examining, including the following.

When employees work off-site, businesses believe the odds of a data breach occurring are higher.

1. Off-site work habits. When employees work off-site, businesses believe the odds of a data breach occurring are higher.

  • Eighty-six percent of C-suite executives and 60% of SBOs agree that the risk of a data breach is higher when employees work off-site than when they work at the office.
  • However, despite security risk concerns, just 35% of SBOs have a policy in place for storing or disposing of confidential information while working off-site, while 54% of SBOs have no policy in place at all.
  • Most C-suite executives have an information security plan in place. These respondents reported that they train employees on keeping sensitive information out of sight when working in a public space (81%), sharing company-issued electronic devices with family or friends (60%), keeping company-issued devices safe from interference from children or pets at home (56%), using public Wi-Fi (54%), identifying fraudulent emails (71%), and providing guidance on how to report a lost or stolen electronic device (73%).

2. Physical document security. From loosely stored confidential notes on a desk to the theft of paper documents while working off-site, U.S. employees create vulnerable paper trails.

  • Most U.S. workers (65%) admit they take notes at work in a paper notebook. Additionally, two in five (39%) admit they leave these work documents or notebooks on their desk after they leave the office for the day, leaving documents with confidential information vulnerable to theft.
  • Thirty-six percent of C-suite executives admit employees lost or had paper documents with sensitive company information stolen, compared to just 6% of SBOs.
    Twenty-six percent of U.S. workers leave their computer on and unlocked when they leave work for the day.
  • As workers continue to turn to pen and paper to take confidential business notes inside and outside the office, the good news is that 96% of C-suite executives say they have a policy for storing and disposing confidential paper documents. However, just 49% of SBOs report that they have a paper policy in place.

3. Device use. U.S. workers are losing computers and mobile devices and/or leaving them vulnerable to theft.

  • Twenty-six percent of U.S. workers leave their computer on and unlocked when they leave work for the day.
  • Around half of C-suite executives indicate that they have had employees who lost or had their company laptop/device (49%) or company mobile phone (43%) stolen. In contrast, SBOs were much less likely to report employees had lost or had their company laptop/device (7%) or company mobile phone (9%) stolen.
  • One in five C-suite executives (17%) and SBOs (18%) suffered a data breach due to an employee losing or having sensitive information stolen.

    About the research: Ipsos conducted a quantitative online survey of SBOs in the United States (n=1,003), maximum 100 employees and C-suite executives in the United States (n=101). C-suite executives work for companies with a minimum of 500 employees in the United States. Data for Small Business Owners is weighted by region. Data for C-suite executives is unweighted as the population is unknown. The precision of Ipsos online surveys is calculated via a credibility interval. In this case, the U.S. SBO sample is considered accurate to within +/- 3.5 percentage points had all U.S. small business owners been surveyed, and the U.S. C-suite sample is accurate to within +/- 11.1 percentage points had all U.S. C-suite executives been surveyed. The fieldwork was conducted between April 3 and April 21, 2018.