Lesson 1: Why Attackers Target Ordinary Staff

Why This Matters to You

Many people think cyber security is the IT team's job. Firewalls, servers and software are only part of the picture. Criminals know that the easiest way into most organisations is through people, so they aim at ordinary employees such as finance assistants, receptionists, HR officers, project managers and new starters.

The UK Government's Cyber Security Breaches Survey 2025/2026 (published 30 April 2026) found that:

• 43% of UK businesses identified a cyber security breach or attack in the previous 12 months.
• Phishing (fake messages designed to trick people) was the most common type by far. It affected 38% of businesses.
• Of the organisations that had a breach, 69% said phishing was their most disruptive incident.

Phishing goes after people, not machines. That makes you part of your organisation's defence.

Reason 1: You Have Access

Attackers don't need to break in if someone can let them in. As an employee you probably have:

• A work email account and login details
• Access to shared drives, customer records or finance systems
• The ability to approve, pay, send or change things

Think of your login as a staff pass to a building. A burglar can try to force the locked back door (the IT systems), or simply persuade someone to hold the front door open. The second way is usually quicker and quieter.

Reason 2: You Are Trusted

Your colleagues, suppliers and customers trust you. If an attacker takes over your account, or pretends to be you, they borrow that trust.

Example: An attacker gets into a sales assistant's mailbox. They send a "shared document" link to 200 contacts from a real, familiar address. Many people click, because the message came from someone they know.

Reason 3: You Are Busy

Most staff are juggling deadlines, meetings and emails. Attackers rely on this. A person who is busy or stressed is more likely to act quickly without checking. The NCSC (the UK's National Cyber Security Centre) points out that people click for many reasons, including situational ones such as being busy and stressed. It also warns that blaming users doesn't work.

How One Click Becomes a Wider Breach

A single action rarely stays small. A typical chain looks like this:

1. The hook: An employee gets a convincing message, call or text.
2. The action: They click a link, enter their password, open a file or read out a code.
3. The foothold: The attacker now has a working account or a device they control.
4. The spread: The attacker uses that access to read emails, find other systems or message colleagues and customers.
5. The damage: Data is stolen, money is redirected or systems are locked.

You can break this chain at step 2, and stopping there costs the least.

The Four Pressure Tactics

The technique of manipulating people rather than hacking computers is called social engineering. Most social engineering relies on one or more of these four pressures:

• Urgency: "This must be done in the next 30 minutes." A deadline leaves you no time to think.
• Authority: "This is the Finance Director." A senior name, regulator, bank or IT team makes you less likely to question the request.
• Fear: "Your account will be closed" or "You'll be fined." Worry makes you act to avoid trouble.
• Curiosity: "See who viewed your profile" or "Revised salary bands attached." Intrigue makes you click before you think.

These tactics are often combined. "The CEO needs this payment made before the bank closes" uses authority and urgency together.

What to Do: The Pause-and-Check Routine

When any request makes you feel rushed, pressured, worried or intrigued, follow these steps:

1. Pause. Strong pressure is itself a warning sign. Real requests can almost always wait five minutes.
2. Name the pressure. Ask yourself: is this urgency, authority, fear or curiosity?
3. Ask if it's unusual. Is this the normal way this person or organisation asks for this kind of thing?
4. Check using a different route. Contact the person through a channel you already trust, such as a known phone number or your internal directory. Don't use the contact details in the message.
5. Report it if in doubt. Tell your IT or security team following your organisation's process. Reporting is always the right call, even if you have already clicked.

Practice: Make the Decision

Read this message and decide what to do.

From: Sarah Collins, Managing Director "Hi, are you at your desk? I'm in a client meeting and can't talk. I need you to buy £300 of gift cards for a client thank-you today. Send me the codes by reply ASAP and keep it between us for now. I'll sort the expenses later."

Signs of social engineering:

• Authority: the message claims to be from the Managing Director.
• Urgency: "today" and "ASAP".
• Unusual request: gift card codes sent by email are not a normal business process.
• Secrecy and no way to check: "keep it between us" and "can't talk" are designed to stop you verifying.

Decision: Don't buy anything or reply with codes. Check with Sarah through a known channel, such as a phone number from the staff directory or her assistant, and report the message.

Key Takeaways

• Attackers target ordinary staff because of their access, the trust others place in them, and time pressure.
• Phishing is the most common type of breach or attack reported by UK businesses.
• One click, call or reply can give an attacker a foothold that spreads across the organisation.
• Look out for the four pressure tactics: urgency, authority, fear and curiosity.
• Pause, name the pressure, check through a trusted route, and report. Reporting quickly matters more than whether you made a mistake.