In April 2025, Marks & Spencer, a brand trusted by millions and operating in Malaysia lost an estimated £300 million to a cyberattack. Their systems were not hacked. Their people were.
This is not an isolated case. Most business breaches do not start with a technical failure. They start with a person. And for Malaysian SME leaders, that distinction changes everything about how you approach security.
No amount of technology spending would have prevented the M&S breach. The door was opened by a person — and that is exactly how most attacks begin.
The Uncomfortable Truth About Where Breaches Start
Security conversations in businesses tend to focus on technology such as firewalls, antivirus software, system updates. These things matter. But they address the wrong end of the problem.
According to the Verizon Data Breach Investigations Report, the human element is involved in approximately 68% of all breaches. A separate Mimecast study puts that figure closer to 95% when insider mistakes and careless behaviour are included. Wherever the true number sits, the direction is clear: most breaches involve a person doing something such as clicking a link, sharing a password, approving an unexpected request which they should not have done.
This is not a reflection of employee intelligence or commitment. It is a reflection of how sophisticated the attacks have become and how little preparation most businesses provide.
How Attackers Use People to Get In
The technical term is social engineering. Using deception to manipulate people rather than machines. In practice, it looks like this:
- Phishing emails. A message appearing to come from a known sender such as a supplier, a bank, a payroll service, a logistics partner, or a government agency, asking the recipient to click a link or log in somewhere. The page looks real. The request sounds routine. The result is handed-over credentials.
- Impersonation calls. An attacker poses as a senior manager, a bank fraud officer, a payroll administrator, an auditor, or a vendor and asks an employee to reset a password, authorise a transfer, or share a verification code. Urgency and apparent authority are the tools.
- Business Email Compromise. Attackers access or convincingly fake a real email account and use it to redirect a payment or request sensitive documents. The email looks legitimate because it practically is.
- Pretexting. A longer approach where an attacker builds a relationship with an employee over time, posing as a new supplier, vendor, or customer, before making a request that would otherwise seem suspicious.
The M&S lesson for Malaysian SMEs
M&S was not breached because of poor IT infrastructure. It was breached because attackers targeted the human layer. Specifically, people at a third-party contractor who had been given access to M&S systems.
For Malaysian SMEs, the parallel is direct. If your staff, contractors, or service providers have not been prepared to recognise and resist these approaches, your technology investment may count for very little.
The entry point is almost always a person. The question is whether that person is prepared.
The Five Behaviours That Create the Most Risk
Not all employee behaviour creates equal exposure. These five patterns account for the majority of human-enabled breaches in SME environments:
- Clicking links without checking. Most phishing attacks succeed because the email looks convincing enough at a glance. Staff who have not been trained to pause and verify are consistently the most exposed.
- Sharing passwords or login details. More than half of employees share passwords with colleagues, according to security research. Each share is an uncontrolled door into a system.
- Using personal devices for work without security controls. A personal phone or laptop without endpoint protection, connecting to company systems over an unsecured network, is an open window.
- Ignoring software update prompts. Updates patch known security weaknesses. Deferred updates leave known vulnerabilities open and attackers know which ones.
- Approving access requests without verifying identity. Whether it is a supplier email, a message from a “colleague”, a request from a contractor, or a call from someone claiming to represent your bank, government agency or IT support, unverified approval requests are a primary attack vector.
Find out which of these gaps your organisation has.
Take the 2-minute Security Awareness Risk Meter → https://smssb.com/security-awareness-risk-meter
Turning Your Team Into Your First Line of Defence
The goal is not to make employees paranoid or to turn every email into a security exercise. It is to build habits that catch the majority of attacks before they succeed. A few practical steps make a disproportionate difference:
- Run a simulated phishing test. Send your staff a safe, fake phishing email and see who clicks. The results are rarely comfortable but they give you the most accurate picture of your real exposure. You cannot fix what you have not measured.
- Deliver short, regular security briefings. Annual training is quickly forgotten. Fifteen minutes once a quarter, using a real recent example and one practical takeaway, is far more effective than a full-day session once a year.
- Create a no-blame reporting culture. Employees who click a suspicious link often say nothing out of embarrassment. That silence turns a recoverable incident into a full breach. Staff should feel safe reporting immediately without fear of consequences.
- Apply the same standards to third parties. As the M&S breach showed, contractors with system access carry the same risk as employees. Ensure the organisations you work with hold their staff to the same security standards you apply internally.
- Pair training with technology. Human awareness reduces risk significantly. But it works best alongside technical controls like MFA, email filtering, and endpoint protection. Neither replaces the other.
Security is not something that happens to your business. It is something your business either builds or leaves to chance. Organisations where every person understands their role in keeping the front door closed are significantly harder targets than those relying on technology alone.
--- Find out where your human risk gaps are — in 2 minutes
Our interactive Security Awareness Risk Meter asks 6 questions and maps your specific gaps directly to the solutions that close them such as CSAT, EDR, or email security. No generic scores. Just a clear picture of what you are missing and what fixes it.