Where do 90% of all cyber incidents begin?

Where 90% of all cyber incidents begin is with phishing and human error, according to data from Australian Cyber Security Centre, Verizon Data Breach Investigations Report and other global studies. The statistic commonly quoted is that 82% to 91% of cyber incidents, including data breaches, ransomware and business email compromise, start with a phishing email where an employee clicks a malicious link or opens a malicious attachment. In Australia, the ACSC reported that phishing is the most common cybercrime type, with over 30% of cybercrime reports being phishing, and Business Email Compromise losses exceeding $100M per year. The reason 90% begin with human factor is that attackers find it easier to trick a person than to hack technical defences. Typical attack chain is an employee receives an email that looks like it is from Microsoft 365, ATO, MyGov, or a supplier, clicks link to fake login page, enters credentials, attacker then gains access to email account, then uses that to send more phishing or to commit invoice fraud. Other human error beginnings include weak passwords, using same password across sites, not enabling multi-factor authentication, and misconfigured cloud storage. Verizon DBIR 2023-2024 found 74% of breaches involved human element including phishing, use of stolen credentials and errors. That is why Australian Cyber Security Strategy emphasizes training, multi-factor authentication, and why 90% figure is used to highlight need for cyber awareness training and email filtering.