According to IBM's 2025 Cost of a Data Breach Report, 74% of all breaches involve a human element — phishing, stolen credentials, social engineering, or simple human error. Technical security controls — firewalls, endpoint detection, SIEM platforms — are essential, but they cannot fully compensate for a workforce that does not know how to recognise and respond to threats designed to exploit human psychology rather than technical vulnerabilities.

Proofpoint's 2025 State of the Phish report found that 96% of organisations surveyed experienced a successful phishing attack in the previous year. In India specifically, phishing campaigns mimicking SBI, HDFC Bank, and the Income Tax Department are among the most prevalent — using urgency, authority, and familiarity to bypass technical filters and manipulate users into disclosing credentials or authorising fraudulent transactions.

Business Email Compromise — a sophisticated form of social engineering in which attackers impersonate vendors, executives, or banks to redirect payments — cost Indian businesses an estimated ₹1,800 crore in 2024 according to cybercrime bureau data. The attacks succeed not because of technical failure but because a finance team member was deceived by an email that appeared credible.

Organisations that have built genuine security cultures — where employees feel responsible for security, know what suspicious activity looks like, and have a clear path to report it without fear of blame — experience measurably fewer successful social engineering attacks than those that treat security awareness as an annual compliance video. Regular phishing simulations, role-specific security training, gamified awareness programmes, and clear escalation procedures are not expensive. The breaches they prevent are.