Cybersecurity experts who focus solely on technology may be looking for threats in the wrong place, as the transition to hybrid and fully remote work environments has significantly heightened the human risk, according to a report from SANS Security Awareness.

"People have become the primary attack vector for cyber-attackers around the world," said Lance Spitzner, security awareness director for the cybersecurity training provider. "Humans rather than technology represent the greatest risk to organizations, and the professionals who oversee security awareness programs are the key to effectively managing that risk."

Two factors drive the increase in human-based risk: Organizations are not recruiting outside security awareness talent, and hackers are aware of organizations' increased human risk and take advantage of this weakness by creating sophisticated attacks that even the most advanced security software cannot detect.