The most common cyber security mistakes and how to avoid them

Over the years, I’ve reviewed a lot of security incidents, and something struck me early on: the vast majority of them didn’t involve some brilliant, novel exploit. They involved the same handful of mistakes, repeated over and over, across organizations of every size. In this article, I want to walk through the most common cyber security mistakes I keep seeing, explain why they happen, and give you concrete, practical ways to avoid them.

Why the Same Mistakes Keep Happening

Before diving into the list, I think it’s worth asking why these mistakes are so persistent. In my experience, it comes down to three things: security often feels invisible until it fails, the fixes are frequently seen as inconvenient, and there’s a widespread assumption that “it won’t happen to us.” None of these are unique to any particular industry — I’ve seen the exact same patterns in hospitals, retail shops, and software startups alike.

Mistake 1: Weak and Reused Passwords

This is still, year after year, one of the top root causes in breach reports. People reuse passwords across personal and work accounts, which means a breach at an unrelated service — say, a forum you signed up for years ago — can hand attackers valid credentials for your work email through credential stuffing.

How to avoid it:

• Use a password manager (Bitwarden, 1Password, KeePassXC) to generate and store unique passwords per account
• Enforce a minimum password policy aligned with NIST SP 800-63B, which now recommends length over complexity and discourages forced periodic changes without cause
• Check exposed credentials against breach databases like Have I Been Pwned

# Example: checking a password hash against HIBP's k-anonymity API
curl -s "https://api.pwnedpasswords.com/range/$(echo -n 'examplepass' | sha1sum | cut -c1-5 | tr a-z A-Z)"

Mistake 2: Skipping Multi-Factor Authentication

Passwords alone are simply not enough anymore. MFA blocks the overwhelming majority of automated account takeover attempts even when a password has already been compromised, yet a lot of small and mid-sized organizations still don’t enforce it, especially on email and admin accounts.

How to avoid it:

• Require MFA on all accounts with administrative or financial access at minimum
• Prefer app-based authenticators (TOTP) or hardware keys (FIDO2/WebAuthn) over SMS, which is vulnerable to SIM-swapping
• Enforce MFA at the identity provider level (Azure AD, Okta, Google Workspace) rather than per-application

Mistake 3: Delayed Patching

Unpatched software remains one of the most exploited weaknesses in the wild. The 2017 Equifax breach is the textbook example — a patch for the exploited Apache Struts vulnerability had been publicly available for months before attackers used it.

How to avoid it:

• Establish a patch management cadence (critical patches within 72 hours, others within 30 days)
• Use vulnerability scanners (Nessus, OpenVAS) to identify unpatched systems proactively
• Subscribe to CVE feeds relevant to your tech stack

# Example: checking installed package versions against known CVEs using a scanner like Trivy
trivy image myapp:latest

Mistake 4: Poor Backup Practices

I’ve seen organizations that “had backups” only to discover during a ransomware incident that the backups were also encrypted because they were stored on the same network, or that nobody had tested a restore in over a year.

How to avoid it:

• Follow the 3-2-1 backup rule: 3 copies, on 2 different media types, with 1 copy offsite/offline
• Test restores quarterly, not just backup completion
• Keep at least one backup copy immutable or air-gapped so ransomware can’t reach it

Mistake 5: Overprivileged Accounts

Giving every employee administrative rights “for convenience” massively increases the blast radius of any single compromised account. If a regular employee’s account has domain admin rights, a single phishing click can turn into a full network compromise.

How to avoid it:

• Apply the principle of least privilege: give users only the access their role requires
• Use separate accounts for daily work and administrative tasks
• Regularly audit account permissions and remove access for former employees promptly

Mistake 6: Ignoring Phishing Awareness

Technical controls can’t stop every phishing email from landing in an inbox, which makes human awareness a critical layer. Yet many organizations run a single onboarding training and never revisit it.

How to avoid it:

• Run periodic, realistic phishing simulations
• Teach specific red flags: urgency, mismatched sender domains, unexpected attachments, requests to bypass normal approval processes
• Establish a simple, blame-free reporting process so employees report suspicious emails instead of hiding mistakes

Mistake 7: Misconfigured Cloud Storage

Publicly exposed S3 buckets, open Elasticsearch instances, and misconfigured Azure Blob Storage containers have led to some of the largest data exposures on record, often without any “hacking” involved at all — the data was simply left unlocked.

How to avoid it:

• Default all cloud storage to private, then explicitly allow public access only where genuinely needed
• Use automated configuration scanning tools (AWS Config, Scout Suite, Prowler)
• Enable logging on storage access to detect anomalous access patterns

Mistake 8: No Incident Response Plan

When an incident happens without a plan, the response is often chaotic: nobody knows who to call, systems get shut down or rebooted in ways that destroy forensic evidence, and communication with customers is delayed or mishandled.

How to avoid it:

• Write a simple incident response plan covering: who to notify, how to preserve evidence, how to isolate affected systems, and communication templates
• Run a tabletop exercise at least annually
• Align your plan loosely with NIST SP 800-61 (Computer Security Incident Handling Guide)

Mistake 9: Neglecting Logging and Monitoring

Many breaches go undetected for months, not because attackers are flawless, but because nobody was watching the logs. The median dwell time before detection in many annual breach reports is still measured in weeks or months.

How to avoid it:

• Centralize logs from critical systems (SIEM tools like Wazuh, Elastic Security, or Splunk)
• Set alerts for anomalous behavior: failed logins, unusual data transfers, new admin accounts
• Retain logs long enough to support investigation (typically 90+ days minimum)

Mistake 10: Treating Security as a One-Time Project

Security isn’t a checkbox you tick once. Threats evolve, software changes, employees come and go, and a security posture that was solid a year ago can quietly decay without ongoing attention.

How to avoid it:

• Schedule recurring security reviews (quarterly at minimum)
• Reassess your risk profile whenever your business changes significantly (new vendors, new systems, new data types)
• Treat security budget as an ongoing operational cost, not a one-time capital expense

Anatomy of How These Mistakes Chain Together

flowchart TD
    A[Weak/reused password] --> B[Credential stuffing succeeds]
    B --> C[No MFA blocks the login]
    C --> D[Attacker gains account access]
    D --> E[Overprivileged account grants wide access]
    E --> F[No monitoring means breach goes unnoticed]
    F --> G[No tested backups means<br/>ransomware recovery fails]
    G --> H[Full business disruption]

This is the pattern I see most often: it’s rarely one mistake that causes catastrophic damage — it’s several mistakes stacked together, each removing a layer of defense that could have stopped the chain earlier.

Comparing Mistake Severity and Fix Cost

Mistake 11: Ignoring Mobile Device Security

I want to add one more mistake I see constantly overlooked: treating mobile devices as outside the scope of a security program. As more work happens from phones and tablets, especially in bring-your-own-device (BYOD) environments, unmanaged mobile devices become a significant blind spot. A phone with no screen lock, an outdated OS, or a sideloaded app from outside official app stores can be just as damaging an entry point as a laptop.

How to avoid it:

• Require a Mobile Device Management (MDM) solution for any device accessing company email or data
• Enforce screen lock, encryption, and remote wipe capability as baseline requirements
• Restrict app installation to official app stores, and educate staff on the risks of sideloading

Mistake 12: Underestimating Vendor and Third-Party Risk

Many organizations invest heavily in securing their own systems while giving little scrutiny to the vendors and contractors who have access to those same systems. The Target breach referenced earlier is the canonical example — a third-party HVAC vendor’s compromised credentials became the entry point into Target’s broader network because vendor access wasn’t properly segmented from sensitive systems.

How to avoid it:

• Maintain an inventory of all third parties with access to your systems or data
• Require vendors to meet a minimum security baseline before granting access, and review that baseline periodically
• Segment vendor access strictly to only what’s needed, following least privilege even for trusted partners

A Note on Why “It Won’t Happen to Us” Persists

I want to close this list with a brief reflection on why these mistakes are so persistent despite being well documented for years. Psychologically, this resembles what behavioral economists call “optimism bias” — the tendency to underestimate the likelihood of negative events happening to us personally, even while acknowledging they happen to others. In cyber security specifically, this bias is reinforced by the fact that most security investments are invisible when they work. A firewall that blocks an attack doesn’t announce itself; a backup that’s never needed doesn’t generate a success story. This asymmetry — visible cost, invisible benefit — makes it psychologically easy to deprioritize security investment until an incident makes the cost of not investing painfully visible.

Recognizing this bias explicitly, both for yourself and your team, is a small but genuinely useful step toward taking these fundamentals seriously before an incident forces the issue.

FAQs

Which single mistake causes the most damage? It varies by incident, but poor backup practices combined with no MFA consistently appear together in the most damaging ransomware cases, because they remove both prevention and recovery options at once.

Are these mistakes only relevant to large organizations? No — if anything, small organizations are more likely to have several of these gaps simultaneously due to limited dedicated security staff.

How often should we review our security posture? At minimum quarterly, and immediately after any significant business change like a new vendor integration, office move, or major software adoption.

Is fixing all of this expensive? Most of these fixes (MFA, password managers, patch cadence, least privilege) are low-cost policy and process changes rather than large capital investments.

Summary and Recommendations

The mistakes covered here aren’t exotic — they’re the same handful of gaps that show up again and again in breach reports across every industry. The good news is that fixing them doesn’t require a massive budget, just consistent attention: enforce MFA, manage passwords properly, patch promptly, back up correctly, limit privileges, train your people, and monitor what’s happening on your network. Get these fundamentals right, and you’ll have already closed off the paths most attackers rely on.

Further reading:

• NIST SP 800-63B (Digital Identity Guidelines): https://pages.nist.gov/800-63-3/sp800-63b.html
• NIST SP 800-61 (Incident Handling Guide): https://csrc.nist.gov/pubs/sp/800/61/r2/final
• Verizon Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/
• Have I Been Pwned: https://haveibeenpwned.com/