Phishing and Leadership Blind Spots: Why 77% of Security Heads Could Be Firing the Wrong People

Phishing and Leadership Blind Spots: Why 77% of Security Heads Could Be Firing the Wrong People

A major new report by Arctic Wolf has revealed an uncomfortable truth about workplace Cybersecurity. While 77% of IT and security leaders say they would dismiss employees who fall for phishing scams, nearly two-thirds admit they’ve clicked phishing links themselves. For Small & Medium Enterprises (SMEs), this highlights a critical issue of leadership culture and misplaced confidence — a combination that can make smaller organisations even more vulnerable to Cyber threats.

Why This Matters for SMEs

Phishing remains one of the most successful tools for cybercriminals because it exploits human trust rather than technical systems. Arctic Wolf’s findings show that when senior leaders take a punitive approach, it can discourage honest reporting and delay response times. Overconfidence in existing defences, inconsistent training schedules, and the selective application of multi-factor authentication (MFA) further compound the problem. Some leaders even admit to disabling security tools in the name of efficiency, unintentionally opening new attack paths. For SMEs with limited IT staff and smaller budgets, these behaviours can magnify risk dramatically.

Authoritative Insight

Arctic Wolf’s Human Risk Behavior Snapshot 2025 surveyed more than 1,700 IT leaders and employees across 17 countries. The data reveals a clear mismatch between perception and reality: 76% of IT leaders believe their organisation would never fall for a phishing attack, yet 65% have done so themselves. Seventeen per cent failed to report it afterwards. Only 54% of organisations enforce MFA for all accounts, and over half of leaders have intentionally turned off security measures. According to the UK’s National Cyber Security Centre (NCSC), phishing remains the top cause of business email compromise and ransomware incidents — underlining the importance of continuous awareness and layered protection.

SME-Specific Impact

For Small & Medium Enterprises, leadership culture can directly determine Cyber resilience. SMEs rarely have the luxury of large security teams, so a single error by a senior staff member can compromise the entire business. When leaders overestimate their security maturity or ignore best practices, it reduces investment in essential training and discourages openness among employees. In smaller organisations, where trust and communication are vital, this can quickly become a systemic weakness.