Everyone else is the target

In any organisation, privacy is often seen as the responsibility of IT and security teams.

But the truth is, everyone can be a target—whether you're a board member, project manager, executive assistant, or senior leader working on a confidential initiative. ​

Criminals, whether cyber or otherwise don’t just aim for the obvious entry points; they exploit human nature, trust, and access at every level in the business. So why do some businesses think these threats won’t happen to them?

It’s a psychological phenomenon known as optimism bias, where individuals overestimate their organisation’s security posture and underestimate their vulnerabilities. Here's some of the reasons people think 'it won’t happen to me':

1. Confidence in existing security measures

Employees might believe their organisation has invested so heavily in cybersecurity tools, training, and frameworks that they are immune to attacks.​

2. Underestimating personal risk

Overconfidence can lead individuals to believe they aren’t an attractive target compared to others, making them more likely to let their guard down.​

3. A false sense of security

If an organisation has never experienced a significant data breach, employees may think their size or industry makes them less appealing to attackers.​

4. Industry perception

Employees might assume that competitors, high-profile companies, or government entities are bigger targets, leading them to neglect their privacy practices.​

5. No previous incidents

A clean track record can breed complacency, making employees feel safe from potential threats.​

6. Shifting the target

Some individuals assume attackers go after 'low-hanging fruit'—less secure organisations—leaving them untouched.​

7. A critical imperative​

Something new to the organisation such as a merger or acquisition means wider individuals are working on projects that are unique and may fall outside a business’s usual protected environment.

Why this mindset is dangerous

The reality is that privacy breaches and cyber threats can affect anyone within an organisation. Believing otherwise can expose your business to significant risks, such as:

• Evolving threats: Attackers are constantly refining their techniques, exploiting even the smallest weaknesses.​
• Human error: No matter how strong security measures are, mistakes such as sending an email to the wrong person or clicking on a malicious link can still happen.
• Supply chain vulnerabilities: A weak link in your vendor network can become an open door to sensitive data.​
• Targeted attacks: Well-protected companies are not off the radar—some attackers view them as high-value challenges worth pursuing and go to many lengths to exploit them through monetary extortion or competitive advantage.

How to counteract overconfidence

To protect both individuals and the organisation as a whole, a culture of continuous vigilance must be adopted:

• Assume you are a target: Every employee should operate under the assumption that their information is valuable and could be targeted at any time.​
• Stay aware and informed: Regular training and privacy awareness programmes should keep employees up to date with the latest threats.​
• Use secure communication tools: Ensure that all sensitive business communications are conducted in contained, secure environments.​
• Encourage reporting: Foster an open environment where employees feel comfortable reporting potential privacy concerns without fear.

Real-world examples

While it’s rare for employees to openly express overconfidence, it can manifest in subtle ways—ignoring security protocols, sharing sensitive information over unsecured channels, or assuming someone else is handling privacy concerns. However, privacy-conscious organisations actively work to instil a mindset that prioritises security at all levels.

Final thoughts

Whether you're managing a high-profile project or handling day-to-day operations, privacy isn't just an IT issue—it's everyone’s responsibility. The best way to ensure sensitive information remains protected is to embrace privacy as a shared value and take proactive steps to contain and secure communications. Because in today's world, everyone is a potential target.