In the latest annual review of more than 12,000 confirmed data breaches, a person was involved in around 60 percent of them. Someone clicked, reused a password or sent a file to the wrong recipient. The figure comes from the 2025 Data Breach Investigations Report, and it explains why IT security in the workplace largely comes down to what employees do on a busy Monday morning.
This list is written to be shared with colleagues. It follows the same themes as the modules in our cyber security programme, and every habit can be adopted without help from the IT department.
Access and devices
1. Use long passwords, and use each one in a single place
A sentence of four or five words is easier to remember and harder to guess than “Summer2026!”. What matters most, though, is that the password is used in one place only. When a webshop is hacked, criminals try the leaked passwords on work email and other services. A password manager handles the rest, so nobody has to remember 40 different passwords.
2. Turn on two-step login wherever you can
With two-step login, a stolen password is not enough to get in. It is one of the seven pieces of IT security advice that the Danish Business Authority and the Agency for Digital Government give all companies. If you receive an approval request on your phone that you did not ask for, decline it and tell IT.
3. Lock your screen every time you get up
Windows key + L on a PC, Ctrl + Cmd + Q on a Mac. It takes a second, and it applies in the office too, where tradespeople, guests and couriers pass through.
4. Install updates the same day
Most updates close gaps that are already known to the people looking for them. Three weeks of “remind me tomorrow” means three weeks with the door open.
Email, messages and sharing
5. Pause at urgent requests and changed account numbers
Scam messages today look like ordinary emails from a manager, the bank or a supplier, and many are written in flawless language. Spelling mistakes are rarely the giveaway. Pressure is: pay now, log in now, tell no one. Call the sender on a number you already know before you do anything. We have written more about AI phishing that sounds like your boss.
6. Check the recipient before you press send
According to the Danish Data Protection Agency’s guide to the 10 typical breaches, most reported personal data breaches concern information that was unintentionally shared with the wrong recipient. Autofill is happy to pick the wrong Mette. Look at the recipient field and the attachment one more time, especially when the content is about people.
7. Share through the systems your company has chosen
Private file-sharing services and free AI tools are fast, but the company loses track of where the files end up. If you are unsure whether a tool is approved, ask. It is a better question than the one that comes afterwards.
Outside the office
8. Treat home, trains and cafés as open spaces
Use the company VPN on unfamiliar networks, and choose your phone’s hotspot over café wifi. Think about your screen on the train and your phone call in the airport as well. The person next to you does not need to hack anything to read along.
9. Keep work and private life apart
Work email does not belong on the family iPad, and private USB sticks do not belong in a work laptop. The same goes for social media: a photo from the office can show a screen, a whiteboard or an access card that was never meant for the public.
When something goes wrong
10. Say it straight away
This habit matters most, and it is the hardest one. If you have clicked on something you should not have, lost a phone or sent a file to the wrong person, tell IT or your manager immediately. If personal data is affected, the company generally has 72 hours to report the breach to the data protection authority, and those hours start counting when someone in the organisation discovers it. A quick message makes it possible to block an account before it is misused.
That requires management to respond well to the person who speaks up. If an employee is told off for reporting a mistake, IT will not hear about the next one.
From list to habit
A list on the intranet changes little on its own. Habits come from repetition and from examples employees recognise from their own working day. A sales rep working from the car needs different examples than a bookkeeper approving invoices.
That is why the scenarios in our training in basic IT security can be adapted to your own working day. The content is quality-assured by subject-matter experts and developed by our learning designers. To see what that looks like in practice, read about the IT security course for Jeudan or contact us.
