0.1Why cybersecurity concerns every employee
The essentials in 30 seconds
- Over 80% of successful cyberattacks exploit a human error (click, weak password, manipulation) — technology alone is never enough.
- They don't attack “you”, they attack “through you”: your account is a gateway to others (trapped message sent in a colleague's name).
- What is at stake is keeping the business alive: an SME hardly recovers from ransomware, the No. 1 threat to organisations — and good reflexes can be learned.
Threaded mini-case — Karim discovers his attack surface
Karim, an office employee in Algiers, thought cybersecurity was only the IT department's business: he handles “nothing sensitive”. Listing his professional accounts (email, business application, cloud), he discovers he uses the same password everywhere — and that his email address has already leaked. That day he understands he is both a target and a defense, and notes his 3 weak points to address in the following levels.
Standalone case for this section: it returns in the lesson, the diagram, the script and the 48h challenge of section 0.1.
1. A topic no longer reserved for IT
Cybersecurity is no longer the exclusive business of the IT department. According to the ANSSI, over 80% of successful cyberattacks exploit a human error: a weak password, a click on a trapped link, an attachment opened too quickly, a password shared by phone. Karim verified it on his own workstation: every duplicated password is an open door. Every employee is now a potential target — and each of their actions is either a link of protection or a gateway.
2. “They don't attack you, they attack through you”
Your account is a gateway to others: an attacker controlling your mailbox traps your colleagues in your name. This is the attack surface: all your accounts, emails, devices and applications — and you are part of it. Karim understood why his mailbox account, even with “nothing sensitive in it”, interests an attacker: it gives access to the whole office address book.
3. The stake: keeping the business alive
An SME hardly recovers from ransomware (the No. 1 threat to French organisations): encrypted files, blocked activity, ransom demanded. The stake is keeping the business alive, not comfort. Good news: good reflexes can be learned — that is the purpose of the 6 levels of this guide. Karim's 5-minute diagnosis is the starting point: measuring his own exposure for concrete motivation.
🔎 Concrete example — 🔎 Concrete example — Measuring your own exposure
List your professional accounts (email, business apps, cloud).
Count those sharing the SAME password (each duplicate = risk).
Test your email on haveibeenpwned.com (has it leaked?).Takeaway: Karim finds two duplicates and one leak: his diagnosis takes 5 minutes.
Lesson: note your 3 weak points, addressed level by level in this guide.
Section vocabulary
- Cybersecurity
- All the practices that protect systems, data and people against computer attacks — at the office as when working remotely.
Simple example: Karim locks his session, checks his senders and reports suspicious messages: he is doing cybersecurity.
What it is not: a topic reserved for the IT department that employees can ignore.
Reflex: before each digital action, ask “does this protect or expose?”.
- Attack surface
- Everything through which an attacker can get in: accounts, emails, devices, applications — every employee is part of it.
Simple example: Karim lists his professional accounts: that is his personal attack surface, with two password duplicates.
What it is not: only the company's servers, with no link to employees' workstations.
Reflex: list your accounts and reduce password duplicates.
- Human link
- The fact that over 80% of incidents involve a human action (click, weak password, manipulation): technology alone is never enough.
Simple example: Karim understands his click is worth as much as the antivirus: he is the link that decides.
What it is not: believing a good antivirus removes the need for any personal vigilance.
Reflex: treat every click and every password as an act of defense.
- Ransomware
- Software that encrypts company data and demands a ransom: the No. 1 threat to French organisations.
Simple example: Karim pictures the office folders encrypted and activity blocked: that is why this guide starts here.
What it is not: a simple virus that slows down the PC with no consequence for the business.
Reflex: remember that defense starts with reflexes (passwords, phishing, backups).
In practice — In practice — Measure your own exposure in 5 minutes
- List your professional accounts (email, business applications, cloud): that is your personal attack surface.
- Count those sharing the same password — each duplicate is an open door.
- Check whether your email address has leaked: type it into the “Have I Been Pwned” service (haveibeenpwned.com).
- Note your 3 weak points: they will be addressed one by one in the following levels.
Ready-to-say script — explain to a colleague why they are concerned too (30 s)
“People think cyber is for IT, but over 80% of attacks go through a human error: a click, a reused password. Your account is a gateway to others. I listed my accounts and noted my 3 weak points — do the same, it takes 5 minutes.”
Say it with your own example (the duplicates found); follow with the 5-minute diagnosis.
Copy-paste template — my starting diagnosis
MY PROFESSIONAL ACCOUNTS (email, apps, cloud): _______________
PASSWORD DUPLICATES: _______________
HAS MY EMAIL LEAKED (haveibeenpwned.com): _______________
MY 3 WEAK POINTS TO ADDRESS: _______________VSE / tight budget
With no IT department: the diagnosis fits on one sheet — list of accounts, duplicates to eliminate first on email, note of the 3 weak points displayed in the office.
SME in Algeria
Karim shares his diagnosis with his colleagues in the office in Algiers: everyone lists their accounts and names their No. 1 weak point, addressed together through the levels.
Remote work
At home: add to the diagnosis the home Wi-Fi network and the personal devices accessing professional accounts — the attack surface extends to the home.
New joiner
First week: do the diagnosis before even receiving all accesses — email first, then each application as accounts are created.
✓ Best practices
- Handle your critical accounts first (email, banking, professional account).
- Treat every account as a gateway to others.
- Remember: security is everyone's business, not just IT's.
✗ Common pitfalls
- Believing you are not a target “because you handle nothing sensitive”.
- Thinking that only large companies are targeted (VSEs/SMEs first).
- Waiting to become a victim before caring about the topic.
Key takeaways
- Cybersecurity is not an IT topic: every employee is a target and a defense.
- The vast majority of successful attacks go through a human action, not a technical feat.
- An SME hardly recovers from ransomware: the stake is keeping the business alive, not comfort.
- Good reflexes can be learned: that is exactly the purpose of the 6 levels of this guide.
48h Challenge - apply tomorrow
Do your 5-minute diagnosis like Karim: list your professional accounts, count the password duplicates, test your email on haveibeenpwned.com and note your 3 weak points. Start by changing your mailbox password.
- I can explain why every employee is both a target AND a defense.
- I have listed my accounts and counted my password duplicates.
- I have noted my 3 weak points to address in the following levels.
Frequently asked questions
I handle nothing sensitive, why would I be targeted?
Because they don't attack “you”, they attack “through you”: your account is a gateway to others. An attacker controlling your mailbox sends trapped messages to your colleagues in your name — with your credibility. Your address book, your accesses to shared applications, your ability to ask a colleague for a transfer or a document: all of this has value for an attacker, even if your own files seem harmless. Like Karim, treat every account as a gateway to others, and handle your critical accounts (mailbox first) first.
Don't attacks mainly concern large companies?
No: VSEs/SMEs and local authorities are the top victims recorded by Cybermalveillance.gouv.fr — less protected, they are easier targets. Ransomware that would paralyse a large group for a few days can shut down an SME for good: no backups, no dedicated team, fragile cash flow. Attackers know this and industrialise their attacks against small organisations. Size does not protect — reflexes do. That is why this guide addresses every employee, whatever their position: collective defense starts at Karim's desk as much as in the boardroom.
What proportion of successful cyberattacks exploits a human error?