Risk mitigation and workforce development in digital transformation: Human factor in cybersecurity (Part 2)

Employees are often the first line of defence in cybersecurity. Human error remains one of the most common vulnerabilities – think of malicious emails being opened or confidential data mishandled. At the same time, well-trained employees can become a highly reliable defensive layer in the ongoing cat-and-mouse game of cybersecurity.

1. Engagement and risk awareness

Digital transformation is not just about renewing systems – it fundamentally reshapes people’s roles. In finance, employees are moving away from repetitive spreadsheet-based tasks towards more strategic decision-support roles [1]. In other words, digital transformation is as much about cultural change as it is about technology.

Employees must not only learn to use new tools but also understand the strategic significance of the change: why transformation matters, what benefits it brings, and what new responsibilities it creates. However, engagement alone is not enough – every new system introduces new potential for mistakes.

The key lies in ensuring employees are both engaged and risk-aware. Organisations that run regular awareness trainings significantly reduce the likelihood of successful phishing attacks and internal security incidents [2]. With the right preparation, employees are able to identify threats, report them, and most importantly, follow security protocols. In this way, staff become more than technology users – they are part of the organisation’s control environment, providing a human layer of defence that complements technological safeguards.

2. Employees as active security participants

In accounting and payroll teams, staff form the first defensive layer against cyberattacks and data loss. Cybersecurity statistics consistently show that most incidents still originate from human error – for example, poor password practices, weak access controls, or falling victim to phishing emails.

This makes it essential that employees play an active role in risk mitigation: they should understand security protocols, know how automated controls work, and remain alert to suspicious indicators. But how can employees be turned into active participants in transformation?

Cybersecurity during digital transformation is not solely the responsibility of IT departments or roles such as the CISO or DPO [3] – every employee contributes to protection. Building a genuine security culture goes beyond traditional training: staff must be embedded into the first line of defence and understand, throughout the transformation process, that their decisions directly impact organisational security. Practical measures include:

• Scenario-based exercises: Regular simulations (e.g., phishing tests or data breach scenarios) where employees practise responding to realistic threats.
• Ambassador programmes: Appointing and supporting colleagues who are enthusiastic about digital tools and can champion everyday security practices among peers. These roles can be aligned with existing ambassador programmes (e.g., AI Ambassadors) with an additional focus on cybersecurity awareness.
• Two-way feedback channels: Simple mechanisms (such as anonymous reporting tools) that allow staff to quickly flag suspicious activity or potential vulnerabilities.
• Microlearning modules: Short, focused digital training sessions that address specific topics (e.g., “How to identify a suspicious email”) and can be completed alongside daily tasks.

This approach not only reduces security risks but also drives innovation and engagement: employees stop being passive “users” and become active partners in building digital resilience.

Conclusion

Across this two-part analysis, we have examined both sides of digital transformation:

• Part 1 explored the risk management and technological frameworks.
• While this part highlighted the human factor and its security role.

Technology may enable digital transformation – but people are what make it succeed. The success of transformation depends not only on tools, but on human factors. Algorithms can detect anomalies, but they cannot provide context – that remains a uniquely human capability.

The most successful digital initiatives are born where automation complements, rather than replaces, human intelligence. The future of accounting and payroll services will be shaped at the intersection of secure automation and human insight. Organisations that recognise the need to prioritise proactive action over reactive fixes, and embed security from the design phase onward, will gain a true competitive advantage.

While this two-part series concludes one line of discussion, the topic is far from exhausted. In future articles, we will continue to examine the intersection of cybersecurity and digital transformation, share best practices, and highlight further insights worth exploring.

*  *. *

[1] Trintech: The Rise of Digital Risk & Digital Risk Management in the Office of Finance

[2] Verizon Musiness: 2025 Data Breach Investigations Report

[3] CISO = Chief Information Security Officer; DPO = Data Protection Officer

 

Read the relevant Part 1 article:
Risk mitigation and workforce development in digital transformation: A dualperspective analysis (Part 1)

 

Relating PS Blog posts:

What are the most common cybersecurity threats faced by accounting firms? Part 1
What are the most common cybersecurity threats faced by accounting firms? Part 2
Hidden risks of information security and data protection in accounting and payroll services
Accounting and payroll outsourcing in the focus of information-security

Click here for more PS Blog posts
about the most actual questions of accounting and payroll outsourcing