Smaller One is the Biggest...

There are two ways to hide yourself - to hide and be quite or to be in a crowd.

I think the same can be said about security risks in IT. Usually we hear about huge attacks, when companies lose a lot of money. Everyone talks about them. Companies send new regulation to workers and so on, and so on... As result we taught to withstand huge and separate attacks on corporations.

From the other side, there is a silent enemy, which is everywhere and basically we do nothing with it. It is so common for us to get SPAM messages, calls, offers to invest money into International Corporation of Nothing, promises of huge income, which we can't imagine and wan't see, proposals to install new super-tool and win a lottery, that a part humanity(which more or less educated in IT) don't even react on such mails and calls, while another part is looking for some luck.
Therefore the amount of victims grows every year and this evident enemy holds positions.
(spam and phishing reports).
Funny to say, but even our employers think that biggest problem for IT security is not massive attack but workers (5 risks for businesses), with our common for whole people curiosity and belief in something better.

The bottleneck of security for such issue in my opinion is not technology. As per today, the filters built in in browsers, servers, e-mail servers and even phones (i.e. Google messages offers automatic SMS filter and some of vendors offers calls block also) have very good level of filtration. I don't remember the date when spam arrived into my mailbox directly (not in SPAM folder),... the mail server at work have some issues with filtration, but still the level is good. The weakest point in security is us and it could be fixed by two ways only: to teach us and give rights to improve filters, settings and etc.,  or restrict our rights in systems. This is the case when the cheapest way to restrict is not the best one. More restrictions we have - more will to break them arises.(why do we), also latest Windows builds give us opportunities to bypassing restrictions (without breaking them), and if I can, then why the script from some attachment can't? The more expensive, but more reliable is to teach users. At first is to teach about personal and social responsibility, at second - about weapons of this enemy and methods to protect our data and wares.

Some fights are won by knowledge.