What security threats do you experience the most?

The biggest security threat or vulnerability we are exposed and actually affected by the most are the end users themselves. As a point of clarification I deal exclusively with enterprise line of business devices that are shared. Examples include inventory management devices in warehouses and retail stores, point of sale registers, kiosks, digital signage, etc. The end users leveraging these devices are often the biggest threat that we have to manage. There is a never ending battle to keep these end users off non-productive websites and apps like Youtube, Chrome, etc in order to keep them on task on on their business apps only. This is a constant struggle as these end users have a lot of time on their hands interacting with these devices in order to come up with creative workaround. Think for example a warehouse worker that might be interacting with their device 8-10 hours a day every single week. These users find ways to break out of lockdowns and access websites, apps, and settings that they shouldn't. One of the most frustrating examples is when there is some sort of privacy policy linked within an app that launches out to Chrome, or an in app webview with an editable URL bar. A classic example of this is the stock Calculator app. We provided end users access to this app for legitimate business reasons until we figured out they were accessing the privacy policy which was linking them out to Chrome which led them to get out to the internet. Ironically it was therefore Google itself making our devices more insecure and vulnerable to attack. Why a calculator needs a privacy policy is beyond me. 

Either way, I have dealt with countless weekly incidents of end users abusing their devices and working around restrictions. Far far more issues than the ones people seem to pay more attention to. The calls are coming from inside the house, so to speak.

I agree with @mattdermody in that the biggest threat is people - mostly staff/admin of systems that themselves are not security specialists and just don't understand the problems. Whether it is them falling for a phishing scam, using weak passwords (pets names) or using unsecured networks (hotels, airports, coffee shops etc). And its not just digital security they need to think about. Just the other week I was in a local coffee shop next to a table of people I knew worked in a local solicitors office opening telling, what I assume was a new starter, the pin code for the digital lock on the office back door. Now I am just one step away from physical access to their computers and every step nearer to hardware makes the job easier for someone wanting to do harm.

As engineers we can do all sorts to protect the system we are creating - yes we can make mistakes, but we can also acknowledge that and offer bounties, use 3rd party testers etc to keep testing our defences. What we don't have much control over is stupidity - at least not without making the system an absolute nightmare to access for users!

Such an interesting topic! And like others have said, there’s really only one answer: people. When it comes to security, they’re the weakest link.

You can enforce complex passwords, but they’ll write them down on a sticky note. Make them simpler, and they’ll choose something easy to remember (and easy to guess). Add a number requirement? They’ll just tack on a “1.” Ask for a new password later? It becomes the same one with a “2.” People really are the gift that keeps on giving.

I don’t have much to add to what’s already been said about us simple creatures.

But let me offer another angle. A growing concern I see among customers is the targeting of specific individuals within an organization. For example: a CEO travels to a country that’s considered questionable from an EU perspective. On the way back, a security officer pulls them aside at customs. Their smartphone, tablet, and laptop are handed over and disappear behind a closed door.

Eventually, the devices are returned with a casual “everything’s fine.” That’s the moment to worry. There is a big chance they have isntalled something on the devices to track its movements or actions on the OS. Once home, those devices should be wiped—or better yet, trashed. They can no longer be trusted in a corporate environment.

Then there’s the janitor or cleaning crew—people with legitimate access to secure areas. Tracking their phones to identify sensitive locations is a real risk. Banning personal phones helps, but there’s always a loophole. People will always try to do what they’re not supposed to.

This is becoming a real issue for more and more companies on the NIS2 directive list. I’m hearing these stories far too often. And honestly, there’s not much you can do—except travel with hardware that can be shredded on return. Some vendors offer tools to check device integrity or add layers of encryption, but it’s still a rising concern.

I can terrifying 100% agree to this from @mattdermody : "The biggest security threat or vulnerability we are exposed and actually affected by the most are the end users themselves."

But those sometimes are the result of IT handling passwords. They need to be too complicated, changed too often,... yeah sounds strange from security side but look at the results:

• users note down passwords on easy to see/find locations
• users store passwords in cleartext somewhere
• users always try to use still somehow "readable" passwords (like: Id0ntl1ke!t)
• ...

Which may finally less secure than using strong passwords (ofc) but somehow easy to remember and not too often to be changed and even better maybe make the use of MFA as much as possible (today i think this should be a minimum but still not the case).

Also using password managers are not secure because instead of mutliple passwords to be cracked, you only need one (the one from the manager). So if here Software is used which is not secure enough it's getting even worse.