There is a disconnect between rank-and-file employees and chief security officers on who is to blame in the event of a data breach, according to a report published last week by Egress Software Technologies Ltd. and Opinion Matters.

The survey was commissioned by Egress and received responses from 4,000 U.S. and U.K. employees to determine the root causes of employee-driven data breaches. The organization also reached out 500 U.S.- and U.K.-based information technology leaders.

From the perspective of the information technology leaders, 49 percent of respondents indicated that employees have accidentally put sensitive data at risk between one to 10 times in the past year. Sixty-one percent of information technology officials that responded believe that employees have put out information maliciously.

“IT leaders are rightfully concerned by insider data breaches and believe that there is a likelihood of them occurring in the near future at their organization,” the report says. “Despite this recognition and understanding of the root causes, they still can't seem to prevent them from actually happening. The result is loss of brand equity; heavy compliance fines; and potentially lost revenue, lost customers and lost competitive advantages.”

According to the report, 38 percent of respondents believe that the greatest impact of a data breach caused by employee negligence.

Edward McAndrew, a cybersecurity partner at DLA Piper in Wilmington, Delaware, and Washington, D.C., said it is understandable that security executives at companies believe leaks come from employees over infrastructure.

“Employees are the most common attack vector into any organization by a malicious actor,” McAndrew said. “They [also] engage in non-malicious conduct on systems that result in potential data compromise or leakage.”

When it comes to the employee side, 94 percent of U.S. employees and 87 percent of U.K. employees responded that they have not intentionally broken company data-sharing policies.

“When employees do recognize that they may have caused a breach, they attribute it to a high-pressure work environment, rushing to get a job done, and poor training,” the report said.

CEO and co-founder of Egress, Tony Pepper, said in the report that security executives could be doing more to help employees prevent breaches.

“While IT leaders seem to expect employees to leak data—they're not providing the tools and training required to stop the data breach from happening,” Pepper said.

McAndrew said companies should focus on promoting a culture of cybersecurity. He said often employees are not seeing what the information security team is seeing when it comes to data events or breaches elsewhere.

“I don't think it's hard to do and I think it something that resonates with employees because these issues don't just apply to the employees sitting behind a desk or utilizing a smartphone on behalf of his or her employer,” McAndrew explained. “They apply to everybody at home as well. The best practices around identity and access controls apply to us as individuals at home.”