Stop the Cybersecurity Blame Game

In December, genetic testing company 23andMe acknowledged a hack that led to the theft of nearly seven million customers’ data. As the New York Times reported, criminals obtained “ancestry trees, birth years and geographic locations.” This kind of digital theft may have felt personal to many of those impacted.

The other thing that makes the response to this breach surprising was that the genetic testing company appeared in media reports to place much of the blame for the incident on customers. After a class action lawsuit was filed, 23andMe’s attorneys said in a letter to plaintiffs that impacted customers “used the same usernames and passwords used on as on other websites that had been subject to prior security breaches, and users negligently recycled and failed to update their passwords following these past security incidents.”

Digital intrusions are inevitable, even at companies with the strongest of protections in place. But how a company approaches protections for their customers, and the fallout after an incident, can make the difference between maintaining, building, or losing trust. The right approach is to take full responsibility, and take full ownership of customer security, instead of appearing to play the blame game. Data about consumer preferences makes this point in a powerful way: 94% of consumers Telesign surveyed in 2023 agreed that businesses — not the consumers themselves — bear responsibility for protecting their digital privacy.

Our survey also shows that, paradoxically, respondents admit they don’t always do enough themselves to protect their own data. That can include, as the 23andMe lawyers pointed out, not changing passwords after being alerted they need to do so. However, that does not change the fact that, in order to maintain trust, it is the digital business that needs to own the responsibility to protect digital privacy. Through this lens, it is always a bad idea to even subtly suggest that it is the customer’s job to protect themselves in order to deflect the blame.

Once a customer signs up for your service, it becomes your responsibility to protect the data they share with you from fraudsters. The good news is there are many ways to do that. For example, require multi-factor authentication (MFA). This simply means an extra step, often a one-time-passcode (OTP) sent via text, email, or through many other channels, before a log-in or transaction is approved. And by the way, sending a highly secure OTP via text message costs less than one penny in the United States. When you value a customer relationship, that is a minor but smart investment. There are also other options, such as RCS messages, that are increasingly effective, secure, and cost-effective.

In addition to stronger passwords and MFA, another layer of defense for enterprises is to utilize services that allow them to monitor breached data on the dark web, which helps determine if and when customer data has been compromised. In those instances, additional security steps can be requested to secure both the customer’s account and your digital infrastructure.

Even with all of these resources available to protect customers, we too often see the trend of not taking enough responsibility to protect people on digital platforms. For example, when it comes to MFA, some companies are removing Short Message Service (SMS) verification — or text messages, as they are commonly known —as an option. Alternatively, some companies now charge for the service. Some suggest that SMS verification is inherently less secure — which it can be, in some cases. However, there are solutions that score phone numbers for fraud risk before an SMS message is sent. And others that allow “silent” verification in which a number is tested for fraud risk without the need to send a text message. These innovations can stop many fraudsters in their tracks.

On the other hand, taking ubiquitous tools away from customers that allow them to keep their accounts secure — or making them pay extra for them — sends the wrong message. In the case of SMS verification, companies that do that are essentially saying that they are unwilling to pay a single penny to help a customer verify their identity in order to keep their account safe.

It's also crucial not to blame customers for digital intrusions when they happen. There are many reasons people may not take every necessary step to protect themselves online. To make an analogy, most of us know we should eat right and exercise, but sometimes fall short of that standard. So, assume customers aren’t doing enough to protect their digital identities and step up to help them do it when they are on your platform. That means creating the right amount of friction when they are logging in, or transacting, including putting in place multi-factor authentication. Educate them on why that friction is there: to keep their digital interactions safe. And if things go wrong, take responsibility. Explain the steps you are taking to fix the problem.

Owning that responsibility — never blaming — is one of the secrets to building and maintaining trust. When you make that investment in your customer relationships, anything is possible.


  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West: Day 2

    What a great show ISC West 2024 has been so far. The second day on Thursday was as busy or even more hectic than the first. Remember to keep tabs on our Live From ISC West page for news and updates from the show floor at the Sands Expo, because there’s more news coming out than anyone could be expected to keep track of. Read Now

    • Industry Events
    • ISC West
  • A Unique Perspective on ISC West 2024

    Navigating a tradeshow post-knee surgery can be quite the endeavor, but utilizing an electric scooter adds an interesting twist to the experience. While it may initially feel like a limitation, it actually provides a unique perspective on traversing through the bustling crowds and expansive exhibition halls. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3