What 10,042 real security incidents reveal about design failure.
Himanshu Kalra · UX researcher · July 2026 · Data: VERIS Community Database
3,321incidents involving human error or deception
78%of error-caused breaches were discovered by outsiders
700,000median records exposed by a single misconfiguration
The wrong villain
Ask someone to picture a data breach and they picture an attacker: hooded, foreign, brilliant. The record disagrees. In the VERIS Community Database — ten thousand publicly documented security incidents, coded by a community of analysts on a common schema — mistakes rival malice. 2,681 incidents involve error as an action. 2,650 of them involve no hacking and no social engineering at all: no adversary, no exploit, nobody to blame but the way the work was designed.
For every four breaches caused by attackers in this corpus, three are self-inflicted.
This matters for design because the security industry is organized around the attacker. Budgets, tooling, and attention all face outward. The inward-facing failures — the misaddressed letter, the public bucket, the dumpster — belong to no one. This study reads them as what they are: design failures, in the tradition of Don Norman and James Reason. When the same mistake recurs across thousands of organizations, the interesting question is not who erred, but what design made the error easy.
What causes breaches in this corpus
Figure 1. Incidents per action type. Multi-label coding; totals exceed the corpus total.Data table
Action type
Incidents
Hacking
3,364
Error
2,681
Misuse
1,789
Malware
1,646
Physical
1,626
Social
644
A taxonomy of design failure
Every human-element incident was assigned to one of nine design-failure classes, derived from VERIS's own action varieties and refined against the incident narratives. The names deliberately describe the system, not the person. 'Misdelivery' sounds like someone's fault; 'wrong-recipient failure' asks what let the wrong recipient happen.
The nine classes
Figure 2. 359 further incidents carry a human element but fall outside these classes (programming errors, bribery, extortion…).Data table
Class
Incidents
Wrong-recipient failures
973
Trust-cue failures
431
Unprotected portability
415
Visibility-state failures
397
Unsafe defaults & configuration
336
End-of-life failures
321
Authority-verification failures
70
Ambient & verbal disclosure
41
Input-integrity failures
12
Wrong-recipient failures n=973
Information reaches the wrong person through a legitimate channel. Postal mail, not email, is the leading mechanism — mail merges, stuffed envelopes, look-alike names.
The missing design: recipient confirmation, and disambiguation when two records nearly collide.
“Medication for Veteran A was mailed to Veteran B. The first and last name was the same for both veterans.”
VCDB incident narrative
Mechanisms mentioned in narratives
Figure 3. Keyword mentions; indicative, not exhaustive.Data table
Mechanism
Mentions
postal
393
email
209
fax
57
wrong attachment
54
Visibility-state failures n=397
Private content enters a public state without the actor understanding the state change — posted files, indexed documents, data visible on screens and envelope windows.
The missing design: a legible public/private state, and a preview of what will actually be exposed.
“There was a privacy breach this morning for a brief period (10-15 minutes) where the Pharmacy Bingo Board was displaying private patient information on monitors throughout the hospital.”
VCDB incident narrative
Unsafe defaults & configuration complexity n=336
Open-by-default datastores, authentication never enabled, settings silently lost during upgrades. The person configuring never sees the delta between intended and actual exposure.
The missing design: secure defaults and an exposure preview.
“The information of more than 2 million Dow Jones customers was left exposed online after the company made an error in the access preferences on a cloud storage system.”
VCDB incident narrative
Unprotected portability n=415
Data walks out of controlled space and is lost. In the narratives, paper outnumbers laptops.
The missing design: encryption by default, and minimizing what portable artifacts carry at all.
“A VA employee lost an inpatient roster with 24 patients' information… He cannot recall where he left this paper and it is in essence floating.”
VCDB incident narrative
End-of-life failures n=321
Records in dumpsters, storage units auctioned with patient files inside, interview tapes left in a decommissioned building. Disposal is the least-designed moment in the data lifecycle.
The missing design: a forcing function between "sensitive" and "gone".
“An employee removed two IV bags with PII of two Veterans on the labels from the regular trash.”
VCDB incident narrative
Ambient & verbal disclosure n=41
The interface is social space itself: conversations overheard, information posted to personal feeds.
“Employee A overheard Employee B and C discussing and reviewing a patient's information.”
VCDB incident narrative
Input-integrity failures n=12
Mis-keyed identifiers, missing sensitivity flags. Almost certainly undercounted — entry errors usually surface downstream as some other failure.
Trust-cue failures n=431
Phishing works because the channel gives the recipient no reliable way to tell authentic from forged — sender, links and attachments are all spoofable at the surface the user can see. Several of the most sophisticated intrusion campaigns in the corpus begin with the least sophisticated element: an email that looked right.
“The prosecutor's office was hit by ransomware in January 2015 when an employee clicked on a link embedded in a phishing email.”
VCDB incident narrative
Authority-verification failures n=70
Urgent instructions from apparent authority, in workflows with no out-of-band confirmation step. Business email compromise, W-2 harvests, and — already in this corpus — a synthesized voice.
“The CEO of an unnamed UK-based energy company thought he was talking on the phone with his boss… who'd asked him to urgently transfer €220,000.”
VCDB incident narrative
Nobody catches their own mistakes
How does an organization learn that it has breached itself? Mostly, it doesn't. Where the discovery method is recorded — 1,248 of the 2,681 error incidents — 78% were discovered by someone outside the organization. The single most common discoverer is the customer: the person whose data was exposed is the person who finds the exposure. Attackers at least have a reason to stay hidden; a misdelivered letter hides nothing, and still the institution is the last to know.
One caveat is owed here: incidents discovered by outsiders are also more likely to become public at all, so the true external share is probably lower. The asymmetry, not the exact figure, is the finding.
Who discovers error-caused breaches
External discoverers
Figure 4. n = 1,248 error incidents with a recorded discovery method.Data table
Discovery location / external discoverer
Value
External
78%
Internal
21%
Partner
1%
Customer
371
Security researcher
180
Found documents
158
Unrelated third party
77
Actor disclosure
38
Other
17
Law enforcement
13
Audit
8
The blast-radius ladder
Not all design failures are the same size, and the pattern in their sizes is the sharpest finding in this corpus. Where a record count is known, the median wrong-recipient failure exposes two records — one letter, one wrong hands. The median misconfiguration exposes seven hundred thousand.
A person can only mis-send one envelope at a time. A checkbox on a cloud console operates on everything behind it. As the interface becomes more abstract — from envelope to attachment to bucket policy — the same-sized human slip touches more people. The duty of care owed by the design scales the same way: an error-proof console matters five orders of magnitude more than an error-proof envelope.
Median records exposed per failure class
Figure 5. Medians; record counts are known for roughly 30% of incidents. Log scale.Data table
Failure class
Median records
n
Wrong-recipient
2
802
Unprotected portability
808
335
Visibility-state
1,581
256
Trust-cue (phishing)
3,020
116
Unsafe defaults
700,000
236
Failure follows the medium
The corpus also watches failure move. Among human-element incidents of 2010–2014, the physical world dominates: misdelivered letters, lost paper, dumpsters. A decade later the physical classes have collapsed and one digital class has taken over: by 2020–2024, unsafe defaults and misconfiguration account for over half of coded human-element incidents. The mistake did not go away — it moved into the console, and grew six orders of magnitude in reach.
Reporting also declined in this period, so shares are more trustworthy than counts; the direction is unambiguous.
Share of human-element incidents by era
Figure 6. Era totals: 1,889 / 1,166 / 166 incidents — the last era is small; read shares, not counts.Data table
Class
2010–14
2015–19
2020–24
Unsafe defaults & configuration
3%
16%
54%
Wrong-recipient
36%
23%
8%
Unprotected portability
16%
8%
2%
End-of-life
11%
9%
1%
What this asks of design
Security has a well-funded conversation about attackers and a nearly empty one about defaults, confirmation steps, state legibility, and end-of-life. The findings here are an argument that the second conversation belongs to design research: the failures are patterned, the patterns are legible in ordinary qualitative data, and every one of the nine classes names a designable surface. The human element is not the weakest link. It is the part of the system that was never given a designer.
Method
Source: VERIS Community Database (VCDB), the open incident corpus behind Verizon's DBIR; combined JSON of 2026-07-03; 10,042 incidents, 9,523 with free-text narratives. Single-source by design.
Unit & coding: incidents multi-labeled into nine design-failure classes by deterministic rules over VERIS action varieties (mapping table published in the repo); sub-mechanisms from word-boundary keyword matching over narratives, reported as "at least n mentions".
All prevalence figures are within-corpus, not population estimates. VCDB bulk-imported US Veterans Affairs privacy reports, inflating healthcare/public-administration and postal mechanisms; coverage peaks 2010–2019 and thins after 2020; record counts are known for ~30% of incidents; the discovery-method finding carries a visibility bias acknowledged in the text.
Pipeline: Python, deterministic, re-runnable (fetch → tidy → code → profile); exemplar quotes are verbatim incident narratives from the public dataset, lightly truncated.
Author: Himanshu Kalra. Built as a public design-research study, 2026.