Gone are the days when Pinkerton security guards simply locked up information in a vault at the end of the day. Industrial espionage victimized a record number of U.S. companies in 1997. Let's say a virus got into your company's information database via an employee who didn't scan his files with the latest virus protection software. If the virus is potent enough, it could bring your company to a screeching halt in a matter of hours. Hopefully, your IS department will eradicate it before it multiplies and wreaks havoc, but if it can't, expect to spend countless hours recovering data.
Passwords are another problem.
If a hacker gets hold of a live password, he can access your company's top-level files in a matter of minutes. You can see how important employees are to minimizing technical security risks, but don't forget all the other ways information can leak out of a company. For instance, a number of people on the commuter train overhear a conversation between two employees about the new marketing plan, or an employee leaves sensitive information unprotected on her desktop or inbox. Another employee throws the early drafts of a key strategic plan in his trash can. Had these employees understood information security and what role they play, these potentially costly leaks could have been prevented.