Companies still risk information theft.

As many as 80% of corporate employees will disclose sensitive company or customer information to people they do not know over the telephone, and up to 33% will do the same via e-mail, according to a survey by RavenEye, an information security consulting business.

The company recently conducted a series of information security assessments for several U.S.-based companies.The company used "social engineering" techniques, which prey upon human emotions such as fear, trust, kindness and greed, to trick employees into sharing critical information, such as network IDs and passwords, which could be used to access sensitive company data.

Business leaders remain largely unaware that trusted employees are the major source of confidential corporate information leaks, said Joseph Kirkpatrick, president of RavenEye.

While businesses are expected to spend $45 billion worldwide in security technologies in 2006, technology alone is not enough, he said.

"Good security technology is available to companies, and they should have it in place. But the most serious threat comes from the human factor. Curiously, that is the part of the equation that businesses continue to pay little attention to," Kirkpatrick said.

Training employees is the most critical, yet often most overlooked, component of a company's security program, according to RavenEye.

By the Numbers

$130 million

Total financial losses from cyber attacks annually

Top 3

The most common forms of cyber attacks are viruses, unauthorized access and theft of proprietary information.

50%

About half of cyber attacks stem from company insiders.

0%

Despite continuing discussions, there's been no increase in outsourcing cyber security or using insurance to manage risks.