Subscribe to a WardsAuto newsletter today!
Get the latest automotive news delivered daily or weekly. With 6 newsletters to choose from, each curated by our Editors, you can decide what matters to you most.
Industry Voices | Security vs. Speed: Stop Employees From Bypassing Cyber ProtocolsIndustry Voices | Security vs. Speed: Stop Employees From Bypassing Cyber Protocols
Human error remains dealerships’ biggest threat despite advanced cyber defenses.
Terry Dortch, Terry Dortch, founding partner, Automotive Risk Management Partners, Inc. (ARMP)
March 26, 2025
4 Min Read
Data shows employees opt for efficiency over security.Getty Images
Employees increasingly bypass the cyber security measures at their fingertips in exchange for convenience and speed.
A recent new survey says this challenge to the mounting cyber risks businesses face today is not lessening, even with increased employee and consumer awareness of the risks and costs for companies caught up in cyber pirate nets.
Human eyes, hands and experience remain a primary strategy against identity theft crimes in auto dealerships. No dealership can be 100% protected from compliance lapses and data breaches, even where computer systems oversee digital networks.
We’ve written about the need for heightened employee awareness of their role in helping prevent cyber forest fires. With a focus on “efficiency,” a December 2024 Forbes article notes that 65% of employees admit to circumventing employer security policies.
An earlier Verizon data breach study found 68% of breaches in the past year were caused by human error. One example – An employee who falls for a social engineering fraud fails to secure confidential information.
The Forbes piece summarizes the situation: How do dealers enforce compliance without stifling workflow? In the rush to meet deliverables, employees sometimes skip security to make the sale.
I cannot stress too heavily why dealership leaders must embrace this human element to data security and push it down into their stores. Assign one or two managers to implement and oversee data security training and compliance throughout all departments. You must explain and enforce how skimping on safeguards and skipping processes, steps and training as a first-step defense against cyberattacks should not be tolerated, even at the cost of sales.
What are reasonable workarounds for this dilemma? I have three to suggest:
First, strong cyber security technology must be in place. The more this solution can counter cyberattacks – offensive security – the better your dealership will be protected. Make cyber security investments a priority; insurers now scrutinize how dealerships protect themselves from penetrations of their data flows, internally and in the data that moves to and from vendors.
Second, pay attention to your vulnerabilities. Never let your security focus lapse; never fall into the mindset that you're good to go because your current cyber protection methods aren’t turning up evidence of attacks. We see networks penetrated years ago siphoning off financial and personal data or waiting silently to spring into action when an incentive in their coding DNA is activated. The right security software and processes should not leave you in jeopardy like that.
Third, get and keep your people sensitized to the importance of cyber compliance. A quarterly refresher is not too frequent in today’s rule. No dealership can be 100% protected from compliance lapses and data breaches, even where computer systems oversee digital networks. Still, in my 25 years protecting dealerships from compliance and security lapses, lax information hygiene remains a dealer’s most significant risk for information theft. I have advocated for over a decade that lax auditing and document handling practices expose dealers to these unnecessary risks and reputation damages.
However, employee compliance cooperation does not need to be a choice between security or sales. This attention must be given not only to cyber-related risks but to the mundane information theft opportunities and sloppy paper handling we find present in almost every dealership we visit.
It amazes me how many dealers remain lax about managing deal jackets, leaving them exposed in the F&I office or lacking proper storage and stacking them in the customer lounge. Paper documents, from completed deal jackets to service records and deal worksheets, are rich in personal and financial data. Anyone with a malicious spirit and camera phone wandering the store can quickly capture this information, and will rarely be seen doing so.
Your compliance and security vendor offers video training on these topics and audits both cyber and manual compliance practices and procedures at least quarterly. Dealers frequently ask for more frequent scrutiny of these vulnerabilities so they can sleep better at night.
This industry's compliance and cyber security solutions offer various service options and costs. Don’t equate price with value or lack of value.
The passion and zeal of the humans who run the company and bring that same enthusiasm, seriousness and integrity to your dealership, and the technology and strategy they use to ensure the integrity of your data platform will pay long-term big dividends. Determine whether they passively provide cyber protection or aggressively go after people seeking to defraud you and your customers.
About the Author
You May Also Like