CISOs probably didn’t need to see recent statistics to know that employees continue to take major cybersecurity risks, but the numbers are a grim reminder of the education and training necessary to fend off potential attacks.

According to a Blue Coat Systems report conducted by research firm Vanson Bourne, 4 out of 5 of the more than 1,500 people surveyed said they routinely take cybersecurity risks. This included clicking on links within possibly malware-laden email messages, using personal rather than corporate-issued mobile devices in the office, deploying unauthorized software or even looking at adult content on workplace machines. Only 20 percent said they never did any of these things, the study said.

It’s not like awareness of cybersecurity risks is at an all-time low. As CSO Online pointed out, many survey respondents acknowledged the dangers of opening email attachments they didn’t expect, and it’s no surprise that employees in the IT department tended to score better in awareness than their peers in other departments. From an industry sector perspective, however, it was alarming to see that those employed by tech companies tended to be among those most likely to do things that put their firm’s data security at risk.

To some extent, employees may be more likely to take cybersecurity risks because they have more opportunity to do so. Technologies such as software applications that were once only within the domain of IT departments to procure and deploy are now accessible by almost anyone, an expert told iTWire. It may be increasingly difficult for some firms to strike a balance between offering employees choices and flexibility from an IT perspective while also safeguarding mission-critical systems and data.

Although eWEEK suggested companies could work harder to set policies to mitigate cybersecurity risks, there aren’t a lot of great ideas on how best to enforce them. Viewing online content at work might lead to serious repercussions, of course, but should downloading an app without the IT department’s permission be an offense worthy of termination? What about using social media, where cybercriminals might manipulate the user’s emotions to scam money, data or worse? That’s the real challenge for CISOs. If nothing else, the study means that whatever solutions they propose, they’ll have some good numbers to back them up.