erizon’s 2026 Data Breach Investigations Report (DBIR) once again highlights the importance of the human factor in cybersecurity: 62% of the breaches analysed involved an unintentional human contribution. This does not mean that people are the sole cause of security incidents. It does, however, confirm that technical controls alone cannot eliminate risks related to credentials, errors, social engineering and access rights.
For Validato, a European provider of background checks and Human Risk Management, the conclusion is clear: technical security controls should be complemented by proportionate human-risk management. “Cybersecurity does not end at the firewall. For sensitive roles, it can also be relevant – within the applicable legal framework – to verify whether a person’s identity, qualifications and relevant professional history are consistent with the level of trust and access required by the role,” says André Naef, CEO of Validato.
Validato recommends that Spanish CISOs work with HR to define in advance which checks are necessary and proportionate for each role. In Spain, any processing of personal data in recruitment and employment requires a valid legal basis and must comply with the GDPR and LOPDGDD principles of purpose limitation, data minimisation, transparency and proportionality. Data relating to criminal convictions and offences is subject to additional restrictions and cannot be checked routinely without a specific legal basis.
About Validato: Validato is an international provider of background checks and Human Risk Management, headquartered in Zurich, Switzerland, and operating internationally. Its modular, ISO 27001-certified platform enables companies to configure candidate and employee checks according to the role and within the applicable legal framework. Core data is processed and stored in Switzerland and the EU and, under Validato policy, deleted within a maximum of 120 days. No minimum volumes and no setup fees.
For Validato, a European provider of background checks and Human Risk Management, the conclusion is clear: technical security controls should be complemented by proportionate human-risk management. “Cybersecurity does not end at the firewall. For sensitive roles, it can also be relevant – within the applicable legal framework – to verify whether a person’s identity, qualifications and relevant professional history are consistent with the level of trust and access required by the role,” says André Naef, CEO of Validato.
Validato recommends that Spanish CISOs work with HR to define in advance which checks are necessary and proportionate for each role. In Spain, any processing of personal data in recruitment and employment requires a valid legal basis and must comply with the GDPR and LOPDGDD principles of purpose limitation, data minimisation, transparency and proportionality. Data relating to criminal convictions and offences is subject to additional restrictions and cannot be checked routinely without a specific legal basis.
About Validato: Validato is an international provider of background checks and Human Risk Management, headquartered in Zurich, Switzerland, and operating internationally. Its modular, ISO 27001-certified platform enables companies to configure candidate and employee checks according to the role and within the applicable legal framework. Core data is processed and stored in Switzerland and the EU and, under Validato policy, deleted within a maximum of 120 days. No minimum volumes and no setup fees.
