Don't have time to read through the massive Verizon's 2015 Data Breach Investigations Report? Here is a great summary; 90% of Security incidents are still caused by PEBKAC and ID10T errors, according to Verizon.
Phishing attacks are a prime example of how the problem exists between keyboard and user as the DBIR said it takes a mere one minute and 22 seconds after a phishing email is sent before the first victim clicks on the tainted link. At ComputerWorld:
Security awareness training can close the PEBKAC gap.