American companies are spending more than ever to beef up their cybersecurity, but threat actors are still managing to stay one step ahead, a discouraging phenomenon security professionals are trying to combat by drawing more attention to the leading vulnerability in the security chain—humans.

Internet crime complaints have surged, according to the FBI, with reported financial losses from 2018 through 2022 totaling $27.6 billion, including $10 billion in 2022. The agency isn’t expected to release 2023 data until March, but experts are bracing for an even larger financial hit.