It’s tax season. And that means, for internet scammers looking to filch your employees’ identities and steal their money, it’s phishing season.

According to a warning issued by the IRS, tax season triggers a 400 percent surge in phishing and malware incidents. The scammers’ target? The sensitive information found on your employees’ W2 forms:

The cost of cybercrime is going nowhere but up. Meanwhile, the news reports on staggering incidents of mass data theft on a regular basis. If you’ve become obsessed with combatting intrusion from outside hackers and scammers, it’s understandable.

But if you’re only looking outward, you may be missing one of the leading and most damaging risks to your cybersecurity: those who work in and with your organization.

No one wants to believe their colleagues and partners would compromise their data security – either deliberately or mistakenly – but it happens more often than you would think.

We don’t have to tell you your organization’s IT system is deeply complex. To provide even the most basic services to your users, many layers of hardware and software combine.

Lurking within these layers are vulnerabilities – weaknesses that can be exploited to inflict costly damage on yourorganization. And as the layers of your IT system multiply, so do their vulnerabilities, whether they’re problems in the operating systems, application flaws, or improper configurations.

How do you find these weak points before the bad guys do? That’s exactly what penetration testing is for and why it is a critical part of a company’s security policy.