Cybersecurity officials are struggling to get government employees and business leaders to stop opening malicious emails, industry experts said on Thursday.

“People are hacking themselves. There is no exploitation of code,” said Kevin Mandia, president of cybersecurity firm FireEye. “There are 226 investigations that we’ve started or finished … since 2014. Over 90 percent of the time, the way the bad guys broke in was some sort of spearphishing.”