State of the Phish report by Proofpoint
The 2024 State of the Phish report by Proofpoint has revealed significant insights into the current cybersecurity landscape, focusing on the human element of security threats.
Here’s a summary for you;
Employee Risk Behaviour: A striking 68% of employees reportedly engage in actions that knowingly put their organizations at risk, leading to potential ransomware or malware infections, data breaches, or financial losses. Despite a decline in the number of successful phishing attacks, the repercussions, such as financial penalties and reputational damage, have notably increased (up 144% and 50%, respectively).
Security Awareness vs. Actions: The report highlights a gap between security awareness and actual behaviour. While 71% of working adults admit to engaging in risky actions, 96% are aware of the dangers. This contradiction underscores the challenge of transforming knowledge into secure behaviour, as people often prioritize convenience or urgency over security.
Discrepancies in Security Perceptions: There's a notable disparity between what security professionals and employees believe is effective for encouraging safer behaviour. While most security professionals advocate for more training and tighter controls, a large majority of employees (94%) suggest they would prioritize security if controls were simpler and more user-friendly.
Rising Threats and False Security: The misuse of technologies such as multifactor authentication (MFA), generative AI, and QR codes by malicious actors is on the rise. Despite over one million MFA-bypass attacks per month, 89% of security professionals mistakenly believe MFA provides complete protection against account takeovers.
Cyber Extortion and Phishing Trends: Business Email Compromise (BEC) attacks have increased, with significant growth in countries like Japan, South Korea, and the UAE, facilitated by AI technologies. The report also indicates a persistence of cyber extortion and ransomware as major threats, with 69% of organizations experiencing a successful ransomware infection last year.
TOAD Attacks and Lack of Preparedness: Telephone-oriented attack delivery (TOAD) remains a prevalent method, with Proofpoint detecting an average of 10 million TOAD attacks per month. However, only 23% of organizations educate their users on recognizing and preventing such attacks.
Regional Insights and Global Challenges: The report provides regional data, noting variations in attack types and preparedness levels across different areas. For example, North American organizations reported a high incidence of TOAD attacks and ransom payments.
Overall, the report emphasizes the crucial role of human behaviour in cybersecurity and suggests that knowledge alone is not enough to ensure security. Organisations need to bridge the gap between awareness and action by simplifying security measures and focusing on behavioural change.
