Proofpoint, a leading cybersecurity and compliance company, has released its fifth annual State of the Phish Report, which uncovers phishing cyberattack trends across more than 15 industries and details the fundamental cybersecurity knowledge of more than 7,000 working adults in the US, Australia, France, Germany, Italy, Japan and the UK.
Data from tens of millions of simulated phishing attacks sent over a one-year period were analysed along with nearly 15,000 cybersecurity professional survey responses, from both Proofpoint customers and outside organisations, to provide an in-depth look at state of global phishing attacks.
Overall, 83% of global infosecurity respondents experienced phishing attacks in 2018, up from 76% in 2017, and nearly 60% saw an increase in employee detection following security awareness training.
In addition, more organisations were affected by all types of social engineering attacks (phishing, spear phishing, sms phishing, voice phishing and USB drops) year over year. For the first time, compromised accounts bypassed malware infections as the most commonly identified impact of successful phishing attacks.
“Email is the top cyberattack vector and today’s cybercriminals are persistently targeting high-value individuals who have privileged access or handle sensitive data within an organisation,” said Joe Ferrara, General Manager of Security Awareness Training for Proofpoint.
“As these threats grow in scope and sophistication, it is critical that organisations prioritise security awareness training to educate employees about cybersecurity best practices and establish a people-centric strategy to defend against threat actors’ unwavering focus on compromising end users.”
This year’s State of the Phish Report key findings include the following:
- Infosecurity professionals reported a higher frequency of all types of social engineering attacks year over year. Phishing increased to 83% vs. 76%. Spear phishing increased to 64% from 53%. Vishing and/or smishing increased to 49% vs. 45% and USB attacks increased to 4% vs 3%.
- Credential compromise has increased 70% since 2017 and 280% since 2016, surpassing malware infections to become the most common phishing attack impact in 2018. Respondents reporting phishing attacks, that resulted in data loss, more than tripled between 2016 and 2018, underscoring the growing phishing threat and impact from such attacks.
- A total of 83% of global respondents experienced phishing attacks in 2018, demonstrating a 9% year-over-year increase. Only 10% of respondents reported experiencing a ransomware attack, confirming that ransomware took a back seat to other types of attacks last year.
- A total of 59% of suspicious emails reported by end users were classified as potential phishing, indicating that employees are being more diligent and thoughtful about the emails they receive
- Baby boomers outperformed all other age groups in fundamental phishing and ransomware knowledge, underscoring why organisations should not assume a younger workforce has an innate awareness of cybersecurity threats
- Educating employees about today’s cyberthreats is essential. In a global survey, working adults identified the following terms correctly: phishing (66% correct), ransomware (45% correct), smishing (23% correct) and vishing (18% correct). These findings spotlight a knowledge gap when it comes to the language security teams are using when communicating to end users.
Adenike Cosgrove, Cybersecurity Strategist, EMEA, Proofpoint, said: “Lack of cybersecurity awareness, in particular amongst the millennial/Generation Z demographic, presents a greater threat than many businesses expect. Our latest research shows that surprisingly, older generational groups can more accurately identify threats such as phishing and ransomware than digitally-savvy millennials. This tells us that millennials, despite being much more comfortable and at ease with digital platforms, display greater complacency towards threats and perceived risks.
“With the percentage of millennials in the workforce set to reach 50 percent globally by 2020, it’s imperative that businesses focus on developing a people-centric approach to security and deploy cybersecurity awareness training programmes that aim to change employee behaviour. The bottom line is that organisations that do not consider the human factor as a key pillar to their cyberdefence strategy will continue to be prime targets for cybercriminals, putting their businesses at risk of potentially crippling attacks.”
To download the State of the Phish 2019 Report and see a full list of global comparisons, visit: https://www.proofpoint.com/us/resources/threat-reports/state-of-phish.
For more information on cybersecurity awareness best practices and training, visit: https://www.proofpoint.com/us/products/phishing-simulation-security-awareness.