In a recent whitepaper, sponsored by SlashNext, Osterman Research conducted a survey of IT decision makers, and a few results stood out for us:

• When asked about security incidents that have occurred during the previous 12 months, 37% stated that one or more endpoints in their network were infected as a result of a phishing email. This was the number one answer by more than 9 percentage points.
• 14% indicated that one or more of their senior executives’ systems was infected with malware because of a phishing or spearphishing email.
• When asked about concerns regarding various security-related issues, 54% of responders cited a user’s credentials getting successfully stolen using email-based phishing (this was the number one answer).
• The amount spent on security in 2019 is expected to rise to $90.91 per employee, a 16% increase over 2018 spending.

These findings all point to a growing security threat from phishing attacks, and while the whitepaper highlights email-based phishing, we’ve seen a growing set of attack vectors that reside outside of the email inbox. In a recent blog post, we highlighted five phishing scams outside of email, to include malicious browser extensions, credential stealing, technical support scams, rogue software, and gift and prize scams.

So why are cyberattacks so successful? Osterman research identified eight reasons.

1. Criminals are smart and capable. The criminal network is organized, collaborative, and well-funded. And now more than ever they have the technical resources to develop and unleash new and sophisticated attack methods.
2. Criminals make lots of money from their efforts. Osterman cited research from Bromium that found the most lucrative cybercriminals can make up to $2 million annually and even entry-level hackers can make $42,000 per year.
3. Organizations make mistakes. The research indicates (and the survey results support) that organizations don’t have adequate data protection and backup plans in place to support business continuity. A lack of systems and employee training creates a fertile landscape for cyberattacks.
4. Users make mistakes. We’re likely all guilty of using inadequate passwords and then using them repeatedly. On top of this many people use personal devices and unauthorized applications to conduct business, creating additional attack vectors for cybercriminals.
5. Vendors make mistakes. Software almost always gets shipped with vulnerabilities and let’s face it mistakes happen, but in some instances, vendors can fail to patch these vulnerabilities, including companies like Microsoft, Firefox, and Equifax (we know how that turned out).
6. There are more points of vulnerability. The Internet of Things (IoT) has driven the number of possible attack vectors up considerably, and in fact Osterman cites Gartner research that by 2020, IoT will reach 20.4 billion units, with 7.6 billion of them in business settings.
7. Use of cryptocurrency. The difficulty with tracing cryptocurrencies has emboldened cybercriminals, and we’ve seen this with the increase in ransomware attacks.
8. Cybercrime isn’t just for professionals. The dark web has opened the door for the novice cybercriminal with the availability of ransomware-as-a-service kits and other tools of the trade.

These are all some valid reasons why cyberattacks are so successful, but we’ll add one more that we think is going to play a major role as we move through the year.

1. Most cybersecurity solutions are NOT real-time. The speed in which phishing websites are spun-up and then taken down leave almost no time for traditional blocklist-based security solutions to even notice. By the time a phishing attack has been identified it’s more than likely the attack vector won’t even exist anymore. The only way to stop today’s sophisticated phishing attacks is with real-time, zero-hour detection of threats.

SlashNext phishing site detection is cloud-powered and out-of-band, so it does not introduce any network latency. With seamless integration to existing blocking defenses, and near-zero false positives, automated blocking becomes feasible. Together with a simple 20-minute install and no tuning requirements, SlashNext phishing threat protection is immediate, non-disruptive, and effective.

To access the Osterman Research whitepaper – Addressing the Key Cybersecurity Issues Organizations Face – just follow this link.