84% of Organizations Experienced Ransomware and Phishing-Related Security Events in the Last 12 Months

Orgs Experienced Ransomware and Phishing AttacksNew research from Trend Micro and Osterman Research highlights where organizations are strongest and weakest at stopping phishing attacks resulting in ransomware.

We already know ransomware is a problem. But, it’s a two-pronged discussion. Part of the problem is the prevalence and ease of access to very sophisticated ransomware technology. The other part of the problem is how well organizations can stop attacks. New data in Trend Micro’s How to Reduce the Risk of Phishing and Ransomware report exposes where organizations are struggling to stop attacks.

According to the report, the top 4 most effective ways organizations protect against phishing and ransomware threats, organizations are best at:

  • Protecting endpoints from malware
  • Protecting end users from ransomware
  • Protecting backup integrity
  • Training end users on detecting and addressing phishing/social engineering

Despite these efforts, the report goes on to highlight the percentage of orgs that have experienced 17 different types of security incidents. The top 3 are:

  • A business email compromise attack was successful in tricking at least one lower-level employee within our company (53% of organizations)
  • A phishing message has resulted in a malware infection (49%)
  • A phishing message has resulted in an account compromise (47%)

I can’t help but wonder if the “training” being given to users is truly Security Awareness Training as we here at KnowBe4 define it. Our research has shown that 38% of employees within an organization generally will fail a phishing test (and, therefore, the real thing). Many organizations identify quarterly break room training or monthly email reminders as “awareness training". But we see it as a continual education of the user, keeping them constantly updated on the latest campaigns, methods, social engineering tactics, and their role in the organization’s security. This is accomplished through continual online Security Awareness Training matched with monthly phishing testing.

According to our research, this combination can reduce the 38% of employees failing a phishing test down to just 4.7% of employees – a reduction in the organization’s human threat surface of 87%!

I would encourage you to scrutinize how your organization defines Security Awareness Training and take a look at effective ways to train your users to play a part in your organization’s security stance.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Topics: Phishing, Ransomware

Subscribe To Our Blog

Cybersecurity Awareness Month Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews