A survey by the Spanish GetApp software rating site has found that the number of organizations using phishing simulations has risen from 30% in 2019 to 70% in 2022.
Despite this positive trend, however, attackers continue to increase both the sophistication and volume of their phishing emails, which has led to a significant rise in employees clicking on phishing links.
“Phishing schemes and their effectiveness have reached a critical point in 2022,” the researchers write. “For the first three years of our survey, the rate of companies reporting phishing emails had remained fairly steady. But in the last year, the percentage of companies reporting phishing has jumped from 77% to 89%.
More concerning, the number of companies that report someone actually clicking a link in a phishing email leapt from 64% to 81% in only the last year. In the last three years, the percentage of employees clicking on phishing links has absolutely skyrocketed, from 43% to 81%. Combined, these numbers are even more alarming because they show a clear upward trend in both phishing volume and effectiveness over the last three years.”
Likewise, the amount of organizations requiring multi-factor authentication has steadily increased over the past three years, but attackers are increasingly finding ways to bypass these measures.
“In 2019, our survey found that 64% of U.S. companies used 2FA for all (21%) or some (43%) business applications,” the researchers write. “In 2022, that number has increased to 91%. Perhaps more importantly, the percentage of companies that use 2FA for all business applications has more than doubled, from only 21% in 2019 to nearly half (45%) in 2022.”
GetApp says organizations need to continue implementing security best practices to keep up with the evolving threat landscape.
“The gap between companies reporting phishing emails and those reporting employees clicking on phishing emails has narrowed year over year, from a 30-point gap in 2019 to only eight points in 2022,” the researchers write. “In response, companies must prioritize email security and educate staff on the increasingly sophisticated social engineering strategies that threat actors use in phishing emails to manipulate employees into turning over network credentials or downloading malware.”
New-school security awareness training can give your employees an essential layer of defense by teaching them how to avoid falling for phishing emails.
GetApp has the story.
