Verizon: Phishing is the Attack Vector Most Often Seen in Data Breaches



iStock-489433406This year’s much-anticipated Verizon Data Breach Investigations Report sheds some light on how cybercriminals use phishing to achieve their goal of stealing data.

When it comes to industry analysis, the Verizon DBIR is definitely somewhere at the top of the list. Every year, they analyze tens of thousands of security incidents and confirmed data breaches to provide the world with a view into the current state of attacks, methods, motivations, targets, and victims.

This year’s report highlights a few stats of interest around how phishing and social engineering is used as part of attacks resulting in a data breach:

  • Phishing was the most used threat action variety representing 22% of data breaches and was the second most seen threat action in all incidents
  • Email links were the number one vector used to infect endpoints with malware
  • 96% of all social attacks arrive via email
  • 37% of breaches used compromised credentials

The phish and its evil cousin, social engineering, are very much active and remain viable tools used as part of successful data breaches. Malware, ransomware, and credential theft all point back – in varying degrees – to phishing attacks.

This data demonstrates how imperative it is for organizations to proactively put a defense in place – one that goes beyond the concept of having security solutions and appliances analyzing and detecting threats. Instead, organizations need to recognize that the breaches represented in these reports occurred in companies that already have these kinds of solutions in place. The gap in security is still the user and their endless ability to be curious, outwitted, and downright fooled into participating in an attack with the simple click of an email link or attachment. Organizations need to ensure users are up to date on the latest attack trends through Security Awareness Training in order to improve your defense against those phishing emails that have figured out how to get past your security measures.

The data breach isn’t going anywhere, and ransomware attacks are going the path of full-on data breaches, so having a comprehensive defense – that includes the user – is going to be an absolute moving forward.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews