Almost 90% of organizations compromised and attacked in 2019

Proofpoint, recently released its sixth annual global State of the Phish report, which provides an in-depth look at user phishing awareness, vulnerability, and resilience. Among the key findings, nearly 90 percent of global organizations surveyed were targeted with business email compromise (BEC) and spear phishing attacks, reflecting cybercriminals’ continued focus on compromising individual end users. Seventy-eight percent also reported that security awareness training activities resulted in measurable reductions in phishing susceptibility.

Proofpoint’s annual State of the Phish report examines global data from nearly 50 million simulated phishing attacks sent by Proofpoint customers over a one-year period, along with third-party survey responses from more than 600 information security professionals in the U.S., Australia, France, Germany, Japan, Spain, and the UK. The report also analyzes the fundamental cybersecurity knowledge of more than 3,500 working adults who were surveyed across those same seven countries.

“Effective security awareness training must focus on the issues and behaviors that matter most to an organization’s mission,” said Joe Ferrara, senior vice president and general manager of Security Awareness Training for Proofpoint. “We recommend taking a people-centric approach to cybersecurity by blending organization-wide awareness training initiatives with targeted, threat-driven education. The goal is to empower users to recognize and report attacks.”

“Proofpoint’s State of the Phish Report proves how threat actors, not only in the Middle East but globally, care about identifying who in a company has access to the information they want and are laser-focused on targeting them directly through different channels and means,” said Emile Abou Saleh, Regional Director, Middle East and Africa for Proofpoint. “The report identified millennials, which make up a large part of the population in the region, continue to underperform other age groups in fundamental phishing and ransomware awareness. Therefore, it is paramount that organizations start to build a strong security culture among its employees through effective security awareness training.”

End-user email reporting, a critical metric for gauging positive employee behavior, is also examined within this year’s report. The volume of reported messages jumped significantly year over year, with end users reporting more than nine million suspicious emails in 2019, an increase of 67 percent over 2018. The increase is a positive sign for infosec teams, as Proofpoint threat intelligence has shown a trend toward more targeted, personalized attacks over bulk campaigns. Users need to be increasingly vigilant in order to identify sophisticated phishing lures, and reporting mechanisms allow employees to alert infosec teams to potentially dangerous messages that evade perimeter defenses.