State of the Phish report reveals email-based attacks dominated 2021

Proofpoint’s eighth annual State of the Phish report, which provides an in-depth look at user phishing awareness, vulnerability and resilience, revealed that attackers were more active in 2021 than 2020. Findings uncovered more than three-quarters (78 per cent) of organisations saw email-based ransomware attacks in 2021, while 77 per cent faced business email compromise attacks (BEC) (18 per cent YoY increase of BEC attacks from 2020), reflecting cyber criminals' continued focus on compromising people, as opposed to gaining access to systems through technical vulnerabilities.

This year's report examined responses from commissioned surveys of 600 information and IT security professionals and 3,500 workers in the US, Australia, France, Germany, Japan, Spain and the UK. The report also analysed data from nearly 100 million simulated phishing attacks sent by Proofpoint customers to their employees over a one-year period, along with more than 15 million emails reported via the user-activated PhishAlarm reporting button.

The report includes regional, industry and departmental benchmarking data that emphasises the need for a people-centric approach to cyber security. It also highlights real-world phishing examples and illustrates the value of a training solution that accounts for changing conditions, like those experienced by organisations throughout the pandemic.

Attacks in 2021 also had a much wider impact than in 2020, with 83 per cent of survey respondents revealing their organisation experienced at least one successful email-based phishing attack, up from 57 per cent in 2020. In line with this, more than two-thirds (68 per cent) of organisations said they dealt with at least one ransomware infection stemming from a direct email payload, second-stage malware delivery or other exploit. The year-over-year increase remains steady, but representative of the challenges organisations faced as ransomware attacks surged in 2021.

Where 2020 taught us about the need to be agile and responsive in the face of change, 2021 taught us about the need to better protect ourselves, according to Alan LeFort, SVP and GM of security awareness training for Proofpoint.

"As email remains the favoured attack method for cyber criminals, there is clear value in building a culture of security. In this evolving threat landscape and as work-from-anywhere becomes commonplace, it is critical that organisations empower their people and support their efforts to learn and apply new cyber skills, both at work and at home," LeFort said.

The shift to hybrid working accelerated in 2021, with 81 per cent of organisations saying that more than half of their employees are working remotely (either part or full time) due to the pandemic. However, only 37 per cent educate workers about best practices for remote working, illustrating a worrying gap in security best practice knowledge for the "new normal" of working.

For example, 97 per cent of workers said they have a home Wi-Fi network, but only 60 per cent said their network is password-protected, a major lapse in basic security hygiene.

VIEW ALL

LeFort added that Infosec and IT survey participants experienced an increase in targeted attacks in 2021 compared to 2020, yet their analysis showed the recognition of key security terminology such as phishing, malware, smishing and vishing dropped significantly.

"The awareness gaps and lax security behaviours demonstrated by workers creates substantial risk for organisations and their bottom line. Our 2022 report offers actionable advice aimed at enhancing user awareness, reducing risk and protecting people," LeFort said.

Additional State of the Phish report global findings include the following key takeaways:

• Almost 60 per cent of those infected with ransomware paid a ransom. Many (32 per cent) paid additional ransom sums to regain access to data and systems. Fifty-four per cent regained access to data/systems after the first payment, while 4 per cent never got access to data/systems, even after paying. Ten per cent refused to pay additional ransom demand(s) and walked away without data.
• Many workers exhibit risky behaviours and fail to follow cyber security best practices. Forty-two per cent said they took a dangerous action (clicked a malicious link, downloaded malware or exposed their personal data or login credentials) in 2021. And 56 per cent of people who have access to an employer-issued device (laptop, smartphone, tablet, etc) allowed friends and family to use those devices to do things like play games, stream media and shop online.
• Awareness of key security terminology dropped (in some cases, significantly) year-over-year. Only 53 per cent of respondents were able to correctly identify the definition of the term "phishing"’ in a multiple-choice array. This was down from last year’s 63 per cent mark, a 16 per cent year-over-year decrease. Only 63 per cent recognised the definition of malware (down from 65% per cent in 2020), just 23 per cent identified the definition of smishing (down from 31 per cent in 2020), and only 24 per cent recognised the definition of vishing (down from 30 per cent in 2020). Ransomware was the only term that saw a global increase in recognition, with correct answers rising from 33 per cent in 2020 to 36 per cent in 2021.
• Proofpoint customers saw positive results in awareness and security behaviours, even with more testing and a more active threat climate. Their customers’ average failure rate on phishing simulations held steady at 11 per cent year over year, even with the 50 per cent increase in testing seen over the 12-month measurement period.
• Employees were able to better report suspicious emails they receive in their inboxes. Over the one-year measurement period, users alerted their security teams to more than 350,000 credential phishing emails, nearly 40,000 emails with malware payloads and more than 20,000 malicious spam emails.

[Related: VeroGuard receives Common Criteria certification for VeroGuard Platform]