February 15, 2016 By Larry Loeb 2 min read

Security professionals can discuss what cybercrime costs an enterprise at great length. But what does the actual cybercriminal make from the endeavor?

Palo Alto Networks and the Ponemon Institute recently set out to answer this question. They worked together on a new report called “Flipping the Economics of Attacks,” and there are some surprises in their findings.

About the Cybercrime Survey

To get the answers, the two groups surveyed 304 “threat experts” — also known as the bad guys — in the U.S., U.K. and Germany. Ponemon built this panel of experts based on their past participation in Ponemon Institute activities and IT security conferences.

Their first finding was that attackers are opportunistic and go after the easiest targets first. According to the report, 72 percent of respondents said that they won’t waste their time on targets that don’t have a quick and high payoff.

They are also put off by a good defense. Attackers will quit when the targeted company has a strong defense, according to 69 percent of study respondents.

Defense Does Work

One of the biggest takeaways was that time plays a strong role in how lucrative an attack is — or isn’t. “The longer an organization can keep the attacker from executing a successful attack, the stronger its ability to safeguard its sensitive and confidential information,” the report said.

“The inflection point for deterring the majority of attacks is less than two days (40 hours), resulting in more than 60 percent of all attackers moving on to another target.”

But it’s getting cheaper to attack. About 53 percent of respondents said the total cost of a successful cybercrime attack has decreased. This aligns with 53 percent of the respondents reporting that the time to plan and execute an attack has decreased.

That easy process may be due to a number of factors. According to the study, 67 percent of attackers agreed the number of known exploits and vulnerabilities increased, while 52 percent said attacker skills have improved and 46 percent believed hacking tools improved.

The study confirms that if enterprises can make it hard on an attacker, costing them time and effort, then they are more likely to prevent an attack from having a harmful effect. As previously noted, 40 hours of additional effort for attackers seems to be when 60 percent of them will call it quits.

The Real Profit

So why do they do it? Although 69 percent of respondents were motivated by money, the average attacker received $28,744 for about 705 hours spent on attacks annually. This is 38.8 percent less than the average hourly rate of IT security practitioners employed in the private and public sectors, and only 25 percent of their yearly wage, according to IT Business Edge. That is not the big money that legends are made of.

Cybercrime doesn’t pay. Even ignoring the legal consequences of the actions, the end results are small. It’s a mug’s game, for sure.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today