Phishing is a lucrative industry for cybercriminals; even a single successful breach could net big money or millions of compromised records. According to CFO, more refined variants such as spear phishing or whaling, which rely on emails supposedly sent by C-suite executives, have already racked up $2.3 billion and are the subject of a new FBI warning.

Despite the rising number of attacks and jump in potential losses, however, British firm AXELOS reported that good security is hard to find in the U.K. As noted by SecurityWeek, while 99 percent of senior management staff know security awareness training is critical to minimizing impact, less than half are doing more than the bare minimum. The result: phish on the hook. How do companies clear the water?

The Current Cyber Defenses

Companies aren’t going in blind; almost all use some kind of defense mechanism to lower the chances of a successful breach. Among the most popular defenses are tools such as Spamhaus, which captures around 90 percent of all malicious mail. Supplemented with specific phishing lists, it’s possible to get this figure up near 100 percent. But since even one breach can cost millions, near isn’t good enough.

ITProPortal, meanwhile, noted that 82 percent of companies are still using traditional cybersecurity training methods such as computer-based training and e-learning. More than half (54 percent) only require employees to take an annual refresher course and aren’t developing new training in response to emerging threats or the actual risks associated with specific corporate roles. This creates a defense strategy that catches low-hanging fruit but lets truly malicious attacks slip through and wreak havoc.

Changing the Game With Security Awareness Training

So how do companies address the problem of baited hooks and barbed nets in email waters? It starts with a shift in security awareness training.

Rather than using automated defense systems, which take the burden off employees and place it on autonomous processes, companies need to respect the cybercriminal mandate: Enter wherever is easiest. Right now, the easy point of entry is employee email; fool one individual into clicking on a malicious link or downloading a file and attackers get access to the entire network.

One of the best ways to handle this new batch of threats is through the use of simulated phishing attacks. Used by 70 percent of American companies but just 31 percent of their U.K. counterparts, according to SecurityWeek, these simulated phishers are relatively low-cost and provide critical insight into the effectiveness of current security training. If multiple users fall prey to the same tactic, companies can change their overall training strategy.

If specific users aren’t successful, they can receive on-the-spot refreshers in addition to long-term remedial training. As noted by a recent Ponemon report, this type of training typically costs less than $5 per staff member but can offer returns of 20 to 50 times that amount — not a bad deal considering the average cost of a data breach is $3.7 million.

The current slate of security awareness training tools aren’t getting the job done. Companies need to go beyond automated keep-away tactics and actively engage users to identify safe waters and damaging phishing emails.

More from

$10.3 Billion in Cyber Crime Losses Shatters Previous Totals

4 min read - The introduction of the most recent FBI Internet Crime Report says, “At the FBI, we know ‘cyber risk is business risk’ and ‘cybersecurity is national security.’” And the numbers in the report back up this statement. The FBI report details more than 800,000 cyber crime-related complaints filed in 2022. Meanwhile, total losses were over $10 billion, shattering 2021's total of $6.9 billion, according to the bureau’s Internet Crime Complaint Center (IC3).  Top Five Cyber Crime TypesIn the past five years, the…

4 min read

How to Boost Cybersecurity Through Better Communication

4 min read - Security would be easy without users. That statement is as absurd as it is true. It’s also true that business wouldn’t be possible without users. It’s time to look at the big picture when it comes to cybersecurity. In addition to dealing with every new risk, vulnerability and attack vector that comes along, cybersecurity pros need to understand their own fellow employees - how they think, how they learn and what they really want. The human element — the individual and social factors that…

4 min read

Detecting Insider Threats: Leverage User Behavior Analytics

3 min read - Employees often play an unwitting role in many security incidents, from accidental data breaches to intentional malicious attacks. Unfortunately, most organizations don’t have the right protocols and processes to identify potential risks posed by their workforce. Based on a survey conducted by SANS Institute, 35% of respondents said they lack visibility into insider threats, while 30% said the inability to audit user access is a security blind spot in their organizations. In addition, the 2023 X-Force Threat Intelligence Index reported that…

3 min read

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read