Our yearly Cyber Security Report is here – download it free here.
This year we’ve analyzed over 45 billion emails and sliced and diced this data, and compared it with last year’s report to provide actionable insights for anyone who wants to protect their business against cyber threats.
We encourage you to download the full report which has a lot more important data, but in this article, we’ll cover the biggest findings in the report.
There Are a Lot of Junk Emails
Out of that pile of 45 billion emails, 36.4% was categorized as unwanted. Think about that – more than one in every three emails in ALL email we looked at wasn’t something the recipient wanted. Out of that portion, 96.4% were spam or rejected outright (never analyzed further as we knew it was coming from a bad sender). The remaining portion of just over 3.6% was categorized as malicious.
These malicious emails come in various flavors, with phishing remaining in the top spot at 43.3% (a 4% increase from last year). The second flavor was malicious URLs at 30.5%, which is an 18% increase over last year.
There’s a Lot of Junk Attached to Those Junk Emails
The most prevalent type of malicious email attachment are HTML files at 37.1%, followed by PDFs at 23.3% and then archive files (ZIP etc.) at 20.8%. The previous year’s usage of DOCX and XLSX files has dropped since Microsoft disable macros by default in Office.
HTML files will continue to be popular, as every mail client and OS knows how to handle this web standard format.
Industry Targeting
Both in last year’s report, and in this year’s, we found that attackers don’t have a strong preference for one industry vertical over another. In essence, if you can pay a ransom, you’re a target.
However, we did find three sectors that were overrepresented: Research, Entertainment and Manufacturing. It makes sense, Research often handles sensitive intellectual property, which increases the likelihood of a payday, and the same can be said for Manufacturing.
They’re also often seen as a soft target as they have a lot of insecure IoT and OT devices on their networks which can be used as springboards for compromise. Finally, Entertainment seems like a good target as they often handle large amounts of money, see the recent MGM and Caesar breaches as examples.
Brand Impersonation
A very popular type of technique in email attacks is impersonating trusted brands to increase the likelihood of a click. Our top 10 list includes DHL, Amazon, LinkedIn, Microsoft, FedEx and Netflix.
Conclusion
The full report, which is free, covers so much more than this quick taster, we analyze major breaches and trends in the Microsoft 365 space over the last 12 months and we make predictions on what cyber security trends we’ll see in the next 12 months.
We’ve also got a section on the best strategy for you to protect your organization, a section on vendor overdependence as a strategic risk and much more. Read the full Cyber Security Report.
