Barracuda Networks Inc., a provider of cloud-enabled security solutions, published its 2023 spear-phishing trends report, which shows that 50 percent of organizations studied were victims of spear-phishing in 2022 — and 24 percent had at least one email account compromised through account takeover.
The report presents propriety spear-phishing data and analysis, drawing on a data set that comprises 50 billion emails across 3.5 million mailboxes, including nearly 30 million spear-phishing emails. The report also features survey findings from Barracuda-commissioned research.
The survey, conducted by independent researcher Vanson Bourne, questioned IT professionals from frontline to the most senior roles at 1,350 companies with 100 to 2,500 employees, across a range of industries in the U.S., EMEA, and APAC countries.
Overall, the research shows that cybercriminals continue to barrage organizations with targeted email attacks, and many companies are struggling to keep up. While spear-phishing attacks are low-volume, they are widespread and highly successful compared to other types of email attacks.
- Spear phishing is widespread: 50 percent of organizations analyzed were victims of spear phishing in 2022, and a typical organization received five personalized spear-phishing emails per day.
- These attacks are highly successful: Spear-phishing attacks make up only 0.1 percent of all e-mail-based attacks, according to Barracuda data, but they are responsible for 66 percent of all breaches.
- Organizations are feeling the impact: 55 percent of respondents that experienced a spear-phishing attack reported machines infected with malware or viruses; 49 percent reported having sensitive data stolen; 48 percent reported having stolen login credentials; and 39 percent reported direct monetary loss.
- Threat detection and response remains a challenge: On average, organizations take nearly 100 hours to identify, respond to, and remediate a post-deliver email threat — 43 hours to detect the attack and 56 hours to respond and remediate after the attack is detected.
- Remote work is increasing risks: Users at companies with more than a 50 percent remote workforce report higher levels of suspicious emails — 12 per day on average, compared to nine per day for those with less than a 50 percent remote workforce.
- Having more remote workers slows detection and response: Companies with more than a 50 percent remote workforce also reported that it takes longer to detect and respond to email security incidents — 55 hours to detect and 63 hours to respond and mitigate, compared to an average of 36 hours and 51 hours respectively for organizations with fewer remote workers.
Download the full report: https://www.barracuda.com/reports/spear-phishing-trends-2023
For more information, visit barracuda.com.
