Phishing Scams Were The Top Cybersecurity Threat

Reading Time: 2 minutes

Webroot, the Smarter Cybersecurity^® company, announced the results of a new report: “The 2018 Webroot SMB Pulse Report.” Webroot found that across 500 small- to medium-sized businesses (SMBs) in the U.S., phishing scams were the top cybersecurity threat. While many businesses still don’t fully recognize the broad spectrum of threats they face due to the lack of in-house security expertise, they see an opportunity for user awareness training to reduce the risk from cyber threats.

Explore the Webroot SMB Pulse Report

Key Report Findings:

• Phishing scams were identified as the top cybersecurity threat, but many SMBs are still unaware of the spectrum of threats their businesses face.
  • 24 percent of respondents overall view phishing as the number one cybersecurity threat to their organization.
  • After phishing, businesses with one to 19 employees reported they continue to focus on last year’s top threat—ransomware­­—identified as a top threat by 20 percent of respondents in this group.
  • 24 percent of respondents overall don’t know their top threat. The smallest businesses (one to 19 employees) were found to be the least likely to know their top threat.
  • For companies with 20 to 99 employees, 28 percent of respondents believe employee naiveté is their top threat, while phishing dropped to 22 percent.
  • Webroot’s Take: Be it ransomware, phishing, cryptomining software or other threats, nearly 93 percent of all malware is delivered via email, according to the 2018 Verizon Data Breach Investigations Report. SMBs should focus on training employees to securely manage their email.
• Many SMBS aren’t providing their employees with ongoing cybersecurity training, a key strategy to prevent sophisticated phishing attacks.
  • 66 percent of businesses with one to 19 employees surveyed don’t have any kind of employee cybersecurity training. The stats are better for larger companies, but still not ideal. 29 percent of companies with 20 to 99 employees and 13 percent of companies with 100 to 500 employees do not have a cybersecurity training program in place.
  • Webroot’s Take: A Webroot efficacy report found that click rates on phishing simulation links dropped by more than half when customers used phishing simulations in combination with ongoing training, from 26 percent to 12 percent. Continual education is key.
• Small businesses often don’t have the resources or expertise to handle IT security needs.
  • 41 percent of respondents don’t have dedicated resources to address IT security; only 12 percent have in-house or dedicated IT security staff. The rest of the organizations fell somewhere in between with a mix of in-house and outsourced security support.
  • One-third of businesses surveyed outsource IT security in some capacity through a third-party managed service provider (MSP), helping alleviate the burden.
  • Webroot’s Take: While it may seem costly to outsource security, Webroot research found a data breach would cost a U.S. business an average of $527,256. Trusting an MSP to provide preemptive, preventive security services is significantly less costly.

Beware of These Top Phishing Subject Lines:

• Since phishing is the top threat to SMBs, it’s no surprise that identifying and preventing these scams is top of mind for those in the security trenches. According to Gary Hayslip, chief information security officer at Webroot, here are the top phishing subject lines to be on the lookout for this year. Notice, some even have spelling errors.
  • Review or Quick Review
  • Bank of <take your pick>; New Notification
  • Charity Donation for You
  • FYI
  • Action Required: Pay your seller account balance
  • Unauthorize login attempt
  • Your recent Chase payment notice to <name of employee>
  • Important: (1) NEW message from <Bank Name>
  • AMAZON : Your Order no #812-4623 might ARRIVED
  • Wire Transfer
  • Assist Urgently