Cyber-criminals are increasingly targeting vulnerabilities outside traditional corporate networks, focusing on third-party vendors and employee’s personal devices to bypass organisational defences.

This is according to SoSafe’s 2025 Cybercrime Trends Report, which surveyed 500 security professionals across nine countries to reveal trends in how attackers are expanding their focus beyond direct corporate targets.

“Organisations can no longer rely solely on internal network security,” said Andrew Rose, CSO at SoSafe. “Even with robust measures in place, the risk from external partners remains significant if they don’t uphold the same level of protection. The same applies to employees – when they act without security in mind outside the workplace, it creates vulnerabilities that can compromise the organisation’s overall security posture.”

Third Party Vulnerability

Personal Device Breaches

SoSafe’s study reveals that cyber-criminals are moving outside the traditional corporate domain, with 83% of organisations reporting their employees have fallen victim to cyber-attacks on personal devices that caused security issues for the organisation.

“Cyber-criminals are blurring the lines between personal and professional spheres,” said Niklas Hellemann, CEO of SoSafe. “While employees may be protected by their organisation’s technical controls, their personal devices and accounts are often left vulnerable. They have become prime targets for attackers looking to gain access to corporate information.”

The message is clear: if it’s connected, it’s a threat vector. And personal is now professional.

Recommended reading

• Comment | The Growing Threat of Third-Party Cyber Risks
• Third-party Attack Vectors Plague Insurance Companies
• Third-Party Risks Driving Cyber Insurance Claims

Multi-Channel Attack Strategies

As a related trend, the report highlights that 95% of organisations report an increase in multi-channel attacks over the past year. These sophisticated approaches can combine email, messaging apps, social media, and voice calls to create more convincing and harder-to-detect attacks.

With the aid of AI technologies, these attacks have evolved into “3D phishing attacks” that seamlessly integrate multiple communication channels to manipulate trust and exploit every possible entry point.

A notable incident occurred in 2024 involving the CEO of WWP, who was targeted in a sophisticated cyberattack. Attackers used AI-driven voice cloning to impersonate the executive and deceive employees into disclosing sensitive information and transferring funds.

This case illustrates how cybercriminals are using multi-channel tactics: Leveraging WhatsApp to build trust, Microsoft Teams for ongoing interaction, and an AI-generated deepfake voice call to execute the final stage of the fraud.

With the aid of AI technologies, these attacks have evolved into “3D phishing attacks” that seamlessly integrate multiple communication channels to manipulate trust and exploit every possible entry point.

“Multi-channel attacks are sophisticated tactics to trick users into becoming unwitting accomplices to criminal activities. To protect against these threats, organisations must provide regular, scenario-based training to their staff. The training not only helps employees identify potential threats but also reinforces positive security behaviours, fostering a security-first culture and empowering them to service as the first line of defence for the business,” said Hellemann.