The second Email Security Risk Report by cybersecurity company Egress has revealed that 94% of global organisations experienced email security incidents in the past 12 months.

The report sheds light on the evolving risks, impact of incidents, and cybersecurity leaders’ concerns about traditional approaches to email security.

The eye-watering statistic of 94% of organisations falling victim to phishing attacks marked a 2% increase from the previous year. This upward trend is mirrored in the negative impact of phishing attacks, affecting 96% of organisations enduring operational disruption as a result of an email security incident, up from 86% in the prior year. Cybersecurity leaders express heightened vulnerability, with 58% reporting account takeover incidents.

Data loss and exfiltration incidents have emerged as significant concerns, affecting 91% of organisations. Outbound email incidents were primarily caused by reckless behavior, human error, or malicious exfiltration, highlighting a multifaceted challenge in securing data both within and outside organisations.

The impact on employees caught in phishing attacks is severe, with 96% of organisations experiencing negative consequences. Disciplinary actions were taken in 74% of cases, including termination and voluntary departures, emphasising the seriousness with which organisations approach email security incidents.

As AI continues to proliferate and become ever more mandated to be a key part of business operations, it has become a major talking point within the discourse around cybersecurity. The report indicates that 61% of cybersecurity leaders are troubled by the use of AI chatbots in phishing attacks, while 63% express concerns about deepfakes, highlighting the industry’s growing worries about AI-related cyber risks.

Microsoft credentials, often considered the ‘keys to the kingdom,’ have become prime targets for cybercriminals. Account takeover attacks (ATOs) have risen to prominence, affecting 58% of organisations. The majority of ATOs (79%) initiated with a phishing email harvesting employee credentials, and an alarming 83% saw cybercriminals bypassing multi-factor authentication.

The effectiveness of Secure Email Gateways (SEGs) is being questioned, with 91% of organisations expressing frustration, leading to considerations of replacements in 87% of cases. Native controls in Microsoft 365 and Integrated Cloud Email Security solutions are gaining traction as organisations seek comprehensive coverage for inbound and outbound email security incidents.

Despite the high incidence of security events, training efforts seem to fall short. While 94% of organisations faced security incidents, 88% provide Security Awareness Training (SAT) for compliance purposes only. Concerns about the effectiveness of traditional training methods persist, with only 19% tailoring SAT to departments or teams and a mere 9% to individual employees.

Jack Chapman, VP of threat intelligence at Egress, comments: “The 2024 Email Security Risk Report is an essential read for all cybersecurity professionals and ultimately a tool to help teams assess their inbound and outbound defenses.  

“What has been staggering is the emergence of trends alongside the 2023 edition of the Email Security Risk Report; for example, 94% of respondents fell victim to phishing attacks, up 2% from the previous year. Organisations continue to face vulnerabilities when it comes to advanced phishing attacks, human error, and data exfiltration, and analyzing emerging trends will be key to bolstering defenses. 

Recommended

• What’s the Most Overlooked Aspect of Organisational Security?
• Will New Sustainable Tech Become a Major Cyber-attack Vector?
• What’s the State of Cybersecurity Automation in 2023?

“The report also highlights how cybersecurity leaders know that they’re vulnerable when it comes to phishing attacks. 58% of organisations have experienced account takeover incidents in the last 12 months, and 79% of these started with a phishing email that harvested an employee’s credentials, so it’s no wonder that phishing attacks and compromised accounts are causing concern for our cybersecurity leaders.

“The use of AI by cybercriminals is also at the front of our leaders’ minds, and rightly so. While it’s currently impossible to actually prove chatbots are being used to create phishing attacks, cybercriminals generally take every advantage they can get. Organisations can’t afford to be left behind but must ensure their defenses keep pace with cybercriminals’ methodology and the resulting attacks. 

“The stats in this latest report are truly staggering; 94% of companies have experienced security incidents in the last 12 months, and 95% of cybersecurity leaders are stressed about email security. Organisations urgently need to adapt their approach, or risk finding themselves in the same position next year.”