Osterman Research

Perception Point recently published its 2024 annual report on cybersecurity trends and insights, reporting on data and trends seen from its data sets during 2023. You can get a copy from Perception Point (registration required).

There are some useful data points in the report. These stood out:

• 20% illegitimacy rate
  1 in 5 emails are not legitimate. That is, 80% make good business sense within the work flow of a given individual. 20% don’t.
• 70% of attacks are phishing; huge increase in BEC attacks
  Phishing attacks remain the most frequently observed threat type, at 70% within the Perception Point data. In the FBI’s data from 2023 – based on a different data set of incidents reported to the FBI’s IC3 unit – it was 34% phishing (299K phishing out of 880K total incidents). Perception Point also reported a massive increase in the number of BEC attacks it identified, to 18.6% of all attacks. Per the FBI data, BEC occurs less frequently but is significantly more costly than plain phishing attacks.
• AI in email attacks
  “2023 was defined by the advances and widespread usability of generative AI … and its use in more intricate and deceptive malicious campaigns.” They even quote our report on The Role of AI in Email Security (which they co-sponsored).
• Details on attacks against SaaS apps, such as Zendesk and Salesforce
  Perception Point protects users from threats, irrespective of where they come from. Email was the starting point. Collaboration and SaaS apps followed. The report dives into some of the forms that attacks against Zendesk and Salesforce take (among others), and why organizations need security protections over uploaded content and shared URLs via these services.
• Hospitality sector under attack
  “Phishing attacks against the hospitality sector are often focused on stealing the Booking.com login credentials for a given hotel – so they can then access hotel profiles and acquire guest information, including emails, phone numbers, and financial details – for use in large-scale phishing campaigns.”