Ransomware attacks may lead to employee absenteeism or turnover, with the global cybersecurity talent shortage reaching up to 3.4 million

▌01

Most organizations spend up to 60 minutes on each phishing email

According to a new report from Osterman Research, phishing-related activities are consuming one-third of the total time available to IT and security teams, and the cost of processing each phishing email ranges between $2.84 and $85.33.

The report does not calculate the damage costs caused by phishing, but rather the productivity loss of IT and security teams.

The report states that 70% of organizations spend 16-60 minutes on each phishing email. This covers the entire phishing lifecycle, from the initial discovery of a potential phishing email to its complete removal from the environment.

One-third of respondents said they consider current and expected phishing activities to pose a "threat" or "extreme threat" to them. While the current threat level has decreased over the past 12 months, the report states this likely reflects many organizations returning to on-site work, where the phishing risk is lower than with remote work.

Despite this, 67% of surveyed organizations stated that in the next 12 months, they expect the time IT and security teams spend weekly on phishing emails to remain the same or increase.

"As phishing attacks will almost certainly become more numerous, complex, and better able to bypass traditional email security detection, the data above actually indicates how organizations wish to respond to phishing threats, rather than the nature of the phishing attacks themselves."

The SecVerify Security Metric Validation Platform is capable of simulating a series of cyber fraud attacks, such as phishing emails containing malicious links or attachments. It provides enterprises with effective validation services for the efficacy of their security defense systems, reducing the costs spent by security teams handling phishing emails.

You can easily select validation experiments for phishing emails containing malicious links or attachments within the SecVerify Security Metric Validation Platform. By designating AI attack-defense robots to send these emails to specified addresses in your enterprise email system, you can verify whether your company's email security products have the capability to detect these phishing emails and quarantine or delete them.

| Source Reference

https://www.csoonline.com/article/3677451/securing-your-organization-against-phishing-can-cost-up-to-85-per-email.html

▌02

Ransomware attacks may lead to employee absenteeism or turnover

Northwave conducted scientific research on the psychological impact of ransomware crises on organizations and individuals. The findings indicate that members of the crisis response team may experience severe symptoms long after the event, potentially leading to the breakdown of the team.

Northwave believes the reaction to a cyberattack consists of three phases. First is the actual crisis situation, which evolves into an incident phase after about a week. Then, an action plan is formulated, and recovery measures are initiated. Approximately one month later, the "firefighting" is complete, and operations basically return to normal.

Complete recovery may take one to two years. Each phase has its specific physical and mental impacts on the people involved, extending to the organization or other departments. "On average, a company comes to a standstill for three weeks after a malware attack," notes organizational psychologist Van der Beijl. "But to our surprise, psychological issues still surface even a year after the actual crisis occurred."

• One in every seven employees directly or indirectly involved in handling the attack showed symptoms severe enough after several months that they were considered above the clinical threshold for requiring professional trauma therapy assistance.

• One in five employees stated they actually needed more professional help to come to terms with the attack incident.

• One-third preferred having more knowledge and specific tools to handle the psychological impact following an attack.

Ransomware attacks have a lasting psychological impact on how employees view the world. Two-thirds of employees, including those who were not actively involved in handling the attack, now perceive the world as less safe.

These long-term effects impact employee turnover rate:

• One in five people directly affected by the attack has considered or is still considering changing jobs.

• More than half of the managers and IT staff reported long-term absenteeism among several employees months or even a year after the attack occurred.

Ransomware attacks also produced positive residual effects. IT departments found that their companies now give higher priority to cybersecurity, and non-IT colleagues showed more solidarity and empathy.

SecVerify recommends that enterprises proactively prevent ransomware attacks by validating the effectiveness of their own defense systems before an intrusion occurs. The SecVerify Security Metric Validation Platform helps companies precisely assess their defense capabilities with visual, quantifiable data by simulating the attack techniques of real ransomware groups. Addressing ransomware, SecVerify has also introduced a Ransomware Defense Assessment Service to assist you in technically evaluating your ransomware defense capabilities. As shown in the figure below, our assessment service covers all attack phases of the entire ransomware attack kill chain, identifying risks existing at each attack phase for enterprises.

▌03

Global cybersecurity workforce reaches historic high, yet a gap of 3.4 million personnel remains

In announcing the findings of its 2022 (ISC)² Cybersecurity Workforce Study, (ISC)² highlighted the dramatic increase in the shortage of cybersecurity professionals. The study shows the global cybersecurity workforce is at an all-time high, with an estimated 4.7 million professionals.

Despite adding 464,000 cybersecurity professionals this year, data shows that effectively securing assets requires an increase of 3.4 million cybersecurity workers.

70% of respondents stated that their organizations do not have enough cybersecurity staff. More than half of the respondents experiencing workforce shortages believe that staff shortages put their organizations at "moderate" or "extreme" risk of cyberattacks. For organizations looking to mitigate workforce shortages, the research indicates that initiatives to train internal talent, rotate job assignments, establish mentoring programs, and encourage employees outside of the IT or security teams to join the field are the most effective.

At the same time, the report found that 72% of respondents expect their cybersecurity staff to increase or significantly increase in the next 12 months, representing the highest predicted growth rate compared to the past two years (53% in 2021, and 41% in 2020).

• 75% of respondents expressed high job satisfaction, and an equal proportion are passionate about their cybersecurity work, yet 70% of respondents still feel overworked.

• 64% of respondents seek new certifications for skill growth and to keep pace with security trends (53%).

• 20% of employees stated their organizations would increase security budgets in response to violations, but only 16% stated their organizations would hire additional IT staff.

• 61% of cybersecurity professionals primarily focus on the potential risks of emerging technologies (such as blockchain, AI, VR, quantum computing, etc.).

The huge talent gap subjects corporate cybersecurity efforts to rising labor costs. While maximizing the utilization of talent, enterprises must also consider the turnover rate and growth of their cybersecurity teams. SecVerify is committed to helping clients improve the quality and efficiency of their cybersecurity construction. By simulating the most classic and latest cyber attack methods through the security metric validation platform, it precisely assesses the effectiveness and shortcomings of the enterprise's security defense system on one hand, and empowers the security team on the other, helping them keep up with security trends and new attack technologies, coping with attack behaviors through harmless practical exercises to discover weak links in security defenses.