{"id":9898,"date":"2019-04-10T17:15:48","date_gmt":"2019-04-10T21:15:48","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=9898"},"modified":"2022-11-22T15:42:59","modified_gmt":"2022-11-22T20:42:59","slug":"80-eye-opening-cyber-security-statistics-for-2019","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/80-eye-opening-cyber-security-statistics-for-2019\/","title":{"rendered":"80 Eye-Opening Cyber Security Statistics for 2019"},"content":{"rendered":"\n

Cyber attacks have never been more prevalent than they will be in 2019<\/h2>\n\n\n\n

Note from the Editor:<\/p>

To read the industry’s latest cyber security statistics (or “cybersecurity statistics” if you’d prefer), check out The Definitive Cyber Security Statistics Guide<\/a>.<\/strong> This article is updated throughout the year to provide the most current data and informatio<\/em>n, including cybersecurity statistics for 2019 and 2020.<\/em><\/p><\/div>\n\n\n\n

It\u2019s an interesting and challenging time to be working in the cyber security industry. By and large, research indicates that cybercrime is on the rise<\/a> \u2014 news headlines support these findings as major companies like Marriott<\/a>, Equifax<\/a>, Yahoo<\/a>, and Facebook<\/a> find themselves in the crosshairs of cyber attacks. Even sacrosanct governmental election processes<\/a> the world over are not excluded from falling prey to cybercriminals and are a part of the increasing statistics about cyber security and cyber attacks.<\/p>\n\n\n\n

In this article, we\u2019ll present you with essential cyber security statistics but also want to take a moment to recognize that this incredibly broad category encompasses many areas of concern for individuals, IT security professionals, and business leaders alike. This range of topics include everything from cyber security vulnerabilities such as unpatched software and expired security certificates<\/a> to the costs of cyber security attacks to the number of businesses that implement adequate (or inadequate<\/a>) cybersecurity measures and policies. Cyber security statistics also includes a variety of other topics, but we have neither the time (nor the attention span) to cover all of them in one article. So, we\u2019ll limit it to several categories but will cover other areas in a future article. <\/p>\n\n\n<\/span>\n\n\n\n

So, what numbers have made our list of the 80 top cyber security statistics for 2019? As the saying goes around here: Let\u2019s hash it out. <\/span><\/p>\n\n\n\n

Table of contents<\/p>

<\/polyline><\/svg><\/div>
  1. Cyber attacks have never been more prevalent than they will be in 2019<\/a>
      <\/ol><\/li>
    1. Cyber security statistics: The cybersecurity\nindustry overall and its economic outlook<\/a>
        <\/ol><\/li>
      1. Cyber security statistics: The costs of cyber security attacks<\/a>
          <\/ol><\/li>
        1. Cyber security statistics: Victim data\nand compromised records \u2014 by the numbers<\/a>
            <\/ol><\/li>
          1. Cyber security statistics: Key cyber attack\nstatistics by industry<\/a>
              <\/ol><\/li>
            1. Cyber security statistics: Top data breaches\nof 2018 and 2019 (so far)<\/a>
                <\/ol><\/li>
              1. Cyber security statistics: Most common types of cyber attacks<\/a>
                1. DoS and DDoS attack statistics<\/a>
                    <\/ol><\/li>
                  1. Malware attack statistics<\/a>
                      <\/ol><\/li>
                    1. Man-in-the-middle attack statistics<\/a>
                        <\/ol><\/li>
                      1. Phishing statistics<\/a>
                          <\/ol><\/li>
                        1. Web application attacks and vulnerabilities<\/a>
                            <\/ol><\/li><\/ol><\/li>
                          1. Cyber security statistics: Compliance\nwith cyber security industry best practices<\/a>
                              <\/ol><\/li>
                            1. Final thoughts<\/a>
                                <\/ol><\/li><\/ol><\/div>\n\n\n\n

                                <\/p>\n\n\n\n

                                Cyber security statistics: The cybersecurity\nindustry overall and its economic outlook<\/h2>\n\n\n\n

                                While it\u2019s vital to stay abreast of the most recent cyber security attack statistics and information,\nit\u2019s also important to be aware of general statistics\nabout cyber security as an industry overall, including its economic\noutlook. Depending on where you stand on the side of the cyber security market,\nthe following statistics paint a positive or bleak outlook for your business concerning\nindustry gender representation, profitability, or the mounting costs of protecting\nyour business, customers, and data:  <\/p>\n\n\n\n

                                1 – $1.5 trillion cybercrime economy<\/strong>
                                The cybercrime economy has grown to enjoy at least<\/em>                                 $1.5 trillion in profits<\/a> each year.<\/p>\n\n\n\n

                                2 – 300 billion cybersecurity Market<\/strong>
                                The value of the cyber security market is anticipated to reach $300 billion by 2024, according to a 2019                                 press release<\/a> by Global Market Insights, Inc.<\/p>\n\n\n

                                \n
                                \"The<\/figure>\n<\/div>\n\n\n

                                3 – $15 billion in cyber security funding<\/strong>
                                According to the 2019 President\u2019s Budget released by the White House, the U.S. government plans to spend on cybersecurity-related activities this year \u2014 a 4.1% increase ($583.4 million) over the 2018 budget. However, according to the                                 budget document<\/a>, the caveat is that \u201cDue to the sensitive nature of some activities, this amount does not represent the entire cyber budget.\u201d<\/p>\n\n\n\n

                                4 – 9% increase in cyber security spending<\/strong>
                                Despite data breaches rising at inordinate rates each year, Juniper Research\u2019s                                 Cybercrime & the Internet of Threats 2018 report<\/a> anticipates cyber security spending<\/ins> will only increase by 9% on average per company, per annum. <\/p>\n\n\n\n

                                5 – Small businesses invest <$500 per year in cyber security products<\/strong>
                                The average amount small businesses spend on consumer-grade cyber security products each year, according to                                 Juniper Research\u2019s<\/a> 2018 study. This constituted 13% of the overall cybersecurity market that year. <\/p>\n\n\n\n

                                6 – Women anticipated to make up 20% of the cybersecurity workforce<\/strong>
                                Cybersecurity Ventures estimates that women will represent 20% of the global cybersecurity workforce by the end of the year, according to a company                                 press release<\/a>.<\/p>\n\n\n

                                \n
                                \"20<\/figure>\n<\/div>\n\n\n

                                7 – 20% of CISOs anticipated to be women in 2019<\/strong>
                                Women are anticipated to hold 20% of Chief Information Security Officer (CISO) roles in the cybersecurity workforce by the end of the year, according to Forrester\u2019s                                 Cyber Predictions for 2019<\/a>. This number is up from 13% in 2017.<\/p>\n\n\n\n

                                8 – 49<\/strong>.6 day period between breach discovery and reporting dates<\/strong>
                                The average <\/ins>number of days between when a data breach was discovered and reported was nearly 50 days in 2018, according to a                                 report<\/a> from security intelligence vendor Risk Based Security (RBS). <\/p>\n\n\n\n

                                9 – >70% of cryptocurrency transactions for illegal activity<\/strong>
                                The percentage of all cryptocurrency transactions predicted to be used for illicit activity is anticipated to be 70% by 2021, according to the                                 Cybersecurity Almanac 2019<\/a> by Cybersecurity Ventures. <\/p>\n\n\n\n

                                10 – Security breaches up >11%<\/strong>
                                The percentage by which security breaches have increased over the past year, according to the                                 Ninth Annual Cost of Cybercrime<\/a> global study by Accenture.<\/p>\n\n\n

                                \n
                                \"Data<\/figure>\n<\/div>\n\n\n

                                11 – Security breaches increased by 67%<\/strong>
                                Over the past five years, security breaches have increased by 67%, according to Accenture\u2019s global survey. <\/p>\n\n\n\n

                                12 – SMBs are targeted 43% of the time<\/strong>
                                SCORE<\/a> reports that 43% of cyber attacks target small businesses. <\/p>\n\n\n\n

                                13 – Ransomware attacks occur every 14 seconds<\/strong>
                                The frequency in which Cybersecurity Ventures predicts that a business will fall victim to a ransomware attack this year in its                                 2019 Official Annual Cybercrime Report<\/a> (ACR). The company also estimates that number will increase to every 11 seconds by 2021.<\/p>\n\n\n\n

                                Cyber security statistics: The costs of cyber security attacks<\/h2>\n\n\n\n

                                The costs and damages that result from unaddressed cyber security\nvulnerabilities are, by no means, chump change. Cyber\nsecurity attacks statistics should be an eye-opener for every company \u2014\nparticularly those that operate under the assumption (or with the hope) that a\ncyber attack will never happen to them. Anyone who thinks that their company \u2014\nno matter how small or large \u2014 is not at risk because they lack cyber security vulnerabilities is fooling\nthemselves. Simply put, as technologies evolve and cyber criminals become more\nadvanced, it is a matter of when<\/em>, not if<\/em><\/a> cyber security attacks will\noccur. <\/p>\n\n\n\n

                                Here are some of the cyber security\nstatistics relating to the costs of cybercrime and cyber security attacks:<\/p>\n\n\n\n

                                14 – Cybercrime damages to reach $6 trillion annually<\/strong>
                                Cybercrime damages are anticipated to cost businesses and organizations $6 trillion annually by 2021, according to the 2019 ACR from Cybersecurity Ventures. This number, which is up from the company\u2019s                                 <\/a>2015 estimate of $3 trillion in cybercrime damages annually, \u201crepresents the greatest transfer of economic wealth in history, risks the incentives for innovation and investment, and will be more profitable than the global trade of all major illegal drugs combined.\u201d<\/p>\n\n\n

                                \n
                                \"\"<\/figure>\n<\/div>\n\n\n

                                15 – Ransomware damage estimated to reach $20 billion globally<\/strong>
                                The Cybersecurity Ventures annual crime report indicates that the same costs will reach $11.5 billion<\/strong> annually this year and $20 billion per year by 2021. Unsurprisingly, this type of year-over-year increase in anticipated damages makes ransomware the fastest-growing type of cybercrime in the past year.<\/p>\n\n\n\n

                                16 – Cybercrime costs organizations $13 million per year<\/strong>
                                The average cost of cybercrime for an organization is estimated to be $13 million per year, according to Accenture\u2019s global study. <\/p>\n\n\n\n

                                17 – $1 cybercrime tools and kits<\/strong>
                                Cybercrime tools and kits can be purchased for as little as $1 on the Dark Web and online marketplaces, according to the Cybersecurity Almanac 2019 by Cybersecurity Ventures. <\/p>\n\n\n\n

                                Cyber security statistics: Victim data\nand compromised records \u2014 by the numbers<\/h2>\n\n\n\n

                                When we\u2019re talking about victims of cyber security attacks[<\/a>, we\u2019re referring to individuals, companies, and other organizations that are targeted or victimized in some way. The goal for cyber criminals is often to acquire information \u2014 personal information, names, addresses, financial and other account information, passwords, trade secrets, intellectual property, etc. \u2014 that can be used, traded, or sold on the Dark Web. They accomplish these goals through a variety of methods such as phishing and spear phishing emails<\/a>, URL hijacking, structured query language (SQL) injections, and man-in-the-middle (MitM) attacks<\/a>, as well as a litany of other methods.  <\/p>\n\n\n\n

                                In some cases, the goal is purely financial \u2014 they seek to manipulate and trick targeted employees into making large wire transfers to fraudulent accounts through business email compromise (BEC)<\/a> and CEO fraud attack tactics. Why should the modern criminal go through the hassle of trying to rob a bank the old-fashioned way when they can get the employees at virtually any company to fork over thousands or even millions of dollars to them unwittingly?  <\/p>\n\n\n\n

                                Here is a glimpse of top cyber\nsecurity threat statistics and cyber attack information relating to\ncompromised victims and records:<\/p>\n\n\n\n

                                18 – USA is No. 1<\/strong>
                                While this is something many Americans are usually proud to chant, in this case, it\u2019s not necessarily a positive attribute. The United States holds first place in the ranks of the top countries that are targeted cyber security attacks, according to                                 Norton Security<\/a>. <\/p>\n\n\n\n

                                19 – 12 Breaches Results in +100 million exposed sensitive records<\/strong>
                                All it took was 12 data breaches to expose 100 million (or more) sensitive records in 2018, according to RBS\u2019s report. These 12 breaches accounted for nearly three-quarters of all records exposed that year.   <\/p>\n\n\n

                                \n
                                \"60%<\/figure>\n<\/div>\n\n\n

                                20 – 60% of Americans exposed to fraud schemes<\/strong>
                                Sixty percent of Americans report they or an immediate family member have been victims of a scheme to defraud, according to                                 research<\/a> from The Harris Poll and the American Institute of CPAs (AICPA).  <\/p>\n\n\n\n

                                21 – 23% of Americans are cybercrime victims<\/strong>
                                Nearly one-quarter of surveyed Americans reported they or someone they know were victimized by cybercrime in 2018, according to Gallup\u2019s                                 annual crime survey<\/a>. <\/p>\n\n\n\n

                                22 – 31% of security professionals organizations victims of OT cyber attacks<\/strong>
                                Early one-third of surveyed security professionals say their organizations have experienced cyber attacks on operational technology (OT) infrastructure, according to Cisco\u2019s 2018 Security Capabilities Benchmark Study that was published in its                                 2018 Annual Cybersecurity Report<\/a>. <\/p>\n\n\n\n

                                23 – Reported cybercrime victims only 10-12% of total<\/strong>
                                Donna Gregory, unit chief at the FBI\u2019s Internet Crime Complaint Center (IC3), estimated that only 10-12% of all U.S. cybercrime victims were reported in 2016, according to a                                 New York Times article<\/a>.<\/p>\n\n\n\n

                                24 – 76% of organizations and businesses were phishing targets<\/strong>
                                The number of organizations that were targeted by phishing attempts in 2017, according to Wombat Security\u2019s                                 State of the Phish 2018<\/a> report. <\/p>\n\n\n\n

                                25 – 33 billion records will be stolen<\/strong>
                                This is the number of records that Juniper Research\u2019s Cybercrime & the Internet of Threats 2018 report estimates cybercriminals will steal annually by 2023. <\/p>\n\n\n

                                \n
                                \"146-billion<\/figure>\n<\/div>\n\n\n

                                26 – 146 billion records will be exposed in data breaches<\/strong>
                                The number of records Juniper Research\u2019s 2018 report also estimates will be exposed by criminal data breaches between 2018 and 2023. The report specifies this number represents actual data breaches and not just reported data breaches.  <\/p>\n\n\n\n

                                27 – 88% of companies with >1 million folders don\u2019t limit access<\/strong>
                                According to a                                 global study<\/a> of 130 organizations by Varonis, 88% of the companies with more than 1,000,000 folders lack appropriate access limitations \u2014 leaving 100,000 folders open to everyone (all employees). The report also indicates that 58% of the companies they surveyed have more than 100,000 folders accessible to all employees.<\/p>\n\n\n\n

                                28 – 41% of companies allow all employees access to > 1,000 sensitive files.<\/strong>
                                Varonis\u2019s report indicates that 41% of the companies they surveyed have more than 1,000 sensitive files (those containing credit card information, health records, and personal information that is subject to regulatory compliance) open to all employees.<\/p>\n\n\n\n

                                Cyber security statistics: Key cyber attack\nstatistics by industry<\/h2>\n\n\n\n

                                Defining cyber security attacks\ncan be difficult depending on how specific or generic you want to be in your\ndefinition. As such, trying to find the \u201ctop cyber attack methods\u201d for each\nindustry is virtually impossible because sources and researchers will define\nsuch attacks in different ways. For example, phishing emails can involve\nmalware attacks, so researchers can choose to define them by either method. <\/p>\n\n\n\n

                                With these considerations in mind, we\u2019ve limited ourselves\nto highlighting just a few of the cyber security\nattack statistics relating to various industries:<\/p>\n\n\n\n

                                29 – Ransomware attacks to increase 5X by 2021<\/strong>
                                The Cybersecurity Almanac 2019 from Cybersecurity Ventures estimates that ransomware attacks against healthcare organizations will increase by this amount between 2017 and 2021. This isn\u2019t all that surprising considering that                                 healthcare ranks 15th out of 18 U.S. industries<\/a> with regard to cybersecurity and research shows that hospital employees open one of every seven phishing emails<\/a>. <\/p>\n\n\n

                                \n
                                \"\"<\/figure>\n<\/div>\n\n\n

                                30 – 48% of UK manufacturers are cybercrime targets<\/strong>
                                Nearly half of the surveyed manufacturers in the United Kingdom reported being victims of cybercrime or a cyber security incident at some point, according to a                                 report<\/a> by Make UK and AIG that was carried out by the Royal United Services Institute (RUSI).<\/p>\n\n\n\n

                                31 – 38.4% of mining industry users receive malicious emails<\/strong>
                                According to Symantec\u2019s                                 Internet Security Threat Report (ISTR) 2019<\/a> report, 38.4% of users in the mining industry were targeted with malicious emails. <\/p>\n\n\n\n

                                32 – 1 in 302 emails targeting public administration users are malicious<\/strong>
                                Email users working in the public administration sector receive one malicious email for every 302 emails they receive, according to Symantec\u2019s ISTR 2019 report.<\/p>\n\n\n\n

                                33 – >20 ATM malware families now exist<\/strong>
                                According to Kaspersky Lab, there are now more than                                 20 ATM malware families<\/a> that pose threats to the banking and finance industry. <\/p>\n\n\n

                                \n
                                \"Malicious<\/figure>\n<\/div>\n\n\n

                                Cyber security statistics: Top data breaches\nof 2018 and 2019 (so far)<\/h2>\n\n\n\n

                                Cyber security research and reports from the past several\nyears indicate that cyber attacks are rapidly increasing and the number of new\nattacks will surpass those of previous years. Here are some cyber security attacks that were reported in 2018\nand 2019:  <\/p>\n\n\n\n

                                34 – Personal info of 1.5 billion<\/strong> Indian citizens exposed in Aadhaar data breach<\/strong>
                                The personal information of 1.5 billion Indian citizens (photographs, national ID numbers, phone numbers, addresses, postal codes, and email addresses) was exposed in a                                 massive data breach<\/a> of the nation\u2019s ID database that was discovered in March 2018. <\/p>\n\n\n\n

                                35 – 1.16 billion email addresses and passwords exposed<\/strong>
                                The number of \u201cunique combinations of email addresses and passwords\u201d that was discovered in 2019 in a massive breach called \u201cCollection 1.\u201d This load of information was discovered by an IT security researcher and is thought to be the largest breach in history to date, according to an                                 article<\/a> by Fortune.<\/p>\n\n\n

                                \n
                                \"540<\/figure>\n<\/div>\n\n\n

                                36 – 540 million<\/strong> Facebook users exposed in breach announced in 2019<\/strong>
                                More than half a billion records about Facebook users were publicly exposed in two app datasets that were digitally stored in two Amazon Simple Storage Service (S3) storage buckets, according to a 2019 announcement by                                 UpGuard<\/a>.<\/p>\n\n\n\n

                                37 – Marriott breach exposes 500 million user accounts<\/strong>
                                This statistic reflects the number of user accounts that were exposed in a data breach of                                 Marriott\u2019s Starwood guest database<\/a>, which was disclosed in 2018. <\/p>\n\n\n\n

                                38 – 340 million contacts exposed in Exactis data breach<\/strong>
                                The personal information of 340 million U.S. consumers and business contacts was exposed on a publicly accessible server by Exactis, a marketing and data aggregation firm, according to a                                 report<\/a> by CNET.  <\/p>\n\n\n\n

                                39 – 200 million user accounts exposed via Fortnite cyber security vulnerability<\/strong>
                                The number of Fortnite user accounts were exposed when hackers took advantage of an old,                                 unsecured website page<\/a> to send phishing emails. The flaw was reported in Check Point Research\u2019s January 2019 announcement<\/a>. <\/p>\n\n\n\n

                                40 – 30 million users exposed in 2018 Facebook data breach<\/strong>
                                In 2018, 30 million Facebook users were affected by another data breach, according to                                 Consumer Reports<\/a>. Nearly half (14 million) of those users\u2019 sensitive information was accessed, and the names and contact information of another 15 million were also exposed.<\/p>\n\n\n\n

                                Cyber security statistics: Most common types of cyber attacks<\/h2>\n\n\n\n

                                Cyber security attacks are some of the fastest-growing\ncrimes in the world \u2014 especially for businesses and organizations in the United\nStates. (Juniper Research estimates that the U.S. companies and organizations\nwill be the targets of more than 50% of all cyber attacks by 2023.) As such,\nthere are a lot of statistics in this area that we can cover, including a\nbreakdown of some of the top cyber security threats<\/a>\nand a list of some of the most common types of cyber\nattacks. <\/p>\n\n\n\n

                                In terms of cyber security threats\nstatistics, we\u2019ve put together a list which includes DDoS attack<\/a> statistics, malware attack statistics,\nman-in-the-middle attack statistics,\nphishing-related statistics, and web application attacks and vulnerabilities: <\/p>\n\n\n\n

                                DoS and DDoS attack statistics<\/h3>\n\n\n\n

                                Although the methods and scale of each attack differ, the\nultimate goal of denial of service (DoS) and distributed denial of service\n(DDoS) attacks is the same: The aim is to flood a resource or targeted system\nto deny access to those who need it.  <\/p>\n\n\n\n

                                Internet of Things (IoT) devices are frequently compromised and added to botnets, then used to launch ongoing distributed denial of service malware and brute-force attacks that use common usernames and passwords. As the IoT market continues to grow and more devices are being used across virtually all industries, we anticipate the year\u2019s cyber security statistics will continue to reflect increasing cyber attacks and exploits of this technology in 2019.   <\/p>\n\n\n

                                \n
                                \"20.4<\/figure>\n<\/div>\n\n\n

                                41 – 20.4 billion<\/strong>
                                The anticipated number of Internet of Things (IoT) devices that will exist by 2020, according to a                                 press release<\/a> from Gartner, Inc.  <\/p>\n\n\n\n

                                42 – Routers account for 75% of infected devices in IoT attacks<\/strong>
                                Routers accounted for 75% of IoT attacks in 2018, and connected cameras accounted for 15% of them.<\/p>\n\n\n\n

                                43 – The largest DDoS attack<\/a> on record: 1.7 TBPS<\/strong> 
                                The largest DDoS attack on record, according to                                 NETSCOUT Threat Intelligence Report<\/a> from the second half of 2018, was a 1.7 terabytes per second (TBPS) reflection\/amplification attack<\/a> against a U.S.-based service provider. To provide you with perspective, Netflix recommends five megabits per second for streaming high definition (HD) quality shows and 25 megabits per second for streaming ultra HD quality shows. Eight megabits is equal to one megabyte per second, and one million megabytes is equal to one terabyte. This means that the victim was targeted with an attack using the demand equivalent of streaming 200,000 HD TV shows, or 40,000 ultra HD TV shows, simultaneously.<\/p>\n\n\n\n

                                44 – DoS or DDoS attack could cost enterprises $2 million<\/strong>
                                According to the                                 Annual Cyber Security Report 2019<\/a> report from Bulletproof, a DoS or DDoS attack could cost an enterprise company more than $2 million or up to $120,000 for a small company.<\/p>\n\n\n

                                \n
                                \"\"<\/figure>\n<\/div>\n\n\n

                                45 – IoT devices typically attacked within 5 minutes<\/strong>
                                Five minutes is the average <\/ins>amount of time it takes for an IoT device to be attacked once plugged into the Internet, according to a report from NETSCOUT.<\/p>\n\n\n\n

                                46 – China accounted for more than 50% of DDoS attacks in Q4 2018<\/strong>
                                The percentage of distributed denial of service attacks that originated in China in Q4 2018 fell to 50.43% from 77.67%, according to Kaspersky\u2019s                                 DDoS Q4 Report<\/a>. The United States came in second with nearly 25%<\/strong> and Australia in third with 4.5%<\/strong>. <\/p>\n\n\n\n

                                47 – $20 price tag for DDoS attacks<\/strong>
                                The low cost per target to purchase a DDoS attack ranging from 290 to 300 gigabits per second, according to an ARS Technica                                 article<\/a>. <\/p>\n\n\n\n

                                Malware attack statistics<\/h3>\n\n\n\n

                                According to an article by <\/a>Security Magazine<\/a>, one in 50 emails contain some form of malicious content. As we turn our attention to malware attacks, it is an area of attack that shows no sign of slowing in 2019. Digital Trends<\/a> estimates that 10% of all malicious emails contain malware such as ransomware, spyware, adware, or trojans. Here are some additional cyber security statistics to help increase your understanding of this growing issue:[<\/a><\/p>\n\n\n\n

                                48 – 1,000% increase in malicious PowerShell scripts<\/strong>
                                The use of malicious PowerShell scripts increased 1,000% in 2018, according to Symantec\u2019s ISTR 2019 report<\/p>\n\n\n\n

                                49 – Email responsible for spreading 92% of all malware<\/strong>
                                CSO Online<\/a> estimates that email is the primary method of malware delivery<\/p>\n\n\n

                                \n
                                \"Microsoft<\/figure>\n<\/div>\n\n\n

                                50 – Office files constitute 48% of malicious email attachments<\/strong>
                                Forty-eight percent of malicious email attachments were Microsoft iOffice files in 2018, according to Symantec\u2019s ISTR 2019 report.\u201c.Doc\u201d or \u201c.dot\u201d files represented 37%<\/strong> of malicious email attachments.<\/p>\n\n\n\n

                                51 – Mobile ransomware jumped 33% last year<\/strong>
                                In 2018, the prevalence of mobile ransomware increased by 33%, according to Symantec\u2019s ISTR 2019 report.<\/p>\n\n\n\n

                                52 – Enterprise ransomware increased 12%<\/strong> in 2018<\/strong>
                                Last year, enterprise ransomware increased 12%, according to Symantec\u2019s ISTR 2019 report. <\/p>\n\n\n\n

                                53 – Scripts represent 47.5% of malicious email attachments<\/strong>
                                Nearly 48% of malicious email attachments are scripts, according to Symantec\u2019s ISTR 2019 report.<\/p>\n\n\n\n

                                Man-in-the-middle attack statistics<\/h3>\n\n\n\n

                                Man-in-the-middle attacks are, essentially, the modern form\nof old-fashioned eavesdropping. However, it\u2019s not that simple \u2014 MitM attacks\nalso include the use of content injection or alteration as well as other\ntactics. Here are some cyber security statistics relating\nto MitM attacks and methods:<\/p>\n\n\n

                                \n
                                \"95%<\/figure>\n<\/div>\n\n\n

                                54 – 95% of HTTPS servers vulnerable to MitM<\/strong>
                                According to Netcraft,                                 MitM attacks<\/a> were thought to pose a threat to 95% of HTTPS servers in 2016.<\/p>\n\n\n\n

                                55 – MitM attacks were involved in 35% of exploitations<\/strong>
                                More than one-third of exploitation of inadvertent weaknesses involved MitM attacks, according to IBM\u2019s                                 X-Force Threat Intelligence Index 2018<\/a>. <\/p>\n\n\n\n

                                56 – 10% of companies implement HSTS<\/strong>
                                Only 10% of companies have implemented HTTP Strict Transport Security (HSTS) for websites, according to                                 research<\/a> from W3Techs. <\/p>\n\n\n\n

                                Phishing statistics<\/h3>\n\n\n\n

                                By and large, phishing leads the pack when it comes to the most common types of cyber attacks against businesses. Cofense, formerly PhishMe, reports<\/a> that 91% of cyber attacks start with a spear-phishing email. Here are some additional phishing statistics that you should know:[<\/a><\/p>\n\n\n\n

                                57 – SaaS-mimicking phishing attacks increased<\/strong> 237%<\/strong>
                                Phishing attacks mimicking Software-as-a-Service platforms increased 237% in 2017, according to Phish Labs\u2019s                                 2018 Phishing Trends & Intelligence Report<\/a>.<\/p>\n\n\n\n

                                58 – BEC costs U.S. companies $12.5 billion<\/strong>
                                The Federal Bureau of Investigation (FBI)                                 reported<\/a> $12.5 billion in losses to companies between October 2013 and May 2018 due to business email compromise (BEC). <\/p>\n\n\n

                                \n
                                \"86%<\/figure>\n<\/div>\n\n\n

                                59 – U.S. target of 86% phishing attacks<\/strong>
                                Phish Labs reports that 86% of phishing attacks targeted U.S. victims.<\/p>\n\n\n\n

                                60 – 83% of infosec professionals experienced phishing attacks in 2018 <\/strong>
                                Eighty-three percent of global information security respondents experienced phishing attacks in 2018, according to ProofPoint\u2019s                                 State of the Phish 2019 Report<\/a>.<\/p>\n\n\n\n

                                61 – Phishing, pretexting represent 98 and 93% of social incidents and breaches<\/strong>
                                Verizon\u2019s                                 2018 Data Breach Incident Report<\/a> states that \u201cphishing and pretexting represent 98% of social incidents and 93% of breaches.\u201d

                                <\/p>\n\n\n\n\n\n

                                Web application attacks and vulnerabilities<\/h3>\n\n\n\n

                                Web applications \u2014 everything from calculators and Google docs to webmail platforms and dynamic websites \u2014 are vulnerable to a variety of attack methods such as SQL injections, formjacking, and brute force attacks. According to a <\/a>report<\/a> by Imperva: <\/p>\n\n\n\n

                                \u201cThe overall number of vulnerabilities in 2018 (17,308 increased by 23% compared to 2017 (14,082) and by 162% compared to 2016 (6,615)\u2026 more than half of web application vulnerabilities have a public exploit available to hackers. In addition, more than a third (38%) of web application vulnerabilities don\u2019t have an available solution, such as a software upgrade workaround or software patch.\u201d <\/em><\/p><\/blockquote>\n\n\n\n

                                Web application vulnerabilities create opportunities for hackers to launch devastating attacks. Hackers launch many types of web application cyber attacks \u2014 TrustWave<\/a> reports the two most common attack method as cross-site scripting (XSS), which constituted about 40% of web attack attempts, and SQL injections (24%). <\/p>\n\n\n\n

                                The following is a list of key cyber security statistics relating to web application attacks and vulnerabilities:<\/p>\n\n\n

                                \n
                                \"46%<\/figure>\n<\/div>\n\n\n

                                62 – 46% of websites have high cyber security vulnerabilities<\/strong>
                                Acunetix\u2019s                                 <\/a>Web Application Vulnerability Report 2019<\/a> reports that websites have 46%<\/strong> high and 87%<\/strong> medium security vulnerabilities.<\/p>\n\n\n\n

                                63 – SQL injection and cross-site scripting saw a 38% increase<\/strong>
                                \u201cApplication-layer attacks such as SQL injection or cross-site scripting\u201d increased 38%, according to Akamai\u2019s                                 Summer 2018 State of the Internet\/Security: Web Attack<\/a> report. <\/p>\n\n\n\n

                                64 – Formjacking compromised<\/strong> 4,818 websites monthly in 2018<\/strong>
                                The average number of websites compromised by formjacking code each month in 2018 was 4,818, according to Symantec\u2019s ISTR 2019 report. <\/p>\n\n\n\n

                                65 – 2% of web applications susceptible to RCE<\/strong>
                                Acunetix\u2019s Web Application Vulnerability Report 2019 indicates that 2% of its sampled web application targets were vulnerable to remote code execution, which allows a malicious user to execute virtually any code within a web application. <\/p>\n\n\n

                                \n
                                \"Just<\/figure>\n<\/div>\n\n\n

                                66 – Two TLS vulnerabilities decrease to 0% and 3%<\/strong>
                                As                                 TLS version 1.3<\/a> becomes more prevalent, old SSL and TLS vulnerabilities such as Heartbleed and POODLE (affecting TLS versions up to 1.2<\/a>) have decreased across the internet or become virtually nonexistent, dropping to 0% and 3% of websites respectively, according to Acunetix\u2019s Web Application Vulnerability Report 2019. <\/p>\n\n\n\n

                                67 – 75% of LAN penetration due to web application weaknesses<\/strong>
                                Three-quarters of network penetration vectors resulted from poor web application security protections, according to a                                 2019 report on vulnerabilities in corporate information systems<\/a> by Positive Technologies. <\/p>\n\n\n\n

                                Cyber security statistics: Compliance\nwith cyber security industry best practices<\/h2>\n\n\n\n

                                Ideally, every company, government, and organization\nshould follow industry best practices to ensure their IT infrastructure, data,\nand customer information are secure. However, we\u2019ve long since come to realize\nthat expectations and reality are often two very different things. Recent\nresearch indicates that most companies lack adequate data protections and have\nnot implemented cyber security best practices. This leaves them vulnerable to\ndata loss, financial costs, and reputational harm. <\/p>\n\n\n\n

                                Here is our list of some of the most enlightening recent cyber security statistics we could find concerning\ncompliance issues and industry best practices: <\/p>\n\n\n

                                \n
                                \"Just<\/figure>\n<\/div>\n\n\n

                                68 – Only 2% of IT budget is used for security<\/strong>
                                ZDNet reports<\/a> that only 2% of companies\u2019 IT expenditure last year was used on security measures. <\/p>\n\n\n\n

                                69 – 70% of employees don\u2019t understand cybersecurity<\/strong>
                                The percentage of U.S. employees who                                 lack a basic understanding<\/a> of cybersecurity best practices is estimated to be 70%.<\/p>\n\n\n\n

                                70 – 32% of U.S. companies failed to properly implement SSL\/TLS <\/strong>
                                High-Tech Bridge<\/a> reports that 32% of U.S. companies (16% of European companies) received failing grades for their implementations of SSL\/TLS encryption. [Editor’s note: High-Tech Bridge has since moved their report from the URL cited when we originally published the article.]<\/em><\/p>\n\n\n\n

                                71 – 52.5% companies compliant with PCI DSS requirements<\/strong>
                                More than 50% of companies were estimated to be fully compliant with interim PCI DSS (Payment Card Industry Data Security Standard) requirements in 2017, according to Verizon\u2019s                                 2018 Payment Security Report<\/a>.<\/p>\n\n\n\n

                                72 – 30% of the world\u2019s top websites unsecure<\/a><\/strong>
                                Whynohttps.com<\/a> estimates that 30% of the world’s top 560 websites are not secure. These sites include ESPN.com, BBC.com, Wikia.com, MyShopify.com, Chegg.com &NBA.com.<\/p>\n\n\n\n

                                73 – 93% of companies report implementing password rules<\/strong>
                                Of the 93% of companies that report having password rules, fewer than 25% require mandatory password changes and 53% require quarterly changes, according to data cited by                                 TechRepublic<\/a> in a OneLogin survey.<\/p>\n\n\n\n

                                74 – Outdated and unpatched software constitutes 22% of security issues<\/strong>
                                According to BulletProof\u2019s 2019 report, 22% of the high and critical-risk issues reported consisted of missing patches, out-of-date or no longer supported software.<\/p>\n\n\n

                                \n
                                \"68%<\/figure>\n<\/div>\n\n\n

                                75 – 68% of business don\u2019t have cyber security insurance<\/strong>
                                More than two-thirds of businesses neglect to purchase                                 cyber liability or data-breach insurance<\/a> coverage, according to a Cisco\u2019s 2018 Cyber Security and Insurance paper.<\/p>\n\n\n\n

                                76 – 68% don\u2019t have a disaster recovery plan in place<\/strong>
                                More than two-thirds of small business owners lack a disaster recovery (DR) plan, according to a                                 research by Nationwide<\/a>. The company also reports that 71%<\/strong> of small business owners do not purchase business interruption insurance. <\/p>\n\n\n\n

                                77 – 45% of companies have a uniform encryption strategy or plan<\/strong>
                                Fewer than half of surveyed companies report having an encryption plan or strategy that is applied consistently across their enterprises, according to the Ponemon Institute\u2019s                                 2019 Global Encryption Trends Study<\/a> for nCipher Security. <\/p>\n\n\n\n

                                78 – 73% of companies have minimum cyber security requirements for vendors<\/strong>
                                The percentage of organizations that now require third-party vendors to meet minimum cyber security requirements, according to a BDO USA\u2019s                                 2018 cyber governance survey<\/a>.  <\/p>\n\n\n\n

                                79 – 95% of employees\/end users receive phishing training<\/strong>
                                We\u2019re happy to share that 95% of survey respondents report training employees\/end users to identify and avoid phishing attacks, according to ProofPoint\u2019s State of the Phish 2019 Report <\/p>\n\n\n

                                \n
                                \"95%<\/figure>\n<\/div>\n\n\n

                                80 – 60% of organizations use cloud technology for sensitive or confidential data<\/strong>
                                Almost two-thirds of respondents for the Ponemon Institute\/nCipher Security survey say their organizations transfer confidential or sensitive information to the cloud regardless of whether the data is encrypted or made unreadable.<\/p>\n\n\n\n

                                While there are many other cyber security statistics out there relating to the industry, attacks, and vulnerabilities, we can\u2019t cover all of them in one single post. However, many aspects of these statistics will be covered in future Hashed Out blog posts. Be sure to keep an eye out for our upcoming blog post on the topic of the 2019 cybercrime statistics in particular. <\/p>\n\n\n\n

                                Final thoughts<\/h2>\n\n\n\n

                                While cybercriminals represent a significant threat to companies, organizations, and governments alike, it\u2019s easy to see that they are not the only threats or even the biggest ones. In most cases, the critical threats to organizations are their own lack of adequate defenses <\/a>and employees who are ignorant of cyber threats<\/a>. Organizations can reduce their risks of cyber attacks by following industry best practices and implementing key defense measures such as employee training and the use of encryption<\/a>. <\/p>\n\n\n\n

                                What are some of the important and recent cyber security statistics that you\u2019ve discovered?\nAs always, we invite you to leave any comments or questions in the comments\nsection below.<\/p>\n\n\n\n

                                \n","protected":false},"excerpt":{"rendered":"

                                Cyber attacks have never been more prevalent than they will be in 2019 It\u2019s an interesting and challenging time to be working in the cyber security industry. By and large,…<\/p>\n","protected":false},"author":17,"featured_media":9930,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16,10200],"tags":[175,9508,166,10083],"class_list":["post-9898","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","category-monthly-digest","tag-cybersecurity","tag-cybercrime-statistics","tag-phishing","tag-statistics","post-with-tags"],"views":156453,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Feature-80-facts-1.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/9898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=9898"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/9898\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/9930"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=9898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=9898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=9898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}