We will wrap up our cybersecurity awareness month with an examination of the current cybersecurity landscape in 2024, evolving tactics of threat actors, the impact of phishing attacks on organizations, and the effectiveness of security awareness programs. As phishing techniques become increasingly sophisticated, it is critical for organizations to understand these trends and enhance their defensive measures.
Evolving Cyber Threats
Diverse Attack Techniques: Cybercriminals are continuously diversifying their attack methods in the ever evolving game of cat and mouse. While phishing remains the primary threat, traditional tactics such as USB drops are still relevant, reported by 60% of organizations. This suggests that attackers are willing to explore a variety of methods, both old and new, to target unsuspecting victims.
The Role of Generative AI: Generative AI is rapidly becoming a significant asset for cybercriminals, enhancing their ability to conduct social engineering attacks. By leveraging this technology, attackers can create realistic and persuasive content—ranging from emails to videos—tailored to their victims. This increases the effectiveness of lures, especially when targeting non-English speakers.
Alarmingly, only 23% of organizations provide training on generative AI safety, leaving a significant gap in readiness to counter such sophisticated threats. To learn more about generative AI and deep fake technology: IBM.
Source: IBM Technology – Youtube
Business Email Compromise (BEC): Business Email Compromise attacks remain a critical concern. Attackers are increasingly using generative AI to craft convincing emails in multiple languages, raising the average monthly targeted BEC attacks to 66 million. Organizations must prioritize defenses against these attacks, given their personalized nature and rising prevalence.
Microsoft and MS365: Microsoft is the most targeted operating system and cloud service as it is heavily used by most enterprises. Over 68 million malicious messages were linked to Microsoft products in 2023, highlighting attackers’ strategy of exploiting user trust. Other brands like Adobe and DHL also featured prominently, but at significantly lower volumes (under 10 million each). This trend emphasizes the need for organizations to educate users on recognizing phishing attempts that leverage trusted brands.

Ransomware Concerns: Ransomware attacks have surged, with 69% of organizations reporting at least one incident—a 5% increase from the previous year. Nearly 60% of organizations faced four or more ransomware incidents annually, highlighting its persistence as a lucrative attack method. While 96% of affected organizations now have cyber insurance, the rate of ransom payments has dropped from 64% to 54%, indicating growing awareness of the risks involved in paying ransoms. Additionally, fewer organizations are regaining access to their data after ransom payments, leading to hesitance in paying.
Emerging Threats
Tailored Phishing Schemes: Phishing attacks that focus on deception and manipulation to compromise users, are gaining traction. These attacks often involve tailored phishing schemes designed to trick users into revealing sensitive information or performing actions that compromise security. Attackers may only send 1 or 2 targeted emails to an organization with an initial email being non-malicious, either to a salesperson or info email to inquire about services or products. This eventually leads to a malicious PDF or link being sent in future emails. Organizations must prioritize educating users on the tactics employed in these types of attacks.
MFA Bypass Techniques: Multi-Factor Authentication (MFA) is a critical line of defense, but attackers are increasingly finding ways to bypass these security measures. Techniques such as SIM swapping, phishing for MFA codes, and using social engineering to convince users to disable MFA are becoming more common. As attackers develop more sophisticated tactics, organizations must ensure their MFA implementations are robust and resistant to these bypass methods. Regular training on the importance of MFA and the risks of bypass techniques should be incorporated into security awareness programs. More about MFA bypass here.
QR Code Phishing: QR codes have surged in popularity, especially with the increase in contactless transactions. It has been seen in the wild with parking apps, restaurants and in public spaces. Attackers can create malicious QR codes that redirect users to phishing sites with ease. Users scanning these codes may unknowingly provide personal information, financial information or download malware. As QR codes become more prevalent, organizations must educate their employees about the risks associated with scanning unknown codes and implement controls to mitigate this threat.
Generative AI in Cyber Attacks: Generative AI is not just a tool for creating convincing content; it is also being utilized for automating phishing attacks at scale. Attackers can generate a vast array of phishing emails tailored to different targets in mere minutes, significantly increasing the volume and variety of attacks. This capability poses a challenge for organizations, as traditional defenses may struggle to keep pace with the speed and sophistication of AI-generated threats. Organizations must integrate training on the risks associated with generative AI and consider employing advanced AI-driven security solutions to detect and mitigate these threats. Gone are the days of phishing emails having spelling or grammar mistakes.
Consequences of Phishing Attacks
The repercussions of phishing attacks can be devastating. While 71% of organizations reported at least one successful phishing attack in 2023, a decrease from 84% in 2022, the negative consequences have escalated. Reports of financial penalties, such as regulatory fines, have surged by 144%, and reputational damage from phishing incidents has risen by 50%. This suggests that even as the frequency of successful attacks declines, their impact on organizations is becoming increasingly severe.
One of the ways that organizations can measure and improve their cybersecurity awareness and resilience is by conducting phishing simulations and continuous training.
Recommendations for Improvement
To bolster their cybersecurity posture, organizations should implement the following strategies:
Human Risk Management: Organizations should adopt structured programs aimed at changing user behavior and prioritizing security awareness. This can include positive reinforcement for reporting suspicious activity, which encourages proactive engagement.
Strengthen Communication and Culture: Building a strong security culture through effective communication and peer support fosters a sense of responsibility among users. Advocacy programs can help engage users and promote best practices in cybersecurity.
Leverage Threat Intelligence: Organizations should use threat intelligence to inform their security awareness programs, tailoring training to address the specific threats faced by their users. Internal data, such as phishing assessment results and user feedback, can provide insights into common risky behaviors.
Focus on Targeted Training: Given the low rates of training on critical threats like BEC, organizations must prioritize targeted training sessions to equip users with the skills to identify and respond to these attacks effectively.
Enhance MFA Security: Regularly review and strengthen MFA implementations, ensuring they are resistant to bypass techniques. Educate users about the importance of MFA and the various methods attackers use to bypass it.
Educate on QR Code Risks: Provide training on the potential dangers of scanning unknown QR codes, emphasizing caution and verification before use.
By enhancing user training, improving security processes, and fostering a strong security culture, organizations can better defend against the increasing sophistication of phishing attacks and other cyber threats. As the threat landscape continues to evolve, a proactive and informed approach will be crucial for maintaining security and resilience.
By prioritizing awareness, behavior change, and strategic use of threat intelligence, organizations can cultivate a more vigilant workforce ready to face the challenges posed by cybercriminals. The path forward demands not just awareness but a comprehensive commitment to change and improvement
Source: Proofpoint