Although the tactics and technologies cybercriminals use have evolved over the past 20 years, phishing and other social engineering attacks are nothing new.
But despite the significant amounts of time and money invested in cybersecurity training and awareness, employee carelessness and ignorance remain the most vulnerable parts of the average enterprise’s security posture, writes Adam Whittington, security and services executive at +OneX.
A recent study from security vendor, SlashNext, found that there has been a 341% increase in phishing attacks in the first half of 2024. If that isn’t disturbing enough, an alarming proportion of users still fall for phishing attacks – in our experience with phishing simulations as many as 10% of users among our client companies will still fall victim. Stats from Verizon show that the median time for users to fall for phishing emails is less than 60 seconds.
So what’s going on here? There is little doubt that phishing attacks have grown in sophistication over the past few years. Criminals have added smarter techniques to their arsenal, such as ‘spear phishing’ – which targets people with highly convincing and personalised messages – and QR code phishing (quishing), which deceives a recipient into scanning a QR code that redirects them to a bogus website.
Furthermore, while many phishing messages still give themselves away through poor grammar or unnatural sounding language, the criminals have lifted their game. Generative artificial intelligence (AI) tools such as ChatGPT have been a godsend for cybercriminals, enabling them to generate more phishing emails than ever before while improving the sophistication of their work.
They can, for example, use public data about executives and companies harvested with AI to launch precision attacks on company employees. In addition, Gen AI can help cybercriminals to eliminate misspellings and grammar mistakes, so that their emails seem like credible copies of a communication from a bank or tax authority. Cybercriminals can also use Gen AI to rapidly build convincing landing pages to harvest logins and passwords from people they duped.
With this as the backdrop and with companies taking end-user education seriously, one would imagine that employees would be more alert. But the reality is that cybersecurity has become a topic that bores many end-users.
Not only have they tuned out from the warnings they get from their IT department on an almost daily basis, they have also started to become tired of the friction that cybersecurity causes in their working lives.
Employees who experience cybersecurity training fatigue become less attentive and vigilant when it comes to identifying potential phishing threats. They are more likely to overlook suspicious indicators or engage with malicious content without critically assessing its legitimacy. As such, cybersecurity training fatigue can weaken an organisation’s defences against phishing attacks.
One international study found that 54% of office workers are ignoring important cybersecurity alerts and warnings due to information overload from digital communication. Nearly 47% agreed that information overload is inhibiting their ability to identify threats such as phishing emails, while 36% admitted to cutting corners on cybersecurity practices. Shockingly, less than a quarter report being engaged with their cybersecurity training.
Unless every end user is hypervigilant, it is only a matter of time before an attacker gets their hands on credentials or tricks someone into download a ransomware file. As such, it’s essential to combat cybersecurity fatigue and keep users deeply engaged in the importance of security. It’s helpful to understand why cybersecurity fatigue sets in, in order to rectify or prevent it.
As the research implies, one of the major issues lies in the sheer amount of information employees need to deal with. It’s not just constant cyberthreat warnings and frequent cybersecurity training, they may also get a range of other compliance-related information in their inboxes. They may feel overwhelmed and start to tune out, or their ability to retain information might be compromised.
For employees who are under pressure to perform every day, cybersecurity training sessions might become an unwelcome chore. That’s especially the case when they start to feel that the training is repetitive or that they already know the material. And then there’s the effort involved in complying with security procedures, such as remembering long passwords or using multifactor authentication (MFA) every time they sign on.
Part of the answer lies in implementing information best practices such as policies dictating multifactor authentication (MFA) and strong passwords. These first lines of defence will foil most attempted breaches via phishing attacks. Zero-trust architectures, where no device, user or traffic is implicitly trusted, can also help stop attacks in their tracks. Passwordless authentication can reduce friction for end users.
But, ultimately, humans remain the weakest link. To mitigate this risk, organisaitons should deliver engaging, targeted training initiatives that address employees’ specific needs and foster a culture of continuous learning and improvement. The phishing simulation tools Microsoft offers can be a helpful way to keep people on their toes, correct behaviour and understand end-user behaviour. Strategies such as gamification, role-based training, microlearning and rewards programmes are also effective.
We also find that it helps to take a positive slant, focusing on what employees should do rather than what they must not do.
This means offering ways for employees to do their jobs and remain productive – clear guidance around the right cybersecurity behaviours and principles. Positive reinforcement works better than a punitive approach, especially when the goal is to get users to report to IT when they see a suspicious message or believe they’ve fallen for a scam.
Ultimately, the objective is to create an environment where every employee understands the importance of addressing cyberthreats and commits to playing their part.
With the right technology and an engaged, vigilant workforce, enterprises can be optimistic about their odds of success. But it requires an environment where people feel rewarded for constantly learning and adapting.