Phishing hooks half of UK organisations in the last two years

Sophos’s survey of 906 IT directors in Western Europe, which was undertaken by Sapio Research, revealed that larger businesses are most likely to have been compromised by phishing attacks, despite also being most likely to conduct phishing and cyber threat awareness training.

 

Although organisations in the UK fell victim to phishing attacks at a similar rate to those in France (49 percent) and the Netherlands (44 percent), those in Ireland performed significantly better. Just 25 percent of Irish respondents said they had fallen victim to phishing in the last two years.

 

Adam Bradley, UK managing director at Sophos, said: “Criminals are adept at using social engineering to exploit human weakness, so while well-trained employees are an excellent deterrent, even the best end user can slip up.  Organisations need to ensure employees remain vigilant to the threat posed by phishing attacks and ongoing training should be part of that to spot check employees and ensure they respond correctly and continue to follow the guidelines they’ve been given.”

 

“Phishing affects everyone and is one of the most common routes of entry for cyber criminals. As organisations grow, their risk of becoming a victim also increases as they become more lucrative targets and provide hackers with more potential points of failure. Given the frequency of these attacks, organisations that don’t have basic infrastructure in place to spot people engaging with potentially harmful emails and whether their systems are compromised are likely to encounter some really significant problems.

 

“Organisations should block malicious links, attachments and imposters before they reach end users’ inboxes, and use the latest cybersecurity tools to stop ransomware and other advanced threats from running on devices even if a user clicks a malicious link or opens an infected attachment.”

 

56 percent of companies employing between 500 and 750 people said they had fallen victim to phishing in the last two years, while two-thirds (65 percent) had identified instances of employees replying to unsolicited emails or clicking on links contained within them. By comparison, just 25 percent of firms with fewer than 250 people and 36 percent of 250 - 499 employee organisations had been compromised by phishing in the same period.

 

●        Across Western Europe, 54 percent of IT directors at companies employing between 500 and 1,000 people told Sophos’ researchers their organisations had fallen victim to phishing attacks in the last two years

●        This compared to 39 percent of 250 to 499 person companies and just 14 percent of firms with fewer than 250 people

●        50 percent of firms with fewer than 250 people offered training to help employees spot attacks, compared to 78 percent of those with between 500 and 1,000 people

●        79 percent of UK companies conduct regular cyber threat awareness training already, while 18 percent said they plan to offer it in the future