The majority of cyberattacks begin with a user clicking on a phishing email. Ever wondor why users continue to fall for phishing emails? According to a new report from PhishMe that found that 91% of cyberattacks start with a phish, the top reasons people are duped by phishing emails are curiosity (13.7%), fear (13.4%), and urgency (13.2%), followed by reward/recognition, social, entertainment, and opportunity. "Fear and urgency are a normal part of every day work for many users," says Aaron Higbee, co-founder and CTO of PhishMe. "Most employees are conscientious about losing their jobs due to poor performance and are often driven by deadlines, which leads them to be more susceptible to phishing." Higbee says PhishMe based the study on more than 40 million simulation emails by about 1,000 of its customers around the world. The study took place over an 18-month span from January 2015 through July 2016. Among the study’s top findings: Higbee adds that Locky's phishing campaign has been effective for the following reasons: It is presented in a business context; it’s personalized to the recipient; there are no noticeable errors in grammar or spelling; and finally, it mimics many organizations’ existing invoice processes. When PhishMe analyzed the Locky data in vertical industries it found that the response rates in the insurance industry were more than one in three (34.7%), while other high response rates occurred in the retail industry at 31.7%; energy, 27.8%; and healthcare at 24.9%. "We don’t really know why insurance was the leading vertical," Higbee says. "It could be that there’s not enough training or insurance workers tend to interact with many external people so the chance for them to receive a phishing email increases." Here’s a look at the average response rate by industry when PhishMe analyzed the "file from scanner" benchmark simulation: Transportation 49% Healthcare 31% Insurance 30% Pharma/Biotech 30% Energy 24% Retail 16% Consulting 14% Utilities 14% Technology 10% Non-Profits 5% Related Content: More Insights
Phishing is the primary vehicle for cyberattacks, according to a study by PhishMe. The report found that 91% of cyberattacks were initiated by a phish. In an effort to prevent such attacks, Google has implemented several measures in recent years, including its own spam filters and automated anti-phishing tools. Other justifications included reward, entertainment and opportunity. Aaron Higbee, co-founder and CTO of PhishMe, said that sensitivity to deadlines and fears of job loss make many employees fall prey to phishing. The study also found that susceptibility to phishing drops almost 20% after a company runs one failed simulation.