Over 33% of Employees are Clicking Malicious Links – Phishing Report

Several data breaches were reported this year that were typically due to ransomware attacks, phishing campaigns, and other social engineering techniques, resulting in millions of dollars losing organizations worldwide.

The key takeaway of these data breaches is that most of these attacks happened due to human error or inadequate knowledge about phishing and malware campaigns conducted by threat actors. Vigilance towards these situations would’ve helped in these situations.

PPP (Phishing Prone Percentage)

Most organizations are spending a lot on training their employees against phishing campaigns which have the highest success ratio among all the other social engineering techniques used by threat actors.

According to reports from KnowBe4, the data set taken over 32.1 million phishing simulation attempts across different organizations provided a result of over 33% of employees clicking on the malicious links. The countries and their phishing-prone percentages are

1. North America – 33.1 %
2. Africa – 32.8 %
3. Asia – 30 %
4. Australia and New Zealand – 34.8 %
5. Europe – 32.9 %
6. South America – 41.1 %
7. United Kingdom and Ireland – 35.2 %

As per the published reports, South America, the UK, Australia, and North America seem to be highly vulnerable to phishing attempts. 

North America and its Economic Impact

Ransomware-as-a-service (RaaS) and Business Email Compromise (BEC) seem to be the most devastating issues surrounding the North American region. A survey by Cybereason showed that 58% of organizations suffered a great loss due to ransomware attacks.

In the case of BEC, 56% of the organizations were impacted negatively, resulting in a massive $2.7 billion loss in 2022. Other major economically impactful attacks include Credit card fraud, accounting for $264 million.

The recent report published by KnowBe4 indicates that employee awareness training can bring major security protection to organizations since employees become the first point of interaction regarding phishing attacks.