Email Security
Mimecast, a leading email and data security company, today unveiled its fourth-annual State of Email Security 2020 report. The findings in this year’s State of Email Security report demonstrate that despite high levels of confidence in respondents’ cyber resilience strategies, there is a clear need for improvement. The large majority (77%) of global respondents say they have or are actively rolling out a cyber resilience strategy.
Leaders are beginning to understand the email perimeter is constantly under attack
The magnitude and scale of possible attacks at the email gateway is of concern to most; 66% of respondents believe it’s inevitable or likely they will suffer from an email-borne attack in the coming year.
Impersonation, phishing, and business email compromise are increasing at a concerning clip
70% of respondents reported the same or increasing phishing at their organisations, and due to the global pandemic, threat actors are broadly using impersonation and BEC to steal from unsuspecting users. The Mimecast Threat Center corroborated this assessment – researchers saw a staggering 30% jump in impersonation globally from January to April 2020.
The effects of ransomware still aren’t improving year over year
More than two thirds of respondents experienced a ransomware attack this year, and an average of 2 days of downtime.
Monthly security awareness training is the best way to train employees
Encouragingly, 36% of respondents receive training monthly, but many aren’t educating employees according to best practices.
In the absence of security awareness training, unsafe URL clicks and data leaks will ensue
Mimecast Threat Center found that employees from companies not using Mimecast Awareness Training were more than 5X more likely to click on malicious links than employees from companies that did utilise the training. The risk these clicks pose is significant: 74% of respondents were hit by malicious activity spread from employee to employee.
Looking beyond your email perimeter towards online brand protection is a business issue that can no longer be ignored
There’s high awareness of the need to protect your online brand and maintain customer trust, but just because the attacks aren’t visible to you, doesn’t mean they’re not happening. 98% of respondents already use or are planning to roll out a DMARC strategy, but it’s just one piece of the brand protection puzzle.
Budget ownership for online brand protection may shed light on how quickly an organisation can respond to an attack
Nearly all organisations – 98% – have a dedicated budget for email spoofing, exploitation and impersonation. Who manages the budget, whether it’s the CIO, CISO, CFO, CMO, can vary; what’s critical is the partnership between the budget owner and a savvy cybersecurity leader that leads to the right knowledgebase and tools investment to detect and respond to brand exploit.
You’re right to have growing concern about web and email spoofing
On average, there are 6 web or email spoofing attacks per organisation each year – and that’s just what they know about. 54% of respondents anticipate an increase in web or email spoofing in 2020, and around 77% are concerned about direct brand exploitation or email domain spoofing attacks.
If there’s one thing we all agree on, it’s that cyber resilience strategies are necessary but still incomplete
The majority (80%) have a cyber resilience strategy or are actively rolling one out, and respondents told us their strategies are stacked with email security, network security, web security, and data backup and recovery solutions. But respondents are still experiencing data loss (54%), a negative impact to employee productivity (40%) and business downtime (24%) due to a lack of cyber resilience preparedness.
When it comes to delivering world-class security, Office 365 needs more cyber resilience
While 92% of respondents use Office 365 for email delivery, the impact to their organisations following an outage or other security event created a lasting impression of the need to build in greater resilience with components like email security.
