Organisations faced unprecedented ransomware risk in 2020

Enterprises faced unprecedented cybersecurity risk in 2020 from increasing attack volume, the pandemic-driven digital transformation of work, and generally deficient cyber preparedness and training, according to a new report.

The fifth annual "The State of Email Security," report from Mimecast found 79% of respondents indicated their companies had experienced a business disruption, financial loss or other setback in 2020 due to a lack of cyber preparedness.

The survey was based on a global survey of 1,225 information technology and cybersecurity leaders, and supported by Mimecast's Threat Centre data, which screens more than one billion emails per day.

Respondents identified ransomware as the chief culprit behind these disruptions, with 61% indicating they had been impacted by ransomware in 2020, a 20% increase over the number of companies reporting such disruption in last year's "The State of Email Security" report.

The report found companies impacted by ransomware lost an average of six working days to system downtime, with 37% saying downtime lasted one week or more, while more than half (52%) of ransomware victims paid threat actor ransom demands, but only two-thirds (66%) of those were able to recover their data.

The remaining one-third (34%) never saw their data again, despite paying the ransom.
 
While ransomware was a big problem for organisations in 2020, it wasn't the only one. The report also revealed additional threat trends, including:

• A 64% year-over-year increase in threat volume.
• An increase in email usage in eight out of 10 companies.
• 47% of survey respondents noted they saw an increase in email spoofing activity.
• 71% said they are concerned about the risks posed by archived conversations from collaboration tools.
• All of these data points can be attributed to the pandemic: work-from-home increased email and collaboration tool usage, and threat actors sought to capitalise on the new "digital office" with massive waves of COVID-19-related social engineering attacks.

Despite facing an elevated threat volume, the report found that companies aren't doing well in the area of threat prevention. In addition to the 79% of respondents who indicated a lack of cyber preparedness, 40% of those surveyed said their organisations fall short in one or more critical areas of email security systems, leaving employees open to phishing, malware, business email compromise and other attacks, while 43% said that employee naiveté about cybersecurity is one of their greatest vulnerabilities, and yet only one in five respondents indicated they have ongoing (more than once per month) security awareness training in place.

Given these factors, it's not surprising that 70% of survey respondents believe their business will be harmed by email attacks in the next year. In 2020, only 59% of respondents said they felt this way.