Proofpoint and Ponemon Institute reveal skyrocketing phishing costs

Proofpoint and Ponemon Institute have found that average phishing costs have sored to US14.8bn annually, quadrupling since 2015.
Proofpoint and Ponemon Institute have found that average phishing costs have sored to US14.8bn annually, quadrupling since 2015.

Proofpoint and leading cybersecurity and top IT security research organization, Ponemon Institute, released a new study examining the Cost of Phishing. The report has revealed that the cost associated with phishing attacks has almost quadrupled in the last six years. As a result, large companies in the US are losing an average of US$14.8mn annually, or $1,500 per employee. This is a drastic $3.8mn increase from 2015’s figure.

The cost of phishing

Proofpoint and Ponemon Institute surveyed 600 IT and IT security practitioners in the latest study. According to those surveyed, the most expensive cybersecurity attacks are ransomware attacks and BEC. This cost is not limited to the funds demanded by the attackers, but also to the loss of productivity, and the cost of responding to attacks.

According to Proofpoint, credential compromise precedes BEC attacks and ransomware, as attackers trick or “phish” employees into sharing their login information. The Anti-Phishing Working Group (APWG) describes phishing as a crime that uses social engineering and technical subterfuge to obtain personal and financial data. However, the most concerning aspect of these threats is their growth rate, with the number of phishing attacks doubling in 2020 alone.

“When people learn that an organization paid millions to resolve a ransomware issue, they assume that fixing it cost the company just the ransom. What we found is that ransoms alone account for less than 20% of the cost of a ransomware attack,” said Larry Ponemon, Chairman and Founder of Ponemon Institute. 

“Because phishing attacks increase the likelihood of a data breach and business disruption, most of the costs incurred by companies come from lost productivity and remediation of the issue rather than the actual ransom paid to the attackers.”

Additional key findings
  • One of the most costly outcomes of a phishing attack is the loss of productivity. According to Proofpoint, an average US company of 9,567 people will lose as much as 63,343 wasted hours each year. This equates to seven hours lost per employee per year on phishing scams, a four-hour increase from 2015.
  • The compromise of a business email costs nearly $6mn a year for a large company. $1.17mn of that figure comprises payments made to BEC attackers. 
  • Ransomware costs a large organization on average US$5.66mn. $790,000 accounts for the paid ransoms themselves. 
  • Security Awareness Training reduces phishing expenses by over 50%. 
  • The cost of resolving a malware infection has more than doubled since 2015. In 2021, the total cost to resolve a malware attack is $807,506, a sharp increase from $338,098 in 2015.
  • In addition to the cost of resolving an infection, the credential compromise costs have also increased dramatically in the last five years. Organizations are dedicating more money to respond to these attacks, and as a result, the average cost to contain phishing-based credential compromises has increased from $381,920 in 2015 to $692,531 in 2021.
  • According to Proofpoint, business leaders need to pay attention to probable maximum loss scenarios. For example, BEC attacks could incur losses from business disruptions up to $157mn is organizations are not prepared. 

“Because threat actors now target employees instead of networks, credential compromise has exploded in recent years, leaving the door wide-open for much more devastating attacks like BEC and ransomware,” said Ryan Kalember, executive vice president of cybersecurity strategy, Proofpoint. “Until organizations deploy a people-centric approach to cybersecurity that includes security awareness training and integrated threat protection to stop and remediate threats, phishing attacks will continue.”


About Proofpoint

Proofpoint is a leading cybersecurity and compliance company that protects organizations’ greatest assets and biggest risks: their people. With an integrated suite of cloud-based solutions, Proofpoint helps companies worldwide stop targeted threats, safeguard their data, and make their users more resilient against cyberattacks. Leading organizations of all sizes, including more than half of the Fortune 1000, rely on Proofpoint for people-centric security and compliance solutions that mitigate their most critical risks across email, the cloud, social media, and the web.

For more news from Top Business Tech, don’t forget to subscribe to our daily bulletin!

Follow us on LinkedIn and Twitter

Amber Donovan-Stevens

Amber is a Content Editor at Top Business Tech

Ab Initio partners with BT Group to deliver big data

Luke Conrad • 24th October 2022

AI is becoming an increasingly important element of the digital transformation of many businesses. As well as introducing new opportunities, it also poses a number of challenges for IT teams and the data teams supporting them. Ab Initio has announced a partnership with BT Group to implement its big data management solutions on BT’s internal...

WAICF – Dive into AI visiting one of the most...

Delia Salinas • 10th March 2022

Every year Cannes held an international technological event called World Artificial Intelligence Cannes Festival, better known by its acronym WAICF. One of the most luxurious cities around the world, located on the French Riviera and host of the annual Cannes Film Festival, Midem, and Cannes Lions International Festival of Creativity. 

Bouncing back from a natural disaster with resilience

Amber Donovan-Stevens • 16th December 2021

In the last decade, we’ve seen some of the most extreme weather events since records began, all driven by our human impact on the plant. Businesses are rapidly trying to implement new green policies to do their part, but climate change has also forced businesses to adapt and redefine their disaster recovery approach. Curtis Preston,...