Phishing Costs Up 400% - BLAKFX

New research shows that the cost of phishing attacks has nearly quadrupled over the past six years: Large U.S. companies are now losing, on average, $14.8 million annually, or $1,500 per employee.

That’s up sharply from 2015’s figure of $3.8 million, according to a new study from Ponemon Institute.

According to the study, released Tuesday, phishing leads to some of the costliest cyberattacks.

One of the most expensive threat types is business email compromise (BEC). BEC costs ramped up significantly in 2020, with more than $1.8 billion stolen from organizations as cybercrooks launch ever slicker attacks, either impersonating someone inside an organization or masquerading as a partner or vendor in order to pull off financial scams. Of course, one of the most expensive attacks is ransomware.

But what businesses shell out for extortion payments in ransomware attacks or what gets jimmied out of them in fraudulent BEC wire transfers are both just portions of the true costs of phishing attacks, according to the study, titled The 2021 Cost of Phishing.

When many people hear that an organization paid millions to resolve a ransomware issue, they assume that fixing it cost the company just the ransom. However, the ransoms alone account for less than 20 percent of the cost of a ransomware attack. Because phishing attacks increase the likelihood of a data breach and business disruption, most of the costs incurred by companies come from lost productivity and remediation of the issue rather than the actual ransom paid to the attackers.

Lost Productivity

It’s the lost productivity and mopping up that eat up the lion’s share of the costs of phishing attacks, with a host of other investigative and compliance costs in the mix. Below is a table that summarizes the annual hours incurred for six tasks by the average-sized organization on an annual basis. As it depicts, the most time-consuming tasks to resolve phishing scams are the cleaning and fixing of infected systems and conducting forensic investigations.

Phishing cost components. Source: Ponemon Institute.

Phishing cost categories distribution. Source: Ponemon.

The study found that in an average-sized U.S. corporation of 9,567 people, that lost productivity translates to 63,343 wasted hours every year. Each employee wastes an average of 7 hours annually due to phishing scams: an increase from 4 hours in 2015.

Researchers found that the average annual cost of phishing has increased from $3.8 million in 2015 to $14.83 million in 2021. As the table shows, productivity losses have spiked, from $1.8 million in FY2015 to $3.2 million in FY2021. (Information about BEC and ransomware wasn’t available in FY2015.) In this, the most current study, annual cost of phishing for BEC was estimated to be $5.97 million, while average ransomware costs were estimated to total $996,000.

Other BEC Costs

Some of the study’s key takeaways:

BEC costs nearly $6 million annually for a large organization. Of that, illicit payments made annually to BEC attackers is $1.17 million.
Ransomware annually costs large organizations $5.66 million. Of that, only $790,000 accounts for the paid ransoms themselves.
Security awareness training reduces phishing expenses by more than 50 percent on average.
Costs for resolving malware infections have more than doubled since 2015. The average total cost to resolve malware attacks is $807,506 in 2021, an increase from $338,098 in 2015.
Credential compromise costs have increased dramatically since 2015. As a result, organizations are spending more to respond. The average cost to contain phishing-based credential compromises increased from $381,920 in 2015 to $692,531 in 2021. Organizations experienced an average of 5.3 compromises over a 12-month period.
Business leaders should pay attention to probable maximum loss scenarios. For instance, BEC attacks could incur losses from business disruptions of up to $157 million if organizations aren’t prepared. Malware resulting in data exfiltration could cost businesses up to $137 million.

The Helix22 Solution

There is a solution to the rising costs of data threats and security expectations and that is to install the Helix22 data security SDK. Our goal is to not only offer perfect data security, but to reduce the amount of time and resources required to defend and mitigate security breaches. Further, we can reduce the stress and fear of being the victim of an attack.

What we understand better than anyone else is the new era of data security is one that requires new solutions. The era of perimeter defenses is over as it is proving impossible to keep hackers from breaching the perimeter and accessing data. Further E2E encryption based on old models of RSA cryptography will be obsolete when quantum computing becomes mainstream.

Helix22 is Designed To Be Quantum Immune – Start Your Integration on our Git

Helix22 delivers perfect security assurance due to our genius engineering team that has invented a new model for data security that required an innovative look at the problem. The approach we took was to protect the data itself. Almost all other data security products try to build a perimeter or being fanatic on user credentials. However, once the product is breached or a password is stolen, even if it is 2FA or encrypted, your firms data is in the clear.

You see, the Helix22 cryptography is embedded with the data itself through our inventive and patented cryptography of DNA Binding^TM. Therefore, even if credentials are stolen the data cannot be exfiltrated. This means that all data is 100% protected regardless of the type of attack.

Another substantial advantage of Helix22, is that it protects all data whether at rest, in use or in transit. All communication apps for example, only encrypt data while in transit. Therefore, that encryption become useless for internal IT security or Artificial Intelligence or Machine Learning experimentation. All data generated during these massive computing exercises is equally protected in real time. Plus, the latency period for the Helix22 is exponentially less than any other security product, so it actually contributes to faster processing times.

The Helix22 is easy to install and runs on all platforms, programming languages, networks and devices.

Our Motto

“In Math We Trust”

In this protocol, we are truly a “zero-knowledge” server so your private communications and transmissions remain completely top secret. Even in the event that BLAKFX were subpoenaed, we can honor the request by just handing over the encrypted content…as that is literally all we have. Helix22 also only use keys just one-time and then destroys them. This way the data security is future forward prefect. Therefore, in our unique user-to-user encryption (U2U) world, there is no opportunity ever for any data leak.

The Helix22 data security SDK accomplishes the following:

Protects all your firms data at rest, in use and in transit
Renders ransomware threats obsolete
Eliminates human error
Eliminates all malicious or interior attacks
Verifies original content i.e. minimizes the threat of impersonation attacks and deep fakes
Reduces latency
Installs with 5 lines of code
Runs on any platform, network, device and in any programming language
Protects all data equally as well on the cloud and at the edge
Provides perfect future/forward secrecy
Delivers “zero-knowledge” encryption
Compatible with all cloud, 3rd party and vendor services
Is quantum ready – so there’s no need to upgrade when the time comes
Requires no employee training
Exceeds all gov’t and banking standards
Meets all international compliance regulations

D2D encryption

We can make this claim as the tech engineers at BLAKFX invented and patented a genuine device2device (D2D) encryption. We manage data security transmission through the truly brilliant and also patented universal Helix22 key service. The Helix22 encryption originates on your network or device, not just when the app is opened. This means, that when data arrives to our key server, it is already encrypted so all it needs to do is issue another key. Signal and Telegram cannot claim this level of security. This key will then only work with the intended device, which generates a matching key required to open the data. In this protocol, we are truly a “zero-knowledge” server so your communications and transmissions remain completely top secret. Even in the event that BLAKFX were subpoenaed, we can honor the request by just handing over the encrypted content…as that is literally all we have. Helix22 also only use keys just one-time and then destroys them. This way the data security is future forward prefect. Therefore, in our unique device-to-device encryption (D2D) world, there is no opportunity at all for any data leak.

This same protocol just described, can be the same with all your 3rd party vendors and suppliers. It does not matter in the least what platform they are running or what device they are using or even the type of data, it is all 100% protected. We do however, strongly advise that all firms involved be utilizing Helix22 due to the nature of the data content. Helix22 can ensure that whatever data they are generating is protected as well.

Let’s take it a step further. Even if your organization were a victim of an internal attack or a victim of malicious open source downloads, there is no reason for concern. Any data that has been forwarded, downloaded, copied or saved cannot be exfiltrated. Period. We have the technology industries foremost data packets which are protected with multi-layered, military grade encryption algorithms that have already proven the ability to withstand penetration testing from MI5 and quantum computing attacks.

One final practical genius of DNA Binding^TM is in that it is immediately compatible with whichever system or software you are utilizing. Therefore, any organization can forward information to another and then discuss it and there is immediate privacy.

The BLAKFX Suite of Data Security Products

In addition to the fastest and most secure data protection product available in Helix22, we provide a full range of security products for an holistic approach.

We are on a mission to stop ransomware threats in 2021

Ransomware Auditing as a Service (RaaS): ransomware attacks have skyrocketed in the past year and currently represents the biggest threat to the data of government agencies, military, intelligence agencies as well as private enterprises. BLAKFX developed the first in the world Ransomware Auditing as a Service (RaaS) platform which allows our cyber security engineers to scan your network and simulate real-world ransomware attacks to test the prevention, detection and mitigation strategies of your organization and establish how resilient your network is to real ransomware attacks. After the scan we provide a comprehensive report and our recommendations for remediation.

If you are the victim of an actual ransomware attack, we are able to recover the data that has been hi-jacked during the attack and due to Helix22’s DNA Binding^TM cryptography, restore it to its original state.

DARKHYDRA^{3 –}Auditing/Penetration Testing: we provide cyber auditing & penetration testing services in order to identify the gaps in your network, cloud, communications, network appliances, wireless networks, laptops, desktops & mobile devices, website, backup and 3^rd party applications and services. Once we scan your systems, we provide a comprehensive report and our recommendations for remediation.

MSS & Insider Threat Prevention: BLAKFX has a national security level Secure Operations Center that can monitor your network (via our Managed Security Service) for threats & vulnerabilities as well as your employees via threat behavioral analysis techniques in order to stop threats (including insider threats) before they become a problem for your network, data and organization.

TSCM: many organizations and government agencies are aware of the threats posed by hacking surveillance and data theft but are not aware that Technical Surveillance Counter Measures and Electronic Security are an essential component of overall risk mitigation. BLAKFX’s access to the most sophisticated equipment, military and intelligence community level RF frequencies monitoring expertise is unique in the world.

Physical Security: we offer overall physical security services and designs for your buildings, data centers, cloud providers, airplanes, vehicles and personnel security. We provide full physical security planning, insider threat detection and prevention, physical security audits, certification, and security awareness training.

Global Governments: (restrictions apply) Click here to request information & quotes

*Katim Ultra Secure Smartphone: part of the BLAKFX’s suite of secure products, we are pleased to offer governments, law enforcement, intelligence agencies, military forces globally and enterprises, a fully user2user encrypted phone, with secure messenger, secure email, secure news, secure audio/video calling & secure conference calling.

Blacklight & CyAn – OSINT: the Collection Platform provides real time comprehensive view of collected intelligence from various sources. The system allows for more effective operation management by allowing the operators to control all available intelligence gathering tools from a single, unified dashboard. By allowing centralized control, alongside presentation of key intelligence and insights the overall operational effectiveness is significantly increased.

The Analytics Platform system fuses all field intelligence meta-data and cyber intelligence content, as well as other data sources, to highlight and identify suspicious activity, important events and analyze suspects’ relationships and communications. The system can provide in-depth operational understanding in near-real-time to the field operations teams.

Pre-Crime, Data Fusion and Big-Data Analysis: a full range of capacity for big data analytics. Analyze billions of events, merge data from heterogeneous sources, reveal weak signals and understand the digital behavior of a target are some of the numerous features of the Analytics Center. It’s composed of modules like Analytics, Profile, Relational and Predictive.

LLDDS: Low Level Defender Drone System consists of three essential elements, the first of which is our Ground Based Sensor Node (GBSN). The GBSN employs a very low power, high sensitivity FMCW radar system, functionally integrated with a complementary video/IR detection and confirmation system. The GBSN is controlled by AI and by either a single on-site operator or via remote operator control over our fully secure Command, Control and Communications (C3) SatComm-based network. The second element in the System is a medium endurance, low-level, missile-armed defender drone. This critical airborne asset will provide: persistent or on-demand zone protection including airborne patrol, target identification, target confirmation, and attack. This unmanned, very capable platform is the attack and deterrent end of the LLDD defense chain. It is continuously and closely monitored and controlled by AI and a Controller/Operator – in real-time – via the LLDD C3 SatComm Network. Our highly automated and minimally manned concept employs proven off-the-shelf, ground-based and airborne sensors and platforms combined with proprietary BLAKFX technology.

Note: Items marked with * are available for enterprises as well

BLAKFX is Based on Success

Our founders, Robert Statica PhD and Kara Coppa, also founded Wickr, which is used by the US military and has never been hacked since its inception in 2012. The Helix22 data security SDK is several generations enhanced since then. Dr. Statica also delivered the encryption for the world’s most secure phone, Katim.

Founder – Robert Statica PhD Founder – Kara Coppa Founder – Alex Maslov MS, MBA

Co-Founders of Wickr Katim^TM Ultra Secure Smartphone

Finally, the Helix22 encryption is quantum computing ready so no need to redo all your data security methodologies in a couple of years when everything else becomes obsolete.

We like to refer to Helix22 as “22nd Century Data Security.”

Helix22 – Zero Risk