"Based on 481 ransomware attacks from the Dutch police and a Dutch incident response party, we arrive at a number of key insights: Insurance led to a 2.8x higher ransom amount paid, without affecting the frequency of payments. Data exfiltration led to a 5.5 times higher ransom amount paid, without affecting the frequency of payments. Organizations with recoverable backups were 27.4 times less likely to pay the ransom compared to victims without recoverable backups.
For those who blame employees for breaches or who think occasionally running a phishing exercise will suffice:
Looking at Verizon DBIR's key insights:
74% of all breaches include the human element through Error, Privilege Misuse, Use of stolen credentials or Social Engineering
So... is C-Suite really investing enough and doing enough to "human-proof?" With numbers like these, will class action lawyers be able to argue more convincingly that management was negligent if it didn't do more to human-proof against breaches?