Essential Insights Based on the Verizon Data Breach Investigations Report (DBIR)
By Thin Green | Chief Operating Officer | CyberSe(C) And I
- Ransomware & Extortion Dominate SMB Attacks
- The Reality: Small and medium-sized businesses (SMBs) represent approximately 96% of all ransomware victims where organization size is known. Threat actors deploy wide, opportunistic nets to compromise as many small organizations as possible, hoping for quick payouts.
- Action Item: Maintain isolated, tamper-proof, offsite backups and regularly test restoration procedures to ensure you can recover without paying a ransom.
- Vulnerability Exploitation Outpaces Stolen Credentials
- The Reality: Software vulnerability exploitation is the #1 initial access vector for breaches (31% overall), outpacing stolen credentials and heavily impacting SMB systems.
- Action Item: Enable automatic patch updates for operating systems, web browsers, edge devices, and applications. Prioritize internet-facing systems immediately.
- Human Element Drives 45% of SMB Breaches
- The Reality: Human error, phishing, and pretexting account for 45% of SMB breaches. Mobile-centric scams—such as SMS phishing (smishing) and voice phishing (vishing)—yield higher click rates than standard email lures.
- Action Item: Train employees to spot non-email scams—such as IT helpdesk impersonation calls, urgent SMS password resets, or web pages prompting terminal commands.
- Third-Party & Supply Chain Risks Skyrocket
- The Reality: Breaches involving third parties (vendors, software supply chains, and hosted cloud databases) account for 55% of SMB breaches.
- Action Item: Audit third-party software integrations, OAuth app permissions, and vendor accounts. Revoke stale permissions immediately and enforce strict authentication policies for external tools.
- Multi-Factor Authentication (MFA) is Non-Negotiable
- The Reality: Stolen credentials remain an attacker favorite throughout the entire breach kill chain, appearing in 39% of all breaches.
- Action Item: Mandate Multi-Factor Authentication (MFA) across all remote access points, cloud applications, and email portals. Prefer authenticator apps or hardware keys over SMS text messages where possible.
Connect with Thin Green | Chief Operating Officer | CyberSe(C) And I
Email: thin.green@
