Phishing remains one of the most effective weapons in a cybercriminal’s arsenal, targeting human vulnerabilities to breach organizational defenses. While it’s easy to stereotype sales teams as the “gullible” ones most prone to phishing, the reality is far more nuanced. According to Mimecast’s Exposing Human Risk report, developed in collaboration with Cyentia Institute, sales teams…
Ransomware presents big problems for small businesses, with incidents comprising 30% to 40% of all security breaches in companies earning less than $100M annually. This striking statistic from the IRIS Ransomware highlights a critical reality: small and mid-sized businesses (SMBs) are disproportionately affected by ransomware. Meanwhile, large enterprises face distinct challenges as they navigate vast networks…
In an era where digital threats are becoming more pervasive and sophisticated, the Information Risk Insights Study (IRIS) on Ransomware, offers critical data and analysis that shed light on the scale and specificity of ransomware threats globally. The 2024 Ransomware edition of the report not only delves into the quantifiable damage inflicted across various industries…
In our joint report with Tidal Cyber, "How Will Adversaries Attack Us and What Defenses Should We Prioritize?", we explore the dynamic world of cyber threats and defenses through the lens of the MITRE ATT&CK® framework. This comprehensive study, grounded in a multi-source analysis of 22 reports, aims to arm organizations with a nuanced, threat-informed…
As we approach the new year, let’s take a look back at the past twelve months here at the Cyentia Institute. In 2023, we explored, discovered, and maybe even encountered a few challenges in the cybersecurity space. We remained dedicated to shedding light on the complex field of information security. Join us for our Year…
“The business of business is relationships” – Robin Sharma In the intricate dance of modern business, the web of relationships extends far beyond the immediate connections we commonly consider in vendor risk management. As we explored in our previous RiskRecon Relationships Report, the complexity of your business relies not just on your third-party partners but…
One pivotal question echoes amongst the cyber community: “How will adversaries attack us, and what defenses should we prioritize?” This inquiry propels the industry’s quest for insights within the ever-shifting threat landscape. MITRE ATT&CK®, a beacon of knowledge, guides this journey with its repository of adversary tactics and techniques gleaned from real-world observations. However, amidst…
Navigating the cyber landscape can feel like a journey through uncharted territories, gaining valuable insights is akin to discovering treasures in a vast and murky realm. As we gather around the cyber table this Thanksgiving here are 10 revelations that are not only deepening our understanding of the digital battleground but are also equipping the…
Two decades ago, as I embarked on the journey of tracking stats in the dynamic realm of information security, the prevailing belief held insiders responsible for the lion’s share of cyber risk threats. This consensus persisted until our release of the first edition of the Verizon Data Breach Investigations Report (DBIR), a seminal moment that…
One common question I get for EPSS is, “Why does EPSS score CVEs low that are on the CISA KEV List?” The short answer is that the CISA Known Exploited Vulnerability List (KEV) (I think) relies on manual curation/vetting at a single point in time while EPSS is 100% data driven with a strong, on-going…