CRA Study: Attackers on High Ground as Organizations Struggle with Email Security

Published on
July 6, 2022

New York, NY, July 6, 2022 – Despite years of security investments, many organizations continue to struggle against criminal actors who launch daily phishing and other email-based attacks against them, according to new findings in a survey from CRA Business Intelligence, the research and content arm of the cybersecurity data and insights company CyberRisk Alliance.

The May 2022 survey, conducted among 221 security and IT leaders and executives, security administrators and compliance professionals based in the United States, uncovered a variety of significant and persistent email security challenges.

Most respondents report dealing with some form of email attack daily, with attacks on Microsoft and Google email systems rising substantially. That includes increased abuse of both Microsoft 365 and Google email infrastructure. In addition to phishing emails designed to capture login credentials, email attacks can also contain payloads that include traditional viruses or application macros, such as those that run in Word or Excel.

"With 83% of respondents experiencing at least one email attack daily, email security is still a top concern for most organizations," said Matt Alderman, Executive Vice President at CyberRisk Alliance. "Our research shows that both ransomware and phishing are the top concerns for email security. However, only email encryption and business email compromise (BEC) protection meet customer
expectations. Security awareness and training is the largest gap and needs the most improvement."

Among the findings:

Respondents reported a significant and steady number of email attacks with one-third experiencing up to 25 attacks on a daily basis. Additionally, about half (51%) of all respondents reported up to 25 BEC attacks per day while one in five (21%) said they didn’t know and couldn’t estimate the volume of daily
BEC attacks.
• Security professionals are concerned about the tempo and sophistication of email attacks assailing organizations. At least half the respondents (51%) said they are very or extremely concerned about email attacks in the next 12 months. With the potential costs associated with these attacks and the fact that the vast majority contain an email component, security professionals are justified in their concerns. The threat of a ransomware attack is a top email security concern for two-thirds (65%) of all respondents, followed by an increase in spoofing and phishing (60%).
• Recognizing the serious risks posed by email attacks, a large share of respondents (68%) reported their organization is likely to increase spending on email security in the next 12 months. The potential for serious data breaches is at the heart of their organizations’ email security strategies, according to 67% of respondents, followed by regulatory requirements (46%) and monetary losses due to business email compromise attacks (42%).

A large majority report they currently use file/attachment scanning (85%), security awareness/training (80%), and email backup/archive (80%) while nearly one-third (31%) say they plan to add social engineering to their email security strategy in the near future.

The report also looks at organizations’ spending plans for email security over the next two years and provides a variety of tips to bolster security in the meantime.

The full research report is available for download here.

About CyberRisk Alliance
CyberRisk Alliance (CRA) is a business intelligence company serving the high growth, rapidly evolving cybersecurity community with a diversified portfolio of services that inform, educate, build community, and inspire an efficient marketplace. Our trusted information leverages a unique network of journalists, analysts and influencers, policymakers, and practitioners. CRA’s brands include SC Media, SecurityWeekly, ChannelE2E, MSSP Alert, InfoSec World, Identiverse, Cybersecurity Collaboration Forum, its research unit CRA Business Intelligence, and the peer-to-peer CISO membership network, Cybersecurity Collaborative. Click here to learn more.

We're Here to Help

From news, analysis, and insight, to events, communities, custom content and marketing solutions, the CyberRisk Alliance portfolio provides support to the entire cybersecurity ecosystem. We'd love to help support your goals.