It takes just 82 seconds for cybercriminals to trap the first victim of a phishing, according to a report.
This report was compiled by Verizon and examines the analyses of nearly 80,000 security incidents that affected thousands of businesses in 2014.
It was found that, across many companies, around 25% of people who received a phishing email were likely to open it.
“Training your employees is a critical component in combating this threat,” said Bob Rudis, lead author of the report.
Tricking users into opening a phishing message allows attackers to steal credentials and other data, the report said.
"They don't need to use complex exploit software, because they can often steal legitimate credentials," Rudis said.
Analysis of the breaches found that, in many cases, it took less than two minutes for the phishing emails to “catch” their first victim. As Rudis reported, half of the victims clicked on the message within the first hour of being sent, but it took much longer for companies to notice that they had been breached.
The report also says that companies could take drastic measures to defend against phishing emails. Training staff to spot malicious messages could reduce the rate of victims from one in four to one in 20.
Additionally, training employees to recognize the signs of a phishing email would position them as an additional line of defense that would block emails that escaped detection by automated systems.
“Companies should see employees as tools in the fight, not as sheep to the slaughter,” Rudis said.
In addition to phishing, some cybercriminals are attacking companies running un-patched software that is vulnerable to old and known exploits, he said.
More than 99% of the vulnerabilities exploited in data breaches had been known for more than a year, while some vulnerabilities had been known for a decade, Rudis said.
