Proper employee training can significantly reduce the financial consequences of phishing in the workplace, supports new research from Wombat Security Technologies and Ponemon Institute.
The Cost of Phishing and the Value of Employee Training revealed that the majority of phishing costs are due to lost employee productivity and uncontrolled credential compromise. When other factors are added, the cost can reach $3,770,000 per year for a mid-sized company.
The data also showed that the average annual cost to contain a credential compromise resulting from a successful phishing attack is $381,920. Uncontrolled credential compromise could cost a business $105,900,000. The total cost of business disruption due to phishing was found to be in the region of $66,900,000.
Furthermore, it was reported that the average total cost for an average business to contain malware is $1.9 million per year. The uncontrollable amount of malware costs the average mid-sized company $105.9 million.
To prove this, studies involving large companies were conducted, and finally the Ponemon Institute found that the click-through rate on phishing emails improved by an average of 64% after security training. This improvement represents the change in behavior among employees who had been victims of phishing scams in the workplace before and after the training. Ponemon estimates potential cost savings of up to $1,800,000, or $188.4 per employee/user.
“As the threat landscape continues to intensify and phishing tactics become increasingly sophisticated, this research shows that employees who have undergone security training are less likely to fall victim to a phishing attack,” said Larry Ponemon, president and founder of the eponymous institute.
“This is yet another proof point that a comprehensive security posture is multifaceted and should include employee training to prevent against increasingly sophisticated phishing attacks, which leave organizations vulnerable to cyberattacks,
” added Joe Ferrara, President and CEO of Wombat Security Technologies. “This research reveals the compelling value and ROI of implementing a comprehensive security training program. Our methods have shown that a continuous educational methodology changes employee behavior and reduces risk to an organization.”
