2024年网络钓鱼报告-29正式版.doc

REPORT

2024StateofthePhish

Riskyactions,real-worldthreats

anduserresilienceinanageof

human-centriccybersecurity

2024STATEOFTHEPHISH\REPORT

INTRODUCTION

Imagineasuccessfulcyberattackagainstyourorganization.

Whatdoesitlooklike?Maybeitinvolvesa?endishlyclever

pieceofsocialengineering—aconvincinglurethatcatchesthe

recipientoffguard.Ormaybeitwouldtakeasmarttechnical

exploittogetpastyourdefenses.Butinreality,threatactors

don’talwayshavetotrythathard.

Often,theeasiestwaytobreachsecurityistoexploitthehumanfactor.

Peopleareakeypartofanygooddefense,buttheycanalsobethemost

vulnerable.Theymaymakemistakes,fallforscamsorsimplyignore

securitybestpractices.Accordingtothisyear’sStateofthePhishsurvey,

71%ofworkingadultsadmittedtotakingariskyaction,suchasreusing

orsharingapassword,clickingonlinksfromunknownsenders,orgiving

credentialstoanuntrustworthysource.And96%ofthemdidsoknowing

thattheyweretakingarisk.

Whenobligedtochoosebetweenconvenienceandsecurity,userspickthe

formeralmosteverytime.So,whatcanorganizationsdotochangethis?In

thisreportwe’lltakeacloserlookathowattitudestowardssecuritymanifest

inreal-worldbehavior,andhowthreatactorsare?ndingnewwaystotake

advantageofourpreferenceforspeedandexpedience.We’llalsoexamine

thecurrentstateofsecurityawarenessinitiatives,aswellasbenchmarking

theresilienceofpeopleandorganizationsagainstattack.

Thefoundationofthisreportisasurveyof7,500endusersand1,050security

professionals,conductedacross15countries.ItalsoincludesProofpoint

dataderivedfromourproductsandthreatresearch,aswellas?ndings

from183millionsimulatedphishingmessagessentbyourcustomersover

a12-monthperiodandmorethan24millionemailsreportedbyourcustomers’

endusersoverthesameperiod.

2

2024STATEOFTHEPHISH