Top Cyber Security Risks in 2025

Email is still the biggest target

According to the latest FBI Annual report the number one way criminals are breaking in is still via email.

• 15 of the top 26 Cyber Crimes have a common thread of email as a significant method of attack

• Phishing / Spoofing accounted for 30% of total Cyber attacks, DOUBLE any other category

The #1 Reported Cyber Crime is Phishing / Spoofing

• Phishing typically involves criminals sending a message, enticing you to click a malicious link and login with your Google, Microsoft, or Bank account, to steal your information, intercept banking transfers or hijack your accounts

• Spoofing describes the impersonation of your email account or your trusted contacts via methods such as email forgery or look-alike addresses

Many organizations are doing little to protect themselves

859,532 Cyber Crimes were reported with losses totaling $16.6 Billion, up from $12.5 Billion in the prior year. 

• On average there are 2354 cyber crimes reported per day

256,256 reported cyber crimes incurred tangible losses

• At $16.6 Billion in losses that's an average of $64,778 per incident

Top 5 Categories - By the numbers:

Crime Type Complaints

Phishing/Spoofing 193,407

Extortion 86,415

Personal Data Breach 64,882

Non-Payment/Non-Delivery 49,572

Investment 47,919

Other well-known categories

Crime Type Complaints

[Fake] Tech Support 36,002

Business Email Compromise 21,442

Identity Theft 21,403

Credit Card/Check Fraud 12,876

[Fake] Real Estate 9,359

Crimes Against Children 4,472

Data Breach 3,204

Ransomware 3,156*

SIM Swap 982

Botnet 587

Malware 441

Top 5 Categories - By Financial Loss:

Crime Type Losses

Investment $6,570,639,864 

Business Email Compromise $2,770,151,146 

[Fake] Tech Support $1,464,755,976 

Personal Data Breach $1,453,296,303 

Non-Payment/Non-Delivery $785,436,888

Other well-known categories

Crime Type Losses

Data Breach $364,855,818 

Credit Card/Check Fraud $199,889,841 

Identity Theft $174,354,745

[Fake] Real Estate $173,586,820 

Extortion $143,185,736 

Phishing/Spoofing $70,013,036 

SIM Swap $25,983,946 

Ransomware $12,473,156* 

Botnet $8,860,202 

Malware $1,365,945 

* Ransomware figure is understood to be artificially low due to various entities not reporting, and does not include estimates of lost business, time, wages, files, equipment, or third-party remediation services. CISA estimates "only about one quarter of ransomware incidents were reported".

Categories frequently initiated via Email

• Phishing/Spoofing

• Extortion

• Personal Data Breach

• Non-Payment/Non-Delivery

• Investment

• Business Email Compromise

• [Fake] Employment 

• Credit Card/Check Fraud 

• [Fake] Real Estate

• Advanced Fee

• Lottery/Sweepstakes/Inheritance

• Data Breach

• Ransomware

• Overpayment

• Malware 

Email is a gateway for Cyber Crime

• The common thread across multiple top categories is an email-based attack

• Cyber Crimes with email as a significant attack method accounted for over $13 Billion in losses and 81% of all reported incidents

• Many organizations lack critical email controls, even those with a solid IT team or a respected IT provider

• Effective user training and the right security defenses can strengthen you organization against attacks without a negative impact on productivity

If you are looking for an area to get started in Cyber Security, start with email.

Follow along for tips your team can implement to strengthen your systems, and reach out to find out how we can help.

――――――――――――――――

How can I defend my Business Email?

1. Adopt a paid Business Email platform such as Microsoft 365 or Google Workspace

   • While a free gmail.com or yahoo.com account may be easy to acquire, these offer no means to add basic defenses such as behavioral email filtering or login monitoring. 

   • Paid business accounts start at under $8/mo.

   • When an attacker locks you out of a free account, there is often no way to get back in. In many cases the account is simply lost. 

2. Implement an Email Filter with Behavioral monitoring and Anti-spoofing controls

   • Help detect malicious links, attachments or look-alike senders, impersonating your team or trusted contacts.

   • Identify suspicious behavior from senders attempting to coerce and defraud your users.

   • Configure anti-spoofing measures such as SPF, DKIM, DMARC and DNS Registry Locking to limit the ability for an attacker to impersonate your email system. 

3. Monitor Cloud Logins and Require Multi-factor authentication

   • When someone signs into your email account from a shady device, or they start funneling out large quantities of data, RED FLAGS should go off.

   • Many businesses have no visibility into this kind of activity and are powerless to stop it.

   • Requiring 2-Step / Multi-factor authentication AND implementing Cloud Login monitoring can go a long way towards keeping your accounts out of an attacker's grip.

   • Limit sign-ins to only company managed devices, work profiles on personal phones, and company networks. Ask your security professional about Conditional Access Policies and SASE "sassy" Networking.

4. Implement Security Awareness Training and monitor for Dark Web activity

   • Humans are the weak link in every security program. We don't know what we don't know. And every day new schemes are used to try to trick us and our teams.

   • Adopt a concise, engaging, user friendly training program for your users where they can compete for high scores and win incentives from your leadership such as a treat, financial bonus or other tangible reward on a quarterly or semi-annual basis. 

   • Public systems are frequently breached and passwords end up on the "dark web" where criminals can easily access and attempt to use them. 

   • Adopt a credential manager or other system to monitor business emails and logins for leaked passwords on the Dark Web, enabling you to update them immediately.

5. Leverage a Credential manager and never re-use passwords

   • We all have that friend who's got all their passwords memorized. Maybe it's 50 of them or maybe it's 3 or 4 they cycle through with small variations.

   • As clever or convenient as this may seem, it's an easy way for an attacker to get into multiple accounts from a single Dark Web password list. 

   • A credential manager such as Keeper Security or Bitwardan allows making a new and unique, phrase-based password for every site and app you use. 

   • Change your passwords at least once per year and always use multi-factor authentication. 

   • Be a moving target and diversify. 

But isn't there more to Cyber Security than Email?

• Yes, and a layered defense can help guard against a wide range of attacks.

• For example, Ransomware attacks are often initiated via an email, where a user is enticed to open a malicious link or attachment. Once opened the attack begins on their system and can spread throughout the company.

• While email is the most common entry point, in some ways similar to an unlocked front door on your house... a motivated thief may try various methods in an attempt to extort you for your data, or cause critical downtime for your business and reputation.

• No system is perfect, and if an attacker gets past your email defenses or comes in via another approach, you will need solid endpoint and network defenses to detect and stop them.

Where do we go from here?

For the rest of the story and strategies to defend your business against modern threats, reach out on our contact page. Let's make a plan to help your business stay above the fray and truly thrive. We'll meet you where you are and help you budget for a solution that meets your needs.