Phishing is the top threat faced by organizations

Both users and their endpoint devices are the primary target for cyber criminals with phishing being the most prevalent threat according to a new report.

The study from research and education specialist the SANS Institute finds security professionals rate phishing at 72 percent, spyware at 50 percent, ransomware at 49 percent, and Trojans at 47 percent as being the top threats today.

Phishing has the biggest impact, with 40 percent of survey respondents having experienced phishing attacks, including spearphishing and whaling in the last year.

"Users and their endpoints are still in the cross hairs," says Lee Neely, SANS analyst, mentor instructor and author of the survey report. "Traditional and malware-less threats keep popping up at every corner, making our jobs as defenders resemble an ongoing game of Whack-a-Mole to keep them at bay."

Almost a third of respondents say they have experienced a malware-less threat entering their organization, impacting IT systems and adding to IT staff workload. These attacks are more difficult to find because they can't be detected by signature-based technologies. Scripting attacks are the most common malware-less incident, while credential compromise or privilege escalation caused the most impact.

Interestingly, few of the threats experienced are new zero-days, with 76 percent of security professionals admitting that less than 10 percent of the significant threats they saw were zero-day. "Today's threats predominately leverage the same old vulnerabilities and techniques," adds Neely. "The time is ripe to change our protections as well as remediation processes to stem the tide of successful threat vectors."

On a positive note, while users are the primary target of these attacks, they can also be part of the solution. In the survey, 37 percent of respondents indicate that calls to the help desk assist them to discover the most impactful threats.

You can discover out more about the findings by registering for a free webcast to be held on 15 August at 1:00pm EDT.

Image Credit: Ivelin Radkov/Shutterstock