Analysis of the 2024 Verizon Data Breach Investigations Report

Originally published by BARR Advisory.

The 2024 Verizon Data Breach Investigations Report (DBIR)—an annual report examining dominant trends in data breaches and cyberattacks throughout the world—is now out for review. Verizon began releasing this report in 2008, and throughout its tenure it has served as one of the most influential and highly-regarded reports in the cybersecurity industry.

Verizon examined over 10,000 breaches to provide actionable perspective and analysis for companies of all sizes. The 100-page report not only highlights their summary of findings, but provides data-based evidence that companies can use to advocate for security and compliance solutions within their organization. Let’s take a look at some key statistics from this year’s report:

• 14% of breaches involved the exploitation of vulnerabilities as an initial access step, almost triple the amount reported last year.
• 68% of breaches involved a non-malicious human element.
• 62% of financially motivated incidents involved ransomware or extortion, with an average loss of $46,000 per breach.
• 15% of breaches involved a third party.
• 32% of breaches in 2023 involved some sort of extortion (including ransomware).
• 31% of all breaches over the past 10 years have involved the use of stolen credentials.

How Can Organizations Use the DBIR?

So, how can you use this report to inform your security practices? Here’s what BARR experts had to say.

“Every year the DBIR provides companies with essentially free threat intelligence,” said Steve Ryan, attest services manager and head of healthcare services at BARR. “By understanding the current trends and methods employed by bad actors, you can use this information to identify critical points to include in your risk-based security program,” Ryan continued.

“For example, the report shows that 68% of all breaches involved a non-malicious human element, and the median time for an average user to fall victim to a phishing attempt is under a minute. With that information in mind, what specific security training can you provide your employees to mitigate the risk of a breach that occurs as a result of a phishing incident?” Ryan explained.

Strengthening company security awareness training is just one action item that organizations can take from this report. Looking at the key takeaways, organizations should also consider taking steps to:

• Implement a plan to quickly identify and patch critical vulnerabilities once a patch is available.
• Employ multi-factor authentication and a zero trust strategy to prevent stolen credentials.
• With third parties often being a consistent factor in breaches, create a strong vendor risk management strategy that includes consistent communication and transparency with vendors.

Become A Security-First Organization

If we’ve learned anything from the data breaches of the past few years, it’s that security needs to be a priority for all organizations. Armed with the insight from the DBIR on the latest trends in cyber threats, organizations can use this information to become a security-first company.

Ultimately, hackers aren’t interested in whether your company is compliant. They care about getting into and navigating your system. While it can be difficult to create real, lasting change in your security program, the DBIR serves as an invaluable resource for any business that wants to establish themselves as a security-first organization.