Speaker 1: Welcome to the Cyber Risk Management Podcast. Our mission is to help executives thrive as cyber risk managers. Your hosts are Kip Boyle, Virtual Chief Information Security Officer at Cyber Risk Opportunities, and Jake Bernstein, partner at the law firm of K&L Gates. Visit them at cr-map.com and klgates.com.

Jake Bernstein: So Kip, what are we going to talk about today on episode 188 of the Cyber Risk Management Podcast?

Kip Boyle: Today's part two of our annual Verizon Data Breach Investigations Report, which I love doing these, there's just so much to cover. So let me get you up to speed. So in the last episode we talked through most of the first two chapters covering the report's overall findings and then some new metrics. And today what we're going to do is complete our review of the four As, I'll remind you what that is in a moment, then we're going to review the incident classification pattern data and then we're going to conclude as we do with industry specific numbers. All right, Jake, you ready to go?

Jake Bernstein: Let's do it.

Kip Boyle: Okay. Right. So there's four As. Last time we did actors and actions. So we've got two down and two to go. So the next one is assets. Now, the asset is the focus of the attacks that we've been discussing, that makes sense, right? So the asset is a thing that somebody wants. They want to possess it, they want to use it, what have you. And so the asset power ranking, so to speak, hasn't changed in its order, but there's still some interesting details that you'll find in figure 33. So that's what we're looking at right now as we go over this area, right? So you got servers at 95%, which is up from 85%. That's what it was last year.

Jake Bernstein: And just to be clear, these are assets in breaches.

Kip Boyle: Yes.

Jake Bernstein: So by percentages, yes. Just to be clear.

Kip Boyle: Assets in breaches. Not just incidents.

Jake Bernstein: Not just incidents. Correct.

Kip Boyle: Breaches, right. The worst kind of incidents.

Jake Bernstein: Yes.

Kip Boyle: People are at 24%, which is down from 35%. User device is 7%, which is down from 10%. Media, 2.4%, way down from 10%. And then we've got this sort of catch-all, network, kiosk, terminal and embedded all less than 1%. So this is a short section. Last year there was that sudden spike in person and media. And this year it's pretty standard stuff. But again, I would go have you look at, start at figure 33 and then continue on figures 34 and 35.

Jake Bernstein: Yeah. And if we look at figure 34 and 35, we see a more detailed breakdown of asset varieties in breaches, which is helpful, right? So we've got server web applications are at 43%, which is down just a little bit. Mail servers, 38%, also down a little bit. The person, end user or employee is about the same as last year, 22%. User device, desktop or laptop is 11%, which is up a little bit. And other now sits at 6%. Now, one of the reasons that... What they've done here is provided a bit more detail on server assets. So you've also got database, you've got a remote access server, which is new, you've got a file server, and some of these aren't new, but they all range from 2% to 1% or so.

And I mean this change did... the only thing that's really concerning is that there has been growth in the server databases, assets has grown. And just keep in mind, the reason that there was such a big fall off in file servers is that last year was that MOVEit related spike, the MOVEit breach, and that obviously directly targeted file servers by definition. So it kind of artificially inflated that. And then if we look at figure 35, we have the top action varieties alongside the remote access servers. And what this means is it's when there was remote access, what were the additional actions related to that breach? And we see that ransomware and exploit vulnerability are both roughly 60%, use of stolen credentials is at about 40%, other is 37%, and then brute force falls down to 30% and Adminware is at 21%.

Kip Boyle: Okay, there's the new term.

Jake Bernstein: And I couldn't find what Adminware meant. I looked and I was like, "What is this?" And my guess is that it is anything that allows the administration remotely. So I suspect it's just that desktop kind of remote server access.

Kip Boyle: Well, yeah. And I wonder if a remote access Trojan would fit into this category.

Jake Bernstein: It might, it might.

Kip Boyle: Or anything like it. Any kind of remote code execution or remote command execution or anything like that.

Jake Bernstein: Yep.

Kip Boyle: Okay.

Jake Bernstein: All right, well, take us home on the forays, Kip.

Kip Boyle: Okay, so attributes, and this is related to VERIS. Now Jake, you want to remind everybody what VERIS is? It's an acronym, yeah?

Jake Bernstein: It is. And of course you asked me that and I don't have it handy, but I can probably scroll rapidly to find it.

Kip Boyle: I'm sorry, I thought you'd have it right at your fingertips. You love definitions, so I just thought-

Jake Bernstein: I do, but that one is...

Kip Boyle: Okay, you scroll, I'll talk. Okay, now these attributes, this has to do with the effects of the incident, right? So confidentiality, integrity, availability are in figure 36, right? Now, confidentiality impacts, well, those are data leaks. Integrity impacts, that's where your data isn't what it's supposed to be. You set it to be something and then it changed into something else and you don't necessarily know that, or you know it, but you don't know how to put it back to the way that it was. And of course, availability, so that's something that we commonly see in ransomware, yeah?

Jake Bernstein: Yep.

Kip Boyle: It's like I'm stealing the of your systems and you can get it back for a small fee. Now, figure 36 shows how often each of these three CIA attributes are impacted over time. And these numbers that I'm about to give you don't add up to 100% because, well, incidents sometimes affect more than just one attribute, yeah? So availability has been north of 60% this year and for the last two years, and it's at 61% this year. So availability is the thing that we seem to be getting creamed on more than anything else.

Jake Bernstein: Sort of.

Kip Boyle: Well yeah, but confidentiality is now taken the first place, right?

Jake Bernstein: Yep, it has.

Kip Boyle: Yeah, 68% of all incidents, right? And of course, just perhaps goes without saying, but 100% of breaches are confidentiality breaches the way that it's defined in here.

Jake Bernstein: By definition, yeah.

Kip Boyle: Yep.

Jake Bernstein: And while allow me to interrupt with VERIS, so this is why I forgot what it means. It's the Vocabulary for Event Recording and Incident Sharing framework. It is just all of this vocabulary, whether it's things like server, database, person, end-user device, all of these are VERIS terms. It's the vocabulary that allows us to talk about this stuff meaningfully. That's really all it is. It's very important.

Kip Boyle: Yeah, well, it is, and that's why I wanted to take a moment and kind of refresh on that. So thank you. All right, so in terms of these VERIS attributes and the impacts, so we've talked about how confidentiality is in first place, availability is in second place, and then here comes our good friend, integrity, 51% of all incidents affected integrity. And so yeah, what we're seeing is these modern attacks are affecting the whole CIA triad or more than one anyway, right?

Jake Bernstein: Yeah.

Kip Boyle: So last year the chart had 38% for confidentiality and what, roughly 33% for integrity. So it's a complete change-up this year.

Jake Bernstein: It is. And I think the reason is that old-school attacks really did only impact one of these attributes and bad guys have just realized we can cause more havoc, get more money, do whatever it is we need to do if we actually target all three.

Kip Boyle: Yeah, it's like, "We're here, let's tip this over too."

Jake Bernstein: Yep.

Kip Boyle: Okay, now we've got some new data about the data in confidentiality breaches, okay? And I believe this is figure 37 on page 34, that may be too many numbers, but here comes some more. So internal data is a target. So it's explicitly gone after in 50% of all the breaches. Personal data shows up in about 32% of breaches. Credentials are down this year to 19%. System and secrets both at 12%. Medical 9%. Bank information, 6%. Sensitive personal data, 4%. Session keys, 3%. Then we've got our other category at 1.4%. And interestingly enough, payment data, way down at the bottom, 1.2%,

Jake Bernstein: Yeah. And I'll mention that in a second, but the growth of medical data as a specifically compromised data variety is pointed out as "worth pointing out" by the DBIR team. They opine that it is a result of the medical industry simply getting more attention from ransomware operators and is probably going to continue to increase. And if you look at page 38, what we'll find is that it shows how medical data dipped to almost last place last year, but I mean, it's back up to first place followed by bank and sensitive personal data, of the ones that its... These are select varieties, right? We're only looking at medical, sensitive personal, bank and payment.

Now about payment going away, I mean, I think it's somewhat intuitive, but the DBIR authors believe that it's probably a result of the widespread adoption of NFC and chip-based card payments for card present transactions and then tokenized solutions for card not present ones. And they do say if you want to find out more, you can go find something called the payment security report, which sounds like a blast for sure.

Kip Boyle: Now I want to say something about figure 38 because if you look at this figure, it just shows payment just inexorably going down to the right, and in this case, that's very good, whereas all the other ones are just sort of porpoising all over the place.

Jake Bernstein: Yep. Okay, the last thing we want to do is touch on incidents with no disclosure. What is that? I mean, really it's a denial of service and it remains the undisputed king. This is obviously an availability issue that the VERIS framework classified as "degradation". Unsurprisingly, shows up in 78% of incidents without data disclosure. The second most common variety is obscuration at 19%. And I'm going to admit, I'm not 100% sure what obscuration is.

Kip Boyle: You're not 100% sure about the 19%.

Jake Bernstein: But it's only 19%. And then slowly creeping upward is this interruption at 2.3%. And a lot of it has to do with third-party service providers. And that is one of the themes of this year's DBIR is the importance of third-party service providers and we could see interruption getting even more prevalent. All right.

Kip Boyle: Okay, nice. All right, so now we're about to go into incident classification patterns, but first I want to look at page 36 of the report. So that's right before we transition into the classification pattern. So discovery method and timeline is the header on the page. Now the vast majority of breaches are disclosed by the cyber attackers themselves, or the actors, is the turn of phrase in here, which I don't particularly like using that term. And how did they do that?

Jake Bernstein: Well, because it had to be four As and so it had to be act-

Kip Boyle: Attacker?

Jake Bernstein: Could have been attack, that's true.

Kip Boyle: Could have been attacker, right?

Jake Bernstein: Except it isn't always an attacker, right? When it's an error, the actor is often foolish, but otherwise innocent person.

Kip Boyle: Okay. All right, I'll run with that.

Jake Bernstein: So yeah.

Kip Boyle: However, what we're seeing is that the vast majority of the breaches are disclosed by the actors themselves. So that means the first time you hear that you've been breached is from the person or the group that's breached you, which I don't know if I prefer that over having Brian Krebs call me up and ask for comment before he runs the piece on how I've been breached. But when it happens, when the actors are doing it, you're getting a ransom note, pleasantly worded, which is ironic. Or when your data shows up in the dark web and possibly is up for auction. Now there's some data on the discovery method of non-actor disclosed breaches and you'll find that in figure 40 on page 36. Let's see here, infrastructure monitoring catches 18% and employee reporting 14% and thankfully customer reporting down at 10%. And it's interesting that the number one way is other.

Jake Bernstein: Other.

Kip Boyle: Yeah.

Jake Bernstein: The ever-popular other.

Kip Boyle: Yep, yep. A whole bunch of hodgepodge of things.

Jake Bernstein: Yep.

Kip Boyle: All right, now, dwell time. It's improved by about six days. So between 2022 and 2024, and that's actually more impressive than it sounds because real numbers are 30 days to discovery in 2022 and only 24 days in 2024. So that's almost a full calendar week of improvement. And jeez, Kip, would you like six days of not being tortured? Yes please.

Jake Bernstein: I think so. Yeah.

Kip Boyle: I'll take that. Sounds like a good deal to me. All right, now let's go on to incident classification patterns. All right, so lost and stolen assets have half a page going on here, but this signifies the fact that the stats just really aren't changing. You either encrypt your laptops and thumb drives and lose them or you don't. So you can look at page 39, just to kind of refresh yourself here, but I want to look at figures 43 and 44, same page. Now this figure, let's see, which one am I looking at here? 43. Okay, so actually they both... No, yeah, 43 shows incidents over time and I am glancing at the report because I've got it up here on my screen.

So let's just focus on the changes because there are some. Denial of service falls by almost half down to roughly 30% and it gets overtaken by system intrusion, which is now up to 35%. And social engineering, holding steady, maybe a little bit of growth, around 20%, and everything else is pretty flat with no changes really worth looking at. But what about breaches, Jake?

Jake Bernstein: Well, thank you for asking Kip. The big news is that system intrusion just goes up and up and up while those old miscellaneous errors really fell back down to earth. And to kind of give you a sense here. So system intrusion is now over 50% of breaches and that gap has only widened with second place, which is social engineering again, as it should be of course, which is call it 20-ish%. It's hard to say.

Kip Boyle: Yeah. Maybe just under.

Jake Bernstein: Maybe just under. Miscellaneous errors is now tied in third place with basic web application attacks, which are actually up a little bit from last year at maybe 15-ish%. And then everything else is hovering around below 10%.

Kip Boyle: Yeah. And it's striking when you look at this because system intrusions are just-

Jake Bernstein: Yes, it just-

Kip Boyle: Taking off a rocket or at least a military jet, how about that?

Jake Bernstein: And it doesn't look necessarily like miscellaneous errors spiked, but it actually really did. It went from fourth place in 2023 at about, again, maybe roughly 10%, to last year miscellaneous errors was in second place, second only to system intrusion and it was close to 30, maybe 25% or so. So that was a big change.

Kip Boyle: Yeah, what I talked to my customers about is systems intrusions and social engineering as being really the two big issues. So we're still there.

Jake Bernstein: So if you happen to be reading along, we are going to go as quickly as we can through pages 39 to 65, which is a pretty big chunk of report, but this is where you can find detailed information about each of the eight attack patterns except for that little tiny half page that lost and stolen assets got. So we're going to begin, again, as you do because it's always first with system intrusion. And we learned that despite some shifts in tactics leveraged by the actors that result in a little bit of movement at the top of actions overall, the effects of system intrusion continue to be felt by the majority of industries and orgs of all sizes. Ransomware drove the growth of this pattern and accounts for 75%, that is not a typo, I did not transpose that, of all breaches in this pattern.

Last year we saw exploitation of vulnerability take first place after a huge spike, but this year things are much more narrow. Even though exploitation of vulnerabilities remains in first place at around 20%, credential abuse is right there at 17% and phishing is up as well to maybe 10% or so. So it's hard to... Well, I suppose we could actually show you what it looks like on screen if we are prepared to do that, but just imagine the first place line going down and the other two primary vectors going up, and that's pretty much... And they're all kind of meeting closer and closer.

Kip Boyle: Yeah, it's a convergence.

Jake Bernstein: It's a convergence, yeah. And while the MOVEit breaches are over, we find that something called Magecart took its place. And Kip, I don't know that you and I really talked much about the Magecart breaches.

Kip Boyle: Uh-uh, I don't think so.

Jake Bernstein: No, we didn't. They were related to online retail operations and apparently accounted for a lot of damage. And honestly, believe it or not, that's all we're going to say about that this year. If you really want to learn more about the Magecart problem, you can either Google it, ask an LLM or read more in the DBIR itself, particularly around page 43, 44-ish.

Kip Boyle: Yeah, there's like six pages devoted to unpacking system intrusion. So there's a lot there.

Jake Bernstein: Yeah. And there is one good piece of news this year is that the percentage of people paying ransom is lower than ever before and shows signs of continuing to drop. I would say this is really good news, Kip, for many reasons. So I mean, one thing it does is it result in a lower average payout. It does this because what happened is that the DBIR team got updated data and then actually revised their median payout from 2023 upward compared to what was shown in last year's report. So just to give you the straight numbers to make it easy. In 2023, it was 150,000, but last year, which again is this report, it was only 115,000. So that's a $35,000 drop in average payments. That's good for everyone. And the percentages of people not paying are really getting up there. I think it's over 50% now.

Kip Boyle: Yeah, but I mean, we-

Jake Bernstein: Which I love to see.

Kip Boyle: But we shouldn't interpret this to mean people are getting attacked less though.

Jake Bernstein: No, no, I do not want to interpret it, but what it means is that people are paying the ransom less. The reason this matters to me is that it will ultimately eventually result in a decrease of ransomware attacks because they'll move on to something else if there's just not the money. Now, let's be honest, it's still a high percentage, right?

Kip Boyle: Yeah.

Jake Bernstein: Still, I mean any-

Kip Boyle: And it's just the ransom amount, it doesn't inaudible.

Jake Bernstein: It is. It's just the ransom amount. No, no, exactly. And think of it this way, look, if you gave any retailer or marketer a 50 plus percent conversion rate, they're going to do a happy dance every day of the week.

Kip Boyle: They're going to go all in on that.

Jake Bernstein: They're going to go all in on that. In real business conversion rates of a quarter would be considered amazing. The good news was in quotes. Okay, so now this isn't the whole section on system intrusion, as Kip said, it's like eight pages, but we only have so much time. So Kip, what's next?

Kip Boyle: Okay, social engineering. Now, the interesting thing here this year is that there's a growth in the espionage motive, so 52%. And also 55% financial, but this is because there's overlap, right? In other words, people are like, "I'm here to steal money, but oh, that's some really cool looking data. I'll take that too."

Jake Bernstein: So actually it tends to be the opposite, "I'm here being a spy, I'm also going to get paid."

Kip Boyle: Well, I mean, whichever way it goes. I mean, I guess that's my point is people are starting to help themselves at the buffet.

Jake Bernstein: Yes, that's right.

Kip Boyle: Whatever you came for, stay for the other stuff. Now, in terms of action varieties, we see phishing at the top, no surprise, 57%. Pre-texting at 30% and then there's something new and it's called prompt bombing at 14%. And then there's another type called baiting, and that's at the tail end of 0.5%. Okay, so I dropped a bomb about prompting. So what is prompt bombing? Okay, so I thought when I first saw this, I thought, "Wow, we're really into AI land here." But no, actually this is about MFA bypass, right? So multifactor authentication, and this is the attackers overloading you with prompts to approve a login to the point where eventually someone says, "Oh my God, just stop. Yes, fine, whatever." inaudible.

Jake Bernstein: Yeah, I mean, and eventually you might just think it's a system problem. And so it might not even occur to people that this is an attacker.

Kip Boyle: Right.

Jake Bernstein: Right? If you get the same prompt over and over and over again, you're like, "What is going on? Fine, just to prove it," to be-

Kip Boyle: That's right.

Jake Bernstein: And then I'll tell it about IT later if I remember to do so. That's prompt bombing, it's bad.

Kip Boyle: Okay, well, so if that's ever happened to you and you're listening to this, if it ever happens again, please don't assume that it's a system malfunction. That's probably somebody trying to just jam their way into your account. Now, so anyway, this is much more common than the three techniques that truly bypass MFA, like adversary in the middle, password dumping and hijacking, like the SIM swapping technique that I think we've talked about before in previous episodes, which are all about the same. And it only shows up at about 4% of all breaches, which is fascinating because this stuff, especially SIM swapping gets a lot of press. So here's to show that just because it's a headline, it doesn't mean it's happening all the time, right?

All right, let's take a look at figure number 52. And for those of you who are following along, that would be on page 47. Now, this is also interesting because it shows how bad guys are bypassing Microsoft 365 MFA, which it's like fire doesn't innovate, right? But hackers do. I remember when MFA was like... If you just turn on MFA, you're golden, right? Nobody knew anything about MFA bypass, but now we've got token theft at 31%, MFA interrupt at 22% and adversary in the middle at 9%. And I think this is only going to get worse, and I think this is going to drive a rush to pass keys, security keys and other ways of protecting our authentication tokens and our one-time codes. So that's where that's going.

Now, business email compromise, still around. In 2024, just that year, the FBI's IC3, which is the internet complaint website, estimates more than 6.3 billion with a B was transferred as part of these attacks. That is an incredible amount of money. And most of the transfers were wire transfers, 88%. And the thinking here is that phishing training works best when you do it more often. And if you look at pages 46 through 51, you're going to be able to unpack that quite a bit. But we are not going to do that now.

Jake Bernstein: We're not. In fact, we're going to actually almost move into industry data to conclude our series this year. But before I do that, I want to encourage everyone to check out the details in this whole section. For example, under basic web application attacks, we learned that espionage has just taken over that attack pattern, which is very interesting. But if you want those details, you are going to have to read the report.

Kip Boyle: Crack it open.

Jake Bernstein: And we're not sponsored. But maybe we'll make that suggestion, not really. So, okay. Yes, I think those are all things that are worth looking at.

Kip Boyle: All right. So thank you for moving us along. So let's see here. Yeah, we're just going to have to leave you hanging. I think it's time to look at the big picture of industry data, Jake.

Jake Bernstein: I think so. Let's do it.

Kip Boyle: So DBIR explains at some length why you shouldn't look at the raw numbers of incidents and breaches and draw conclusions about the state of security in an industry or given industry's likelihood of being attacked.

Jake Bernstein: And we do say this every year, but it's always true.

Kip Boyle: Yep. So when you check out the data, not if but when, you need to keep that in mind, and I say when because this is some of my most favorite data to present to senior decision-makers. They often will find a reason to excuse aggregated data, but when you bring them industry specific data, it's more difficult for them to shoo it away.

Jake Bernstein: Yeah. So okay. So this year they did a bit of a reorg, as they say, in the report, and it now only covers five industries in detail instead of nine. However, Kip, what I didn't mention because I thought it might... I wanted it to be a surprise for you.

Kip Boyle: Yay.

Jake Bernstein: Because we have a whole new section at the end before we wrap it up about some extended analysis. They call it focused analysis. And there's two sections in the focused analysis. One is small to medium versus enterprise. That's what we're going to spend our time. And the other focus part is public sector, which we're not going to look at, but it's there if you want to. So we'll talk more about that soon. But real fast, we are going to look at the industry data. So as usual, the specific recommendation for any industry is to check out the top patterns, and then go back and check out the pattern section, which remember we only skimmed the surface of for useful details. As we say every year, we concur strongly with this recommendation. And then if you're looking for those cool heat map charts, those are located at pages 69 and 70. This is where you find those pattern action and asset organized by industry code, the NAICS code. So Kip, what are we looking at first?

Kip Boyle: Oh man, I just love these charts because I'm a very visual learner and my eye has fun jumping around from one colored cell to the next. But let's look first at finance and insurance, that's NAICS 52. Now, the top patterns in this industry, which collectively account for 74% of all the breaches are system intrusion, social engineering and basic web application attacks. Now, that's a little different from last year, which included a lot of miscellaneous errors, but I think you probably remember that we said miscellaneous errors took a nosedive in general, and it's kind of showing up here as well. Now sticking with the same industry. Threat actors are 78% external, which is up from 69%, and then 22% of the threat actors are internal.

Now, the primary motive at 90%, which I guess it makes sense, this is where the money is, is financial and only 12% for espionage. Now, the data compromised for the financial and insurance industry is first, personal at 54%. We have our grab bag of other at 44%, then it's rounded out by internal data at 35% and then credentials at 22%. Now, hacking, malware and social are the top actions in breaches in this category as opposed to incidents. And the top varieties are ransomwares, the use of stolen creds, phishing, the exploit of vulnerabilities, and backdoor, which is also called a C2, which is command and control.

Jake Bernstein: That's right. And I meant to add that the espionage, as you'll see many times, is significantly up this year. Otherwise, I mean, this is where big money lives, so it's always been a target.

Kip Boyle: Yep.

Jake Bernstein: Okay.

Kip Boyle: Healthcare, right?

Jake Bernstein: So healthcare is NAICS 62 at pages 77 and 78. Slight increase in incidents and breaches this year for healthcare. The top patterns are interesting. You have system intrusion, everything else, and miscellaneous errors accounting for that roughly three-quarters of all breaches with privilege misuse taking last place, which I think is interesting. And as we've seen... Okay, I'll start over. As we've seen in other industries, espionage is an increasingly common motive in the breach, 16% this year. That's a lot, Kip. And it also represents a change in patterns. Last year, miscellaneous errors was by far the top spot, but system intrusion has just totally replaced it and it fell big time. And the big story here, which is not surprising, is the risk created by healthcare industry vendors and suppliers. Third-party breaches impacted a huge number of orgs and patients, and did in fact made headlines all year long. This was the Change-

Kip Boyle: The MOVEit.

Jake Bernstein: Yeah, no, not MOVEit.

Kip Boyle: Oh no, health change.

Jake Bernstein: This was Change Healthcare. Yeah. This was when you couldn't get prescriptions filled and doctors couldn't create medical records. It was that.

Kip Boyle: There was no cash flow for a lot of smaller clinics, doctors either-

Jake Bernstein: Yeah, there was no... Yeah, it very bad.

Kip Boyle: Mortgage their houses or just close their doors.

Jake Bernstein: And look, the DBIR recognizes that if you feel like everything else, that is the category. If you feel like everything else is an unsatisfying category, it's really because of a lack of data. Healthcare is the island of misfit breaches. There's just too many different things going on and we don't have good visibility.

Kip Boyle: Oh man, Christmas in July, I guess. That's what you're making me think about. All right, now the other category of industry is manufacturing. We cannot afford the time, unfortunately, to dive into it, but if you're in the manufacturing industry, which is a huge space, by the way, you're definitely going to want to go in here and check it out. System intrusion is just like a rocket ship in here. So let's go ahead and move on though to discuss the small, medium business sized breaches. But if you're in the public sector, we also want you to look at that section. That's pages 88 to 93. So, all right, Jake, let's get this small business versus large business comparison. What are we learning here?

Jake Bernstein: Okay. So first, a little bit of history. So way back in the sands of time in 2013, the DBIR noted significant differences in the threat landscape between SMBs and enterprise victims. I mean, this is obvious, right? This is obvious stuff, that back in 2013, if you were a big org, you simply faced different threats than small orgs, right?

Kip Boyle: Yeah.

Jake Bernstein: Now, in 2020 when they did this analysis again, so seven years later, the differences were far less noticeable because most business began to kind of coalesce around the same set of tools and the same set of protections. So we all moved to the same basic stuff. And so that was one reason that things didn't... They began to not separate, or I should say they congealed.

Kip Boyle: They converged.

Jake Bernstein: They, thank you, converged. I came up with congealed, which I like, but converged is what I meant. But there was another factor as well, which is the rise of ransomware simply led to a broader target set for the bad guys. Because for a while, the bad guys wanted to get a high price for the data that they stole, but they would ransom it back to you, to the user. And they eventually realized, "Well, I can just sell this." Sorry, let me explain this again better. Originally, they wanted data that they could sell on the dark web. That's what I meant to say. They could sell it on the dark web and they wanted enough data to make these breaches valuable to them, right?

Eventually they realized, "Oh wait, even if a bunch of criminals don't want to buy this data from me, I bet that the person I take it from does want it back." That is what allowed them... That is the example of the innovation. They just wanted any price. And, as ransomware attacks became increasingly automated and therefore easier to do, it became easier to target SMBs than the more heavily defended larger organizations.

Kip Boyle: And by easier, less expensive is another way I think of saying it, because I remember I've talked to many senior decision-makers that kind of had this idea that, "Well, it's not economical to attack me. I'm an SMB. For the same amount of effort, they can tip over an enterprise and do better." And that's just not true anymore.

Jake Bernstein: No.

Kip Boyle: Right? And I think that's the big takeaway here, and I think this totally makes sense to me, the economics are more and more becoming in favor of the cyber attacker, which is putting SMB, which is like 99% percent of all organizations in the U.S. economy into greater peril.

Jake Bernstein: By number, yes, by raw number, yes.

Kip Boyle: Yeah. By raw number, right. Not by number of employees or anything. That's a different way to measure it. Now, the first thing that you need to know is that there's a four to one ratio between small orgs and large orgs according to the report here. Now, it might be intuitive when we think about how many smaller orgs there are versus large ones, but it's right here in the reports, we've got the data that's confirming it. Now, the terms of the top action varieties... Sorry, in terms of the top action varieties by victim size, the most similar variety is use of stolen credentials with 32% of large orgs and 33% of small orgs involved. And I would dare say that that is not statistically significant difference there.

Jake Bernstein: Not at all.

Kip Boyle: So it's essentially the same. And even though these numbers are the same, the other thing you got to factor is that the security posture of these two organizations is probably very, very different, right? The large one's going to have one or more dedicated cybersecurity people. The small orgs, probably none. And there's probably maybe just a handful of IT people, and they all have to share that responsibility, which is that's a pretty big burden. All right. Now, there's also some seriously stark differences. For example, the frequency of the ransomware action variety is 88% in the SMB breaches, but only 39% of the large org breaches, which is a huge spread. And moving on to exploit vulnerability, the numbers there are a little less impressive, but 22% SMB, 9% large organization. So I think these numbers really back up the assertion that size doesn't matter. So make sure you have your data backed up and you are a target.

Jake Bernstein: You are. And Master Yoda, he's always correct, size matters not. But you're right. I mean, it does sound terrible for SMBs. And Kip, my question for you is, does this match your experience in the mythical real world?

Kip Boyle: The mythical?

Jake Bernstein: Yeah. I realized when I said it, that was mind-bending.

Kip Boyle: I love that.

Jake Bernstein: The actual real world. How about that?

Kip Boyle: Yeah, it really does. And what's striking to me is I loved it, actually loved it when you said the mythical real world, because we're talking about the reality, but a lot of SMB leaders are still sort of living in this fantasy that they're not.

Jake Bernstein: Oh, you mean the mythical real world? Yes, that's right. Yeah, it's true. Okay, I like it. And now I like it. I meant it. I meant it.

Kip Boyle: Of course you did.

Jake Bernstein: Yeah. It wasn't in the script, but I meant it.

Kip Boyle: Of course you did.

Jake Bernstein: Okay. So I mean, I agree with that. Now, the other thing that I love about this focused analysis is we also get a comparison at figure 90. And if you're want to follow along, figure 90 is on page 86.

Kip Boyle: Yep.

Jake Bernstein: Of the top actions, again, these are all going to be organized by victim org size. So there's a tiny bit of good news for SMBs here and this is also quite intuitive. Errors account for 18% of large org breaches but only 1% of SMB breaches. So what does that mean? Well, look, SMBs are simply less error prone because of their fewer, and I'm going to be... Some people may get upset with me, hopefully not, don't at me, bro. But in SMBs, you will get employees who dare I say care more or are more careful because when you have fewer employees, you just don't necessarily get... I mean, first of all, it's a numbers game, that somebody accidentally make a mistake. When you have less people, there's fewer people to make those mistakes. However, Kip, there is a big, big, big corollary, malware obliterates the poor SMBs.

Kip Boyle: Yeah.

Jake Bernstein: It is present.

Kip Boyle: And that's so easy to understand, right?

Jake Bernstein: It's so easy to understand. And let me give you the numbers. 85% of SMB breaches involve the malware action. Only 42% of large org breaches do.

Kip Boyle: Yeah.

Jake Bernstein: And then when you get down to social attacks, it's similar. It's a bit more similar. 18% for SMBs, 13% for large orgs, not nearly the difference that we have been seeing in some of these other ones. It's mostly phishing, surprise, surprise. And then pretexting is more common in SMBs than large orgs.

Kip Boyle: Okay. So let's look at the impact by org size. And you might think, "Well, SMBs can't have that much of an impact, right?" Nope, wrong. So there's an exhibit one in the report. So let's see, where's exhibit one?

Jake Bernstein: No, no, sorry, that was... You're supposed to say exhibit, yeah.

Kip Boyle: Oh, no, that's not in the report.

Jake Bernstein: That's your exhibit. That's Kip's exhibit one.

Kip Boyle: That's my rhetorical exhibit.

Jake Bernstein: Well, no, this example is in the report.

Kip Boyle: Okay. So the National Public Data breach, right? So National Public Data is the name of an organization that got breached, right?

Jake Bernstein: And I don't remember hearing it. I mean, I think I might've heard about this, but we didn't do an episode on it as far as I remember.

Kip Boyle: No, no. And it's small. So it was only 20 people. Nobody would've recognized that name, but 2.9 billion records into the dark web as a result of that breach. And I love the way the DBIR says it, the mouse that roared. Indeed.

Jake Bernstein: Yeah. And it's interesting, Kip, I could have given you maybe a little bit more detail on this. Though frankly, there isn't a huge amount. But essentially this company, nobody actually knows how many employees it has. The estimate is from 1 to 20, and the number was never actually disclosed, but we're talking an undeniably small SMB type of company.

Kip Boyle: And in control of almost 3 billion records. That says something about-

Jake Bernstein: Yes. Because Kip, it aggregated data for use in background checks, but that data was breached and it was 2.9 billion records up for sale, including social security number, date of birth and addresses. And it included U.S., Canadian and UK citizens.

Kip Boyle: Thanks National Public Data.

Jake Bernstein: So almost the whole Anglosphere. So, okay, now who's to blame? I didn't even put this in the script. It's organized crime. I mean, it is organized crime, but it's going to surprise absolutely nobody that nation-state actors target large orgs at a much, much higher rate than they do small orgs. And it also should surprise no one that even though these numbers are small, that system admins and end users both impact large orgs far more often than small orgs. Again, these things all make sense. And actually, I guess it is worth pointing out.

Organized crime disproportionately does target small business, but I say that, but even the large businesses are targeted by organized crime around 80% of the time versus 95% of the time for small businesses. So there you go, Kip. That is everything but the public sector, which people should feel free to take a look at. And then of course, the regions which we stopped including in our podcast version, not because we don't care, but because we just don't have time.

Kip Boyle: Yeah. And without going to a part three, but we figure two parts is plenty, and you're going to have to get into the report anyway if you like anything you heard. I mean, we can only skim across the treetops here really.

Jake Bernstein: Indeed.

Kip Boyle: Okay, that wraps up this episode of the Cyber Risk Management Podcast. Today we did part two of our analysis of the 2025 edition of the Verizon Data Breach Investigations Report, the dear old DBIR because we wanted to see what we could learn. We learned a lot. So we'll see you next time.

Jake Bernstein: See you next time.

Speaker 1: Thanks for joining us today on the Cyber Risk Management Podcast. If you need to overcome a cyber security hurdle that's keeping you from growing your business profitably, then please visit us at cr-map.com. Thanks for tuning in. See you next time.