.svg){kind=icon}
.svg)
The world of cybersecurity is a high-stakes battlefield, and the challenges have never been greater. As our technology becomes smarter, faster, and more integrated, cybercriminals are keeping pace, evolving their tactics to exploit every vulnerability.
This article breaks down 170 key cybersecurity insights, statistics, and findings for 2025. We’ll cover the most critical threats, costs to businesses and consumers, and security trends worth considering.
Ready to see what the future holds? Let’s dive into the data and uncover what’s next in cybersecurity.
Table of Contents
Cybersecurity Overview
Cybercrime is on the rise, and attacks are becoming more sophisticated and expensive.
Let’s break down a few introductory statistics to set the stage for the top concerns for cybersecurity professionals.
1. Cybercrime is set to cost businesses up to $10.5 trillion by 2025 and could reach as high as $15.63 trillion by 2029.1
2. Research suggests there’s a worrying correlation between digital transformation and data breaches.2
3. 72% of business owners are concerned about future cybersecurity risks arising from hybrid or remote work.3
4. 74% of businesses are confident in their ability to detect and respond to cyberattacks in real-time, a high of 81% of C-suite leaders vs. 66% of Front-line managers.
AI is everywhere you look – unfortunately, that goes for AI cyber threats, too.
Generative artificial intelligence, or GenAI, is a hot topic in cybersecurity and is unlikely to simmer down in 2025.
• Predicting threats and vulnerabilities ahead of time. (45%)
• Increasing the scale of security patching. (45%)
• Creating more efficient incident response plans. (42%)
• Threat simulation to mimic a wide range of cyber threats. (39%)
• Managing cybersecurity alert fatigue. (36%)
• Threat simulation to mimic a wide range of cyber threats. (68%)
• Managing cybersecurity alert fatigue. (45%)
• Closing the cybersecurity talent shortage and skills gap. (42%)
• Automating security information and event management systems. (37%)
• Increasing the scale of security patching. (34%)
However, it’s also clear that business owners are worried about social engineering and insider threats – and that many companies are re-evaluating who they partner with on the supply chain.
5. 97% of companies are reporting GenAI security issues and breaches. 54
6. 24% of companies believe they can use GenAI technology to make incident response more efficient in the future. 45
7. To combat insider threats, many companies are moving away from encouraging awareness towards behavioral adaptation. 53% of companies actively train staff on how to minimize internal risks. 6
8. Firms are moving toward identity-first security measures – with more than 86% adopting zero trust models. 7
9. By the end of the year, up to 60% of companies on supply chains will be using the risk of cybersecurity as a buying consideration when partnering with others. 8
10. Up to 98% of cyberattacks – against businesses and otherwise – involve social engineering, making this a key trend to prepare for across the next year. 9
11. Around 76% of security leaders are concerned about cyber threats evolving in sophistication – and 72% believe they are “first adopters” of technology to combat them in the years ahead. 10
Cybercrime Costs and Frequency
The cost of cybercrime is skyrocketing for businesses worldwide. Much of this is due to the increasing number of attacks and vectors emerging, meaning companies need to plan wisely to reduce potential revenue loss.
America leads the way in terms of the most expensive cybercrime costs worldwide, but even globally, companies are paying almost $5 million per breach.
Let’s explore some of the most explosive data costs making waves right now.
12. Cybercrime costs are expected to escalate worldwide to almost $14 trillion by 2028.11
13. The average cost of a data breach globally is growing to around $4.88 million, a 10% increase year-on-year.12
14. The industrial sector is experiencing the highest increase in data breach costs, rising by $830,000 on average year-on-year.13 12
15. Data breach costs are projected to be the highest in the U.S., followed by the Middle East, Benelux, and Germany. 14
16. All four territories experience costs higher than the global average of $4.88 million, with the U.S. paying almost double this amount. 14
17. Ransomware costs victims an average of $1.85 million per incident, with attacks rising by 13% over a five-year period. 15
18. The average cost of ransom imposed by attackers increased by 500% over a year, with payments reaching an average of $2 million. 16
19. Phishing attacks currently cost companies an average of $4.88 million to bounce back from. 17
20. Business Email Compromise or BEC attacks are costing companies an average of $4.67 million per attack and account for 8.5% of all data breaches.18
21. BEC attacks have already cost businesses more than $55 billion over a decade. 19
22. Claims made on cybersecurity insurance are increasing by around 13% year-on-year. 20
23. Insurance carriers report an average loss of around $100,000 per claim. 20
24. Only 74% of companies have specific cybercrime insurance to cover losses. 21
25. Written, direct premiums for cyber insurance are expected to reach $23 billion by the end of the year. 22
26. Ransomware accounts for 19% of all claims made on cyber insurance. 20
27. On average, small businesses can expect to pay $120,000 to recover from a cyberattack. 23
28. Only 5% of companies have allocated additional budget to their cyber programs in the past year. 5
29. At least six in ten businesses are raising their prices to help recover the costs incurred by cyberattacks. 24
Business Interruption and Cyber Incidents
30. Businesses are paying $53,000 per hour, on average, due to downtime caused by ransomware.25
31. The average cost of downtime from a DDoS (Distributed Denial of Service) attack is $6,130 per minute. 26
32. The cost of recovering from a ransomware attack is currently, on average, ten times as much as the amount attackers demand in ransom. 27
33. Business owners view cyber risks as more threatening than any other cause of business loss – at 34% – surpassing natural disasters. 28
34. Firms lose up to 1.3% of their market value in the month following a cyberattack. 29
35. 15% of data breaches involve third parties found along the supply chain, putting several firms at risk without fault. 5
36. 49% of companies reported an increase in the frequency of cyberattacks in the last year. 5
37. 43% of companies reported an increase in the severity of cyberattacks in the last year. 5
38. 40% of cyber team members have personally – or have had someone else on their team - intentionally not report cyber incidents out of fear of losing their jobs. 5
39. 33% of companies have been late responding to a cyberattack because they were dealing with a false positive. 5
40. 63% of cyber teams spend four (4) or more hours per week dealing with false positives. 5
41. 15% of cyber teams spend more than seven (7) hours a week managing false positives. 5
Evolving Cyberattack Methods
Ransomware, phishing, social engineering, AI, and the cloud pose immense threats to businesses of all sizes worldwide.
Ransomware alone, in fact, still leads the way regarding threat risk, damage, and attack costs. What’s more, most of them are even attacking data backups!
But, don’t discount phishing, social engineering, and email attacks. We regularly help businesses navigate confidence tricks that – believe it or not – still work on even the best-informed people in 2025.
Let’s dive into some data on attack vectors.
Ransomware Attack Growth
42. Around 27% of all malware attacks right now involve ransomware. 15
43. Ransomware is the most significant contributor to cyberattack costs for small and medium-sized enterprises (SMEs), accounting for around 51% of the average – and this is projected to rise. 15
44. The financial services industry is experiencing a ransomware increase of 9% year-on-year. 16
45. Ransomware attacks are more than doubling year-on-year. 32
46. Projections show that 76% of all organizations suffer at least one ransomware attack per year. 33
47. 96% of ransomware attacks specifically target backup locations and repositories. 33
48. In 77% of ransomware incidents, malicious attacks are deployed within 30 days of an initial interaction–and 54% within the initial seven days. 34
49. The median time between hacker access and ransomware launch is 6.11 days for assumed and confirmed attacks. 34
50. Transport for London suffered one of the highest-profile ransomware attacks, resulting in the loss of traveler contact details, Oyster card information, and bank numbers of up to 5,000 people. 36
51. The healthcare industry reports the most expensive breaches at an average of $9.8 million – remaining at the top of industry costs for over a decade. 36
52. More than 630 ransomware attacks affected healthcare bodies in a single year. 37
Phishing and Social Engineering
53. 60% of recipients fall victim to GenAI-driven phishing attacks, comparable to traditional attack numbers. 38
54. It’s estimated that 80% of phishing attacks are AI-generated, with the trend likely to continue. 39
55. Tools such as ChatGPT that are available for free to the public can generate up to 30 phishing email templates every hour. 40 41
56. The use of GenAI in phishing attacks has increased by at least 17% year-on-year, with experts prepared for more significant jumps. 42
57. The FBI’s IC3 department recently reported almost 21,500 complaints regarding BEC attacks in one year, with losses estimating more than $2.9 billion. 43
58. Companies that employ more than 1,000 people have between 83% and 97% chance of receiving BEC scams every week. 44
59. Up to 74% of attacks involve spear phishing. 45
60. 74% of companies claim insider threats are becoming more frequent. 46
61. 74% of all data breaches involve some kind of human element or error. 47
62. 44% of companies claim they suffered cloud data breaches due to human error. 48
Device and Cloud Security Threats
63. Up to 61% of companies are experiencing at least one cloud attack a year. 49
64. 21% of cloud incidents result in data breaches. 49
65. 27% of business operators experience public cloud security issues, with 23% of them alone caused by misconfigurations. 50
66. Over half of all cloud breaches occur in part due to human error. 51
67. It’s thought up to 70% of IoT or internet-connected devices are still vulnerable to attack. 52
68. In a study regarding healthcare systems – within the NHS – up to 46% of IoT devices have at least one known but unaddressed risk. 53
69. DDoS (Distributed Denial of Service) attacks are increasing by 20% year-on-year. 54
70. Law enforcement shut down 48 DDoS-for-hire platforms in one year, though their numbers are growing by 20% annually. 55
Cybersecurity Vulnerabilities and Breaches
Unfortunately, as cyberattacks become more sophisticated, many companies simply aren’t doing enough to protect themselves—and a huge number of firms are going out of business because of data breaches.
VikingCloud proprietary research reveals: 5
- 42% of companies rate their cyber defense as mature.
- 55% of companies believe modern cybercriminals are more advanced than their internal teams.
- 35% of companies report that the technology cyber criminals use is more sophisticated than the tech their team uses.
- 53% believe emerging AI attack methods create new risks for which they are unprepared.
Let’s explore some data regarding weaknesses, costs, and how quickly companies are bouncing back from even the biggest threats. You might be surprised by what we’ve found.
71. Experts recently discovered 612 new, unique common vulnerabilities and exposures (CVEs) in one quarter. 56
72. Average monthly CVEs considered critical leaped by 13% in a year. 57
73. Experts estimate a 25% rise in CVEs over a year period. 58
74. It’s thought that around 1.1% of CVEs have already been exploited and that 2% are weaponized. 59
75. Operating systems with the most recorded CVEs include Debian Linux (8,809), Android (7,245), Linux Kernel (6,010), and Fedora (5,122). 60
76. In a single year, over 40% of Log4j downloads were still considered vulnerable to hacking. 61
77. 38% of Log4j users were still using vulnerable versions of the application after threats were revealed and patched. 62
78. Vulnerabilities within the MoveIt framework exposed more than 93 million sensitive records. 63
79. Industries most affected by MoveIt vulnerabilities included education, health, and finance. 64
80. High-profile data breaches arising recently include Ticketmaster, which saw 560 million people’s details compromised and up for sale online. 65
81. On average, cross-industry, it takes companies 204 days to spot a data breach and 73 days to contain it. 66
82. Financial companies take an average of 177 days to identify breaches, and 56 days to contain them. 67
83. 9% of publicly traded U.S. companies reported data breaches in a year’s period, impacting 143 million people. 67
84. The use of stolen credentials appears in up to 31% of data breaches. 69
85. Across a decade, the number of U.S. data compromises per year increased from 614 to 3,205. 70
86. Data breaches increased by 72% over two years. 71
87. U.S. data breaches impacted an estimated 353 million individuals in one year alone. 70
88. The cost per capita of a data breach is increasing by around 1 USD per year. 12
89. Companies that find and contain data breaches within 200 days are saving $1 million more than those that don’t. 72
90. Using AI helps companies find data breaches 108 days faster than those that don’t. 72
91. It takes companies in the healthcare industry longer than any other to contain breaches. 73
92. However, it takes entertainment businesses up to 287 days on average to detect a data breach compared to healthcare businesses’ average of 255 days. 73
Industry-Specific Cybersecurity Statistics
Data breaches and cyberattacks can affect different industries in many different ways. Six of those most at risk—healthcare, finance, insurance, manufacturing, retail, and education—continue to lose mind-boggling amounts of money and sensitive data even in 2025.
Let’s dig into these sectors' challenges and where things might be headed.
HealthCare
93. The healthcare industry is the third-most attacked worldwide. 74
94. Ransomware attacks, in particular, are growing in number across the healthcare industry – growing by at least 25%. 74
95. 68% of healthcare officials claim to have witnessed an average of two attacks a year. 75
96. More than 70% of U.S. hospitals surveyed by the HHS are following NIST cybersecurity protocols to fight back against attacks 76
97. Costs incurred by data breaches in healthcare are falling by 10.6% yearly. 77
98. The overall cost of healthcare data breaches has increased by 53% since the start of the COVID-19 pandemic. 78
99. The average cost of a data breach in healthcare was $9.77 million in 2024.78
Finance and Insurance
100. API and web application attacks on financial services companies increased by 65% over a year. 79
101. Financial services are the third-most attacked industry based on phishing alone.79
102. Malicious bot requests spiked by up to 69% year-on-year in the financial sector. 79
103. Data breach costs in the finance industry increased by around 2.3% year-on-year. 12
104. The average financial services firm pays $5.9 million per data breach. 81
105. The average cost of a data breach in financial services ranges from $5.86 to $6.08 million. 82
Manufacturing and Retail
106. On average, up to 44% of all computers used in manufacturing are affected by ransomware, and around 62% of ransomware victims in manufacturing pay the ransom demanded of them. 83
107. The average cost of a data breach in the manufacturing industry in 2024 was $5.56 million. 80
108. Around 62% of ransomware victims in manufacturing paid the ransom demanded of them. 83
109. Backdoor attacks account for 28% of malicious actions against the manufacturing industry. 84
110. 97% of U.S. top retailers have experienced third-party data breaches in the past year. 85
111. The average cost of security breaches in the retail industry rose by 18% year-on-year. 86
112. The retail industry accounts for 6% of all global data breaches annually. 87
113. The average data breach cost in the retail industry is $3.48 million. 24
Education Sector
114. There has been a 92% spike in attacks on K-12 educational establishments. 88
115. Educational businesses saw 265 attacks in the space of a year, an overall increase of 70%.88
116. The U.S. accounted for 80% of known ransomware attacks during this period. 88
117. 95% of ransomware attackers targeting higher-ed bodies attempt to access data backups. 89
118. 95% of higher-ed bodies that report ransomware suggest they experience significant revenue loss. 89
119. Each day of downtime costs schools up to $550,000. 90
120. The average cost of a data breach for higher-ed bodies is around $3.65 million. 91
121. Data breaches through ransomware cost the education sector more than $53 billion in downtime over a five-year period. 92
Cybersecurity Spending and Workforce Gaps
To fight cybercrime, businesses need to invest considerable time and money on resources and people. Thankfully, our research suggests most companies are taking security spending very seriously. After all, it’s better to invest money now than to risk losing massive amounts of business and recovery fees later.
What’s more, there continue to be worrying trends over cybersecurity job availability – there’s some serious skills gaps. Thankfully, a few statistics we’ve found appear to offer some hope.
Here’s what we’ve found with regard to how business owners are budgeting for data protection and planning for hiring and training.
Security Investment Trends
122. Global information security spending is set to increase by 15% for the year ahead. 93
123. Research shows yearly spending is estimated at $183.9 billion. 93
124. Investment in security services is expected to grow more than investment in software or network security. 93
125. Cybersecurity budgets are growing by about 8% per year. 94
126. The cybersecurity market has an annual growth rate of around 7.92% CAGR to the end of the decade. 95
127. Firms could reduce cybersecurity costs by an average of $2.2 million annually when investing in AI and automation tools. 12
128. Companies that actively use security automation and AI spend $1.8 million less per year on breaches than those that don’t. 96
129. Companies using security automation and AI also save more than $3 million per data breach. 97
130. The AI cybersecurity market is set to exceed $133 billion by 2030. 98
131. Identity and access management, a type of zero-trust security strategy, is set to exceed market worth of $24.1 billion by the year’s end. 99
132. At least 41% of businesses now use zero-trust security architecture. 100
133. 83% of IT SME professionals require employees to use multi-factor authentication, or MFA. 101
Cybersecurity Skills Shortage and Workforce Predictions
134. The cybersecurity industry has a talent shortage of four million professionals. 102
135. 45% of people claim skills shortages pose the biggest challenges to cybersecurity professionals. 102
136. Up to 570,000 cybersecurity roles remain unfilled in the U.S. alone. 103
137. Texas, Florida, California, Colorado, Illinois, Virginia, Maryland, and New York are the states with the most U.S. cybersecurity openings. 104
138. Research shows that U.S. cybersecurity jobs are expected to grow 33% by 2033. 105
139. Up to 17,300 new jobs for IT security analysts are projected to open each year across the next decade. 105
140. Growth of employment demand for information security analysts is 29% higher than the average demand for all occupations heading to 2033. 105
141. “Computer occupations” are expected to grow by 12%, again, 21% lower than information security analyst roles. 105
142. 63% of companies are considering implementing new technologies, such as GenAI, to support cybersecurity employment shortages. 5
143. Specifically, 41% of companies already leverage GenAI to address the cybersecurity skills gap. 5
144. It’s predicted GenAI will remove the need for specialized education for up to half of all entry-level roles in cybersecurity by 2028. 106
145. Around 40% of C-level executives intend to use GenAI to support critical skills shortages. 107
Key Takeaways and Recommendations for 2025
As we look to the future, understanding the numbers behind cybersecurity is critical to staying one step ahead of evolving threats. Here are 13 important statistics that could help you shape your cybersecurity posture for 2025 and beyond. We’ve split this section into risk mitigation and future trends worth watching – pulling from our own research along the way.
Mitigating Cybersecurity Risks
146. Proactive management of third-party software risks is vital – at least 29% of all data breaches involve third-party attacks. 108
147. Hiring talent to address growing threats is also important – and only 10% of firms are increasing their cyber hiring. 5
148. Up to 53% of companies feel they’re unprepared for cybersecurity risks and attack points posed by AI. 5
149. Research suggests companies adopting GenAI to support hyper-personalized training could result in 40% fewer employee-caused security incidents by 2026. 106
150. 56% of businesses intend to use AI to help train their cybersecurity professionals. 109
151. The worldwide zero trust security market is projected to be worth almost $133 billion by 2032. 110
152. 33.8% of business owners believe decentralized identity management will continue to be crucial for IAM (identity and access management), with 47.1% supporting passwordless access systems. 111
Future Trends to Watch
153. Business owners are most worried about GenAI model prompt hacking (46%), Large Language Model (LLM) data poisoning (38%), ransomware as a service (37%), GenAI processing chip attacks (26%), and API breaches (24%). 5
154. 41% of businesses are using AI to manage cyber alert fatigue. 38% use GenAI to support security patching, and 29% use it to automate management systems. 5
155. Cyber insurance policy numbers are increasing by around 11.7% yearly after a lull, and annual claims are increasing to more than 33,500. 112
156. The market size for cybersecurity insurance is set to top $20 billion. 113
157. Companies spend an average of 12% of IT budgets on measures for cybersecurity. 114
158. Businesses have increased the budget allocated to security by around 8.6% over the last half-decade. 115
FAQs
159. Ransomware is the biggest global cybersecurity threat, affecting 72.7% of organizations. 116
160. Google Cloud predicts major threats to cybersecurity in 2025 include AI attacks, continued disruption through ransomware, and evolving threats against Web3 companies. 117
161. Hundreds of millions of commercial and private devices will become vulnerable with Microsoft ending support for its Windows 10 operating system in October 2025. 118
162. Research suggests more than 2,300 unique cyberattacks occur every day. 15
163. There are at least 23,900 known cybersecurity vulnerabilities that could encourage these attacks. 84
164. As many as 88% of all cyber incidents are caused by human errors. 119
165. BEC attacks rely on human error and misjudgment and are responsible for more than half of all social engineering attacks. 47
166. Research claims that around 20% of breaches occur due to social engineering. 120
167. Verizon research further claims around 3,661 social engineering attacks were accounted for in its broad study, with 3,032 disclosing data. 121
168. 2021 was a huge year for cyberattacks – bolstered by the enormous data breach affecting the social media developer RockYou, which lost 8.4 billion passwords, affecting 32 million different accounts. 122
169. Companies can prepare for cyberattacks in many ways – by setting up firewalls, arranging penetration testing, and retraining employees – however, 54% of business owners are harnessing AI to mimic threats to prepare for them better. 5
170. Gartner research predicts that the cybersecurity market will expand to $212 billion by the end of the year. 93
Sources
- Statista
- Journal of Electronic Business & Digital Economics
- Statista
- Capgemini
- VikingCloud
- Securonix
- Cisco
- Gartner
- Sprinto
- KPMG
- Statista
- IBM
- SecurityIntelligence
- Statista
- Astra
- Sophos
- IBM
- HoxHunt (quoting IBM and Ponemon Institute)
- Infosecurity Magazine
- Coalition
- NetworkAssured
- Insurance Information Institute
- PurpleSec (quoting IBM)
- IBM
- PentestPeople
- Security Magazine (quoting Radware)
- Delphiix (quoting Soros)
- Allianz
- American Enterprise Institute
- Verizon
- Sophos
- Forbes
- Veeam
- Integrity 360
- Healthcare Dive (quoting IBM)
- Office of Information Security
- Harvard Business Review
- Abnormal Security
- Heimdal
- ChatGPT Community
- KnowBe4 (quoting Perception Point)
- IC3
- Abnormal Security
- ProofPoint
- Cybersecurity Insiders
- Verizon
- Thales Group
- Competitor
- Competitor
- Infosecurity Magazine (quoting Thales)
- CybelAngel (quoting HP)
- Cynerio
- Cloudflare
- Security Delta
- Statista
- CSO (quoting Coalition)
- Help Net Security (quoting Coalition)
- VulnCheck
- CVEdetails
- DarkReading
- VeraCode
- Cybersecurity Dive
- EmsiSoft
- BBC
- Secureframe (quoting IBM)
- Security Intelligence
- ID Theft Resource Center
- Verizon
- Statista
- ITRC
- Embroker (quoting IBM)
- Varonis (quoting IBM)
- Hit Consultant (quoting Ransomware Live)
- Security Magazine (quoting ProofPoint)
- Industrial Cyber (quoting HHS)
- Varonis (quoting IBM)
- Healthcare Dive (quoting IBM)
- Akamai
- Statista
- FinTech Magazine
- Statista
- Sophos
- Competitor
- CIO Influence (quoting SecurityScorecard)
- Retail TouchPoints (quoting IBM)
- Asimily (quoting IBM)
- ThreatDown
- Varonis (quoting Sophos)
- Campus Technology (quoting Comparitech)
- Asimily (quoting IBM)
- Comparitech
- Gartner
- IANS
- Statista
- Alt Index
- Security Intelligence (quoting IBM)
- Security Magazine (quoting Techopedia)
- MarketsAndMarkets
- JumpCloud (quoting IBM)
- JumpCloud
- Statista
- National Science Foundation
- Cyberseek
- US Bureau of Labor Statistics
- Gartner
- ComputerWorld (quoting Kaspersky Research)
- SecurityScorecard
- CompTIA
- Statista
- Kuppinger Cole
- NAIC
- Statista
- Statista
- The National CIO Review (quoting IANS)
- Statista
- Google Cloud
- Beyond Trust
- BreachSense (quoting Stanford and Tessian)
- SecureFrame (quoting Verizon)
- Verizon
- Clear Insurance
The holiday shopping season is here, and surging cyberattacks put retail operations at risk. According to VikingCloud’s 2024 Holiday Cyber Threat Survey, 80% of retailers have already experienced a cyberattack in the past year, with nearly all hit multiple times.
Retailers will be even more vulnerable in the final months of the year: 52% report being at increased risk during the 2024 holiday shopping season – more than at any other time. According to retailers, cyber risks increase due to the surge in in-store and online shoppers, internal cyber workforce challenges, and the targeting of business-critical point-of-sale (POS) devices.
Retailers must recognize cyber vulnerabilities and protect their digital systems from cybercriminal grinches looking to dampen their holiday spirit – and sales.
Here’s what to know to make the holidays more secure.
The Top 3 Holiday Season Cyber Risks
VikingCloud’s proprietary research identified the top 3 cyber vulnerabilities most likely to disrupt retail business operations:
- Strained Teams with Weak Links: Cyber workforce challenges are the biggest cybersecurity hurdle during the holiday season. 2 of the top 4 cyber challenges retailers report directly relate to an overextended workforce caused by employee shortages and turnover (50%) and an influx of seasonal employees with limited cybersecurity training (46%).
Human error is one of the main causes of data breaches, often linked to inadequate cybersecurity training. The seasonal influx of temporary employees means more people with limited awareness of internal cyber policies. In fact, VikingCloud’s research uncovered that 78% of seasonal employees do not receive social engineering training, 56% lack safe internet and social media usage guidance, and 56% do not receive mock email phishing training. Cybercriminals often attempt the easiest entry point - and seasonal workers are a prime target.
These staffing vulnerabilities are compounded by a stretched internal IT team that is overwhelmed by the sheer number of cyber alerts to vet daily. The number one challenge retailers report is limited internal IT resources to keep up with modern-day cyberattack methods (52%).
Understaffed and underequipped teams create the perfect winter holiday storm for retailers. And when the inevitable cyberattack happens, 12% of retailers report having to lay off employees because of financial impacts. That means even fewer resources with which to fend off the next cyber threat.
- Increased Exposure: The surge in both in-store and online holiday shopping makes the holiday season the most vulnerable time of year. The sharp increase in payment card transactions emerges as one of the biggest vulnerabilities: 52% of retailers report being more at risk during the 2024 holiday shopping season than any other time over the previous 12 months.
Retailers face a wide range of cyberattacks with the potential to disrupt holiday shopping including supply chain attacks (52%), data breaches (48%), phishing attacks (32%), and denial-of-service (DoS) attacks (32%). The danger of a supply chain attack is a stark reminder of the importance of third-party visibility.
- Business Interruption and Financial Fallout: Damaging cyberattacks shut down business operations so consumers can’t buy products or services:
- 68% of retailers report that business downtime or operational disruptions are the most likely outcome of a cyberattack.
- 46% of companies reported that their first move upon discovering a breach is to shut down digital systems, including POS devices to ensure the cyberattack doesn't spread.
The financial effects go beyond day-to-day operations. 23% of retailers saw declines in stock prices following an attack, while 33% faced regulatory fines due to lapses in customer data protection.
The ripple effects of cyberattacks can deeply impact customer trust and brand reputation. After a breach, 53% of retailers report damage to their reputation, potentially driving customers to competitors. Unfortunately, in an attempt to protect brand image, 44% of retailers report having withheld incident details from the public. This theme of underreporting and lack of transparency leaves consumers in the dark about potential risks, raising concerns about whether brands are truly safeguarding their data.
Prepare for a Safer Holiday Season with an MSSP
To address heightened risks this holiday season, retail companies should invest in advanced technology and comprehensive training to protect revenue and brand reputation. But retailers don’t have to go at it alone. It takes a team to get through the holidays. While retailers focus on delighting their customers and meeting demand, VikingCloud’s Managed Security Service offering can be an extension of their internal cyber teams.
Managed Security Services Providers (MSSPs) offer a range of services, including threat detection, incident response, compliance management, and more. MSSPs can minimize downtime and financial losses tailored to the unique cybersecurity needs of retailers. With a combination of specialized talent, flexibility to package up specific services within budgetary constraints, and best-of-breed technology, MSSPs are the solution of choice for leading retailers.
The holiday season can make or break a retailer's year. Upwards of a third of annual retail revenue comes from holiday shopping sales. Robust cybersecurity is an essential piece of retailers' holiday season strategy. Uplevel your cybersecurity posture with VikingCloud to ensure your business operates uninterrupted in the face of sophisticated cyber threats.
Learn more about the cyber challenges the retail industry is facing this holiday season and how an MSSP can help: Managed Security Services.
For more information about the findings from our 2024 Holiday Cyber Threat Survey, take a look at the Cybercriminals Are Stealing More Than Holiday Cheer infographic.
.png)
