This report will help users to understand the nature, scope and impact of the threats they face, and will help security teams tailor their program and messaging accordingly. A security awareness program should be an essential component of any organization’s security strategy, but by itself it isn’t enough. Our data shows that 96% of people who took a risky action knew that what they were doing might be risky, so it seems that key information is getting through. However, knowing what to do and doing it are two different things. The challenge is now not just awareness, but behavior change.

The 2023 Board Perspective report shines a light on how boards are managing this evolving landscape. Our annual survey reveals the beliefs, experiences and insights of 650 board members across the globe. We analyzed their responses to get a boardroom perspective of the threat landscape, the role of the CISO and the broader world of cybersecurity. We also compared the results with CISOs surveyed in our 2023 Voice of the CISO report. Pairing the surveys helps provide a more complete picture of where CISOs and their boards are on the same page—and opportunities for better alignment.

Our annual State of the Phish report explores end-user security awareness, resilience and risk across 15 countries (eight more than in previous years). The report benchmarks understanding of common cyber threats and defensive tactics and reveals how potential gaps in knowledge and cyber hygiene enable the real-world attack landscape. Most attacks target people before they target systems. That’s why helping users build sustainable security habits is crucial.

This report will look at how ransomware caused gas shortages on the east coast, why a Justin Bieber tour might have put on the phone with a malware distributor, and what an increase in SMS phishing means for mobile security. We’ll also explore the evolving relationship between malware distributors and one of the world’s most successful ransomware gangs, and how legitimate cloud services now provide the infrastructure for a majority of malicious activity.

In this, our eighth annual State of the Phish report, we explore user vulnerabilities from multiple angles. We look at issues driven by poor cyber hygiene and those that could result from a lack of knowledge and clear communication. We discuss ways organizations can become more attuned to their risks. And we outline opportunities to build and sustain engaging security awareness training initiatives in the challenging climate.

This report explores how CISOs are adjusting in the wake of pandemic disruption, adapting strategies to support long-term hybrid work and battling an increasingly sophisticated threat landscape. We also examine how people put organizations at risk and how CISOc change priorities in response.

Using Proofpoint deployments across the globe over 2020, this report reviews the email messages, URLs, and attachments being communicated and what these mean for email and cyber security. An additional 300 customers provided information on privilege abuse concerns for a section of this report.

A survey of CISOs across 1,400 organizations supplemented with interviews of 100 individuals.

This report examines which employees, departments, and industries are the most vulnerable in 2019. It analyzes which ones receive the most targeted threats, and how their privilege might be abused.

A survey-driven report of over 200 IT and security professionals on the practices and the objectives in their use of cloud access security broker (CASB) technologies.

An annual report derived from the Proofpoint customer base and the emails processed by the Proofpoint email security platform. Focuses on the “human factor” of organizational cyber security.

This survey of 3500 people (conducted by a 3rd party survey research company) examines attitudes and knowledge of various security concepts. The survey is mainly focused on the Western World, the US, Western Europe, and Australia, with Japan being the only Asian country included.

Our sixth annual State of the Phish report again brings you critical, actionable insights into the current state of the phishing threat. You’ll learn about: • The end-user awareness and knowledge gaps that could be hurting your cybersecurity defenses The impacts information security professionals are experiencing because of phishing attacks and the ways they’re trying to combat these threats • How Proofpoint customers are approaching phishing awareness training, and the ways we’re helping them measure program success

This report seeks to explore user knowledge of a broad range of best practices for cyber hygiene, security and compliance.

This report presents data gathered between October–December 2018, along with previously collected data for historical comparisons. We examine which employees and organizational departments receive the most highly targeted email threats. Then we explore how they’re being attacked, analyzing attackers’ techniques and tools. Based on these findings, we recommend concrete steps organizations can take to build a defense that focuses on their people.

On April 20, Proofpoint observed a targeted campaign focused on financial analysts working at top global financial firms operating in Russia and neighboring countries. These analysts were linked by their coverage of the telecommunications industry, making this targeting very similar to, and likely a continuation of, activity described in our “In Pursuit of Optical Fibers and Troop Intel ” blog. This time, however, attackers opportunistically used spearphishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan, which in turn downloaded the PlugX Remote Access Trojan (RAT). Proofpoint is tracking this attacker, believed to operate out of China, as TA459. The actor typically targets Central Asian countries, Russia, Belarus, Mongolia, and others. TA549 possesses a diverse malware arsenal including PlugX, NetTraveler, and ZeroT. [1][2][3] In this blog, we also document other 2017 activity so far by this attack group, including their distribution of ZeroT malware and secondary payloads PCrat/Gh0st.

This guide offers help for surviving ransomware attacks.

This Quarterly report offers key takeaways from the third Quarter of 2016. Those takeaways come from Email, Exploit Kits, Web-Based Attacks, and Social Media and Domain Research.

This Quarterly report offers key takeaways from the second Quarter of 2016. Those takeaways come from Email, Exploit Kits, Web-Based Attacks, and Social Media and Domain Research.

This Quarterly report offers key takeaways from the first Quarter of 2016. Those takeaways come from Email, Exploit Kits, Web-Based Attacks, and Social Media and Domain Research.

This quarterly report offers key takeaways from the fourth quarter of 2017. Those takeaways come from Email, Exploit Kits, Web-Based Attacks, and Social Media and Domain Research.