Tales from the Frontline: What is the Actual Cost of Phishing?

Last week, I talked with a prospect about BlastShield’s passwordless authentication for Secure Remote Access, and I got the strongest positive reaction I have ever received. The CISO asked me” “Do you know how much money I spend trying to combat phishing in a year?” Smiling, thinking I knew where he was going with the conversation, I said, “How much?”

Uncovering the Hidden Costs of Phishing

The CISO started making a list:

1. Let’s start with the direct cost of a breach or hack caused by phishing. Ninety percent of the breaches we have had in IT or OT began with a successful phishing attack. Between ransom and cleanup, my budget exceeded the plan significantly.
2.  After the first hack, we implemented a phishing training course. This resulted in more cost per user, driving up my budget.
3. After the second, we purchased an automated phishing test system—you know, the kind that sends phishing emails, and if an employee clicks on one, you send them to…you guessed it, that training class I just mentioned (which they had already been required to take).
4. After the third, we turned on an MFA solution, thinking that this would solve the problem. The solution is to send an email code or an SMS to confirm whenever someone attempts to authenticate. More cost and it still didn’t stop all the attacks.
5. So, we changed our password aging to every three months rather than yearly. This annoyed our users and resulted in lots of passwords being written on sticky notes and, worse, more password managers being used. One of the password managers was hacked, and a ton of our users' credentials were stolen, resulting in a flood of attacks.

Why Passwordless Authentication is the Solution

If you eliminate passwords and simplify user authentication, you save me millions of dollars a year. That is an ROI good enough for me to test your system today. 

The testing starts this week. Do you have this problem, too? Test the BlastWave solution to see how passwords are unnecessary to secure your OT network. 

https://www.blastwave.com/schedule-a-demo