1 in 3 MSP Clients Could Become Victims of Phishing

Did you know that over 30% of internet users access phishing sites? The internet is littered with millions of new phishing sites that appear and disappear in the blink of an eye. Phishing and spear phishing attacks are launched at businesses of all sizes, and static anti-phishing blacklists, even if updated hourly, are often ineffective against today’s sophisticated attacks.

During a detailed analysis of threat data encountered by Webroot BrightCloud Threat Intelligence, our threat research team identified some key trends. The final three months of 2014 showed that approximately 2.5% of all Webroot customers around the globe experienced a first contact with a zero-day phishing site each month. (It’s worth noting that all subsequent contact attempts by Webroot customers were automatically blocked.)

You might be thinking, “But 2.5% sounds pretty insignificant.” Although not a significant number in itself, when extrapolated over the course of a year, it yields a 30% chance of a user falling for a phishing attack that involves a fraudulent zero-day URL. This indicates how important it is to have real-time anti-phishing security controls in place to prevent such attacks from succeeding.

Phishing attacks surge during certain times of the year or when major world events occur. For example, there was a major spike in the data when the Charlie Hebdo tragedy occurred in early 2015. This is most likely due to savvy phishing scammers capitalizing on trending search terms. Additionally, during the last week of December 2014, there was a greater than 50% increase in phishing activity as compared with the rest of the quarter. We assume this correlates with the anticipated addition of new devices and device users around the holiday season.

Financial services and technology companies were nearly even when it came to the total number of phishing impersonations (44.3% and 55.6%, respectively). Although these numbers are similar, the number of companies within each category being attacked is not. Over 80% of the companies impersonated were financial institutions. But, there are many more phishing attempts per technology company than per financial institution. On average, there are nearly 900 phishing attempts detected per financial institution, but over 9,000 attempts detected per technology company.

With all of these statistics in mind, how can MSPs keep their clients safe from these threats? Real-time analysis is critical when it comes to phishing sites because they are often only online for a few hours, or until a threshold of visits has been reached. Although static lists will never be sufficient for dynamic phishing protection, collective threat intelligence and real-time, behavioral detection has the power to protect clients against websites—even when they’re just a few seconds old.

Want to find out if Webroot has what it takes to protect your clients? See for yourself with a no-risk free trial. You don’t even have to uninstall existing security.

Want to learn more about how Webroot partners with MSPs to delight customers, lower costs, and boost profits? Read more.

Guest blogs such as this one are published monthly and are part of MSPmentor’s annual platinum sponsorship.