The Human Element: Verizon’s 2024 Data Breach Report Highlights Risks

Verizon Business released its 17th-annual Data Breach Investigations Report (DBIR), highlighting the role that the human element plays in cyber threats. This report examined 30,458 security incidents as well as 10,626 verified breaches in 2023, representing a two-fold increase from 2022. Out of the breaches analyzed, more than two-thirds (68%) included a non-malicious human element — in other words, these incidents involved insider errors or people falling for social engineering schemes.

This percentage remains consistent with last year’s, suggesting that the human element remains a steady risk concern. However, reporting practices improved, as 20% of individuals recognized and reported phishing in simulated exercises, and 11% of individuals who clicked a malicious email reported it.

Another notable finding from the report was the increase in vulnerability exploitation. Exploiting vulnerabilities as an initial entry point accounted for 14% of all breaches, representing a volume three times (180%) greater than 2023. According to the report, this increase was driven by zero-day vulnerabilities that ransomware actors leveraged.

Other key findings include:

• 32% of breaches included a form of extortion, including ransomware.
• Between 24% and 25% of financially motivated security events involved pretexting over the past two years.
• Over the last decade, 31% of breaches involved the use of stolen credentials.

Security leaders weigh in

Saeed Abbasi, Manager, Vulnerability Research at Qualys Threat Research Unit:

“The 2024 Verizon Data Breach Investigations Report (DBIR) highlights cyber threats that are evolving and increasingly complex in our interconnected world. These findings spotlight a crucial theme: today’s cyber threats are’ dynamic and increasingly sophisticated in nature.

“Here are my takeaways this year:

• Adaptive threat landscape: The report details a notable increase in ransomware, extortion techniques, and vulnerability exploitation, showing that cybercriminals are becoming more adaptive and opportunistic. They effectively utilize everything from zero-day vulnerabilities to social engineering tactics like phishing to penetrate systems.
• Convergence of threats: It also notes an evolution of ransomware into more complex forms of extortion, marking a convergence of threats where different attack methods merge into hybrid tactics. This convergence complicates organizations’ ability to predict …

  Patrick Harr, CEO at SlashNext:

  “With the rapid growth of AI technology, combined with limited regulation, it’s important for the tech industry to develop tools and processes that can assist in protecting AI technology systems.

  “Everything in security needs to become more human ID-centric rather than network-centric. At the end of the day, we are far better off by providing access through human identity-centric methods and using AI to make that human a super-human. So rather than relying on a training simulation approach for users, we can rely on AI augmentation for that, so users don’t have to be tricked into clicking on bad phishing links, for example.

  “We have to shift our posture from a network-centric to a human-centric security posture. We will put an AI bubble around the user to become a super-human with an extra pair of computer vision eyes, and an ability to listen with spoken language contextualization by using AI. Everyone has talked about a personal co-pilot to help from a security posture, and we will see the rise of these AI co-pilots to augment humans and help users make the best decisions.

  “This problem will not go away and will only get wors…