For several years, this survey—perhaps the most widely quoted set of statistics in
the industry—showed a steady drop in average estimated losses due to
cybercrime. It seemed counterintuitive to some experts, accustomed to seeing the
worst of the crime that’s out there.
Last year the tide turned and respondents reported a significant upswing. Given
the changes in the nature and severity of network-borne threats, this seemed only
natural.
This year the average losses are back down again. And that’s puzzling, honestly.
There seems little question that several sweeping changes in the overall state of IT
practices—coupled with equally broad changes in the habits of the criminal
world—are making significant, hard-hitting attacks easier and more lucrative for
their perpetrators.
What these results suggest, though, is that on most days at most organizations,
the attacks are less imaginative than what’s currently theoretically possible.
Which, for the moment, is good news.