Cyberattackers are increasingly focusing their attacks on businesses rather than consumers, according to a new study by security company ProofPoint Inc. The current favored tactic is to exploit the fatigue of middle managers whose inboxes are often overloaded with emails, while attackers are also seeking to trade off attack volume with more sophisticated attacks.

Proofpoint’s second annual Human Factor Report details how cybercriminals are evolving their social engineering tactics to specifically target corporations. The study’s findings emphasize how human behavior, rather than system vulnerabilities, significantly undermines cybersecurity measures, and makes reccomendations on how these errors can be protected against.

Proofpoint said that on select days in 2014, it saw a 1,000 percent increase over the standard volume of email messages carrying malicious content. The most common malicious emails were voicemail and e-fax notifications, as well as personal and corporate financial alerts.

“The human element is one of the most critical aspects of your security program, yet it’s often the most neglected,” noted a December 2014 Forrester Research report titled “Reinvent Security Awareness to Engage the Human Firewall”. “However, this is the problem, security technologies that are critical to protecting your environment are often rendered useless due to easily avoidable human factors.”

The study found that, on average, employees would click on one out of every 25 malicious messages they received in 2014, double the number they clicked on in 2013. Moreover, not a single organization covered in the study was able to completely eliminate this problem. Most worryingly, Proofpoint found that middle managers were twice as likely to click on malicious messages as executives were. Personnel working in sales, finance and procurement departments were the most likely to click on malicious attachments, with such employees clicking 50-80 percent more frequently than personnel from other departments, the study showed.

Proofpoint also noted the vast majority of malicious messages arrive during business hours. It said that Tuesday was the most active day for clicking, with 17 percent more malicious messages being clicked on compared to other days of the week.

Also noteworthy, Proofpoint found attackers are reducing their reliance on social media lures, which fell by 94 percent in 2014. Instead, attackers are sending their malicious links via emails containing attachments rather than URLs.

“The Human Factor research validates the critical value of threat information – and provides insight into how, when and where attacks are taking place,” said evin Epstein, Proofpoint’s vice president of advanced security and governance. “The only effective defense is a layered defense, a defense that acknowledges and plans for the fact that some threats will penetrate the perimeter.”

Photo Credit: Bankenverband – Bundesverband deutscher Banken via Compfight cc