Attackers target people and not necessarily who you might expect.
The modern threat landscape is increasingly “people-centric.” Attacks focus on people and identities rather than infrastructure, making it more important than ever to identify which users in an organization represent the greatest sources of risk.
• “Very Attacked People” (VAPs) represent significant areas of risk for organizations. They tend
to be either easily discovered identities or targets of opportunity like shared public accounts.
Of the identified VAPs, 36% of the associated identities could be found online via corporate
websites, social media, publications, and more.
• VAPs are not necessarily high-profile individuals either (VIPs such as C-level executives). Only
7% of executive emails could be found online.
• For the VIPs who are also VAPs, almost 23% of their email identities could be discovered
simply by a Google search.
• Education, finance, and advertising/marketing were the industries with the highest average
Attack Index, an aggregated measure of attack severity and risk.