Cybersecurity Threats & Defenses for Everyone

Twenty-nine. That's how many cents of every reported fraud dollar came from scams that never touched a line of code on your computer — no, wait, let me put it differently, because the actual number is stranger. In 2023, the FBI's Internet Crime Complaint Center logged over twelve and a half billion dollars in reported losses, and the single costliest crime type wasn't ransomware, wasn't some shadowy hacker collective breaking through firewalls. It was investment scams. Ordinary people, persuaded by someone they trusted, handing over money voluntarily. And almost none of it involved sophisticated hacking. The FBI's IC3 report — the annual count of internet crime in America — received 880,418 complaints that year. Those are just the reported ones, Al. The real number sits somewhere higher, uncounted.

So, what does that landscape actually look like for someone like you? Phishing and spoofing topped the IC3 complaint list, with 298,878 complaints — that's fake emails, fake texts, fake websites pretending to be your bank or your boss. Think of a fisherman casting a wide net; most fish swim past, but the net costs the fisherman almost nothing to throw. And when the net catches a business? The FBI recorded 21,489 business email compromise complaints with nearly $2.95 billion in reported losses in 2023. That's an attacker impersonating a manager, or a supplier, asking an employee to wire money. One convincing email. What gets me is how unglamorous it all is. Ransomware got 2,825 complaints with adjusted losses over $59.6 million — real money, but a fraction of what simple persuasion stole.

Now, ransomware itself has changed shape, and this matters if you ever handle data at work. It used to be a padlock — files encrypted, money demanded for the key. Today it's more often blackmail. Attackers steal the data first, then threaten to publish it, and encrypting your files is almost an afterthought. Suppose your company's client list gets copied before anything is locked: paying the ransom doesn't guarantee recovery, and it certainly doesn't guarantee your data stays private. Verizon's 2024 Data Breach Investigations Report found ransomware or another extortion technique in roughly one-third of the breaches it analyzed. Which means two-thirds weren't — extortion is one threat among many, not the whole story.

Here's — no, scratch that, let me say it plainly. The way in is usually a person, not a machine. Verizon's 2024 report found a non-malicious human element involved in 68% of breaches in its dataset. Someone clicked something, reused a password, or got fooled — no malice, just a Tuesday morning mistake. And the technical side is accelerating too: exploitation of vulnerabilities as an initial route into a breach rose by 180% in Verizon's analysis compared with the prior year. Nearly tripled, year over year. A vulnerability is just a weakness in software that can be exploited, and once one is publicly known, attackers move fast — like a burglar reading the newspaper about which locks on your street are broken. CISA, the U.S. cyber defense agency, maintains a Known Exploited Vulnerabilities catalog specifically listing flaws with evidence of real-world attacks, so organizations know what to fix first. It's a priority list, not a complete one, but that's the point: fix what's proven dangerous first.

Which brings us to you, Al, and this week. The habits that cut most personal risk are almost embarrassingly simple. Install updates promptly — that removes the known weaknesses attackers actually use. Turn on multifactor authentication, a second verification step beyond your password, and CISA recommends phishing-resistant forms for your important accounts. Use unique passwords; a password manager handles the memory work, so one breach doesn't unlock everything else. And when a message feels off, even from a familiar name, don't click — the FTC advises contacting the organization through details you know are genuine. For organizations, NIST's Cybersecurity Framework 2.0 now organizes all of this under six functions — Govern, Identify, Protect, Detect, Respond, Recover — and notably added Govern, putting decision-making oversight alongside the technical work. CISA also recommends offline, encrypted backups, tested regularly. Because when the extortion email arrives, the calm answer is a restore button, not a wire transfer. The threats keep evolving, but the defenses? Most of them fit in a single afternoon.

The email arrived on an ordinary workday, and it named its price in Bitcoin. That's how a small company in a UK government case study first learned it was under attack, a ransom demand sitting in the inbox, demanding payment. And here's the part nobody says politely, so I will. They had done the things. Daily backups. IT outsourced to professionals. And when the attackers finished, the company had no usable backups at all. Let that sit a moment, because it should unsettle you, Al. Doing the checklist and surviving the attack are two different achievements. The company paid. Then it rebuilt from almost nothing anyway.

Now, the polite version of this conversation says small businesses are too small to bother with. The data says otherwise. Verizon's 2025 breach report found ransomware in 88 percent of the small and medium business breaches it analyzed, versus 39 percent at larger organizations. Ransomware actually prefers you. Think of a burglar choosing the house with the back door, not the biggest house on the street. An Australian study of 331 ransomware victims found small business owners were more likely than individuals to see the attack spread into workplace devices, systems, and email. One infected laptop becomes an infected company. What gets me is the speed of that, how a single machine, a, a single Tuesday-morning click, becomes payroll, email, everything.

So why did the daily backups fail? Because modern ransomware hunts them. Attackers know that if a backup survives, the ransom has no leverage, so the malware tries to find and delete any backup it can reach on the network. That's why CISA says keep backups offline or isolated from ordinary access, encrypted, and, this is the part people skip, keep copies in separate places. Not several copies in one drawer. And test the restore. CISA is blunt about this. Scheduling a backup proves nothing about whether it's complete, usable, or fast enough to run a business on. Suppose you restore and find yesterday's data missing. That discovery belongs in a drill, not in a crisis. There's a darker wrinkle too, what CISA calls double extortion. The ransom note isn't proof files were even encrypted; attackers may just steal data and threaten to publish it.

To see what a real response looks like, consider a U.S. hospital case handled by the MS-ISAC Cyber Incident Response Team. The attack threatened laboratory reporting, medication distribution, even patient diversion, ambulances rerouted to other hospitals. What convinced me about calling responders early is this detail. The team shared preliminary findings in under 48 hours once it had the incident artifacts. Two days to know what you're fighting. That's why CISA and the FBI ask victims to report to the Internet Crime Complaint Center, a local FBI field office, or CDSA itself, or rather CISA itself, sorry. And preserving logs and the ransom communications matters. Those emails aren't just threats; they're evidence that establishes the scope of the incident.

So what should a small business actually do when ransomware detonates? Sequence matters more than speed. First, isolate affected devices from the network to stop the spread, and if multiple segments are hit, CISA's checklist says take the network offline at the switch level. I know, everything in you wants to reboot, to fix, to restore. Don't. Don't reconnect or restore casually, because you can reinfect clean systems, and verify your backups are intact before trusting them. If personal information may have been stolen, notification obligations kick in, so affected people and regulators may need to hear from you. And paying? Paying guarantees nothing. No restoration, no deletion of stolen data, no safety from being hit again, and U.S. agencies discourage it outright.

Back to that UK company for the last time, because their story has a quiet ending worth sitting with. They rebuilt, but the government's account attributes the data loss simply to the absence of usable backups. Everything else, the payment, the panic, flowed from that one gap. NIST says to write the incident response plan before the attack, with decision-making roles, restoration priorities, contacts, and to practice it, law enforcement included. Know which systems keep revenue flowing, and protect those first with MFA, prompt updates on internet-facing software, limited admin rights, and network segmentation so one compromised device can't wander everywhere. And what evidence would move me that a business is ready, Al? Go find a restore test. Pick a system, pull a file back from backup, time it. If that works, the clock never really runs out.