IC3 said CryptoWall and its variants have been targeting U.S. victims since April 2014. The financial impact to victims goes beyond the ransom fee itself, which is typically between $200 and $10,000. Many victims incur additional costs associated with network mitigation, network countermeasures, loss of productivity, legal fees, IT services, and/or the purchase of credit monitoring services for employees or customers. Between April 2014 and June 2015, the IC3 received 992 CryptoWall-related complaints, with victims reporting losses totaling more than $18 million.

“People are used to having a technology solution [but] social engineering bypasses all technologies, including firewalls,” KnowBe4 Chief Hacking Officer Kevin Mitnick said. “Technology is critical, but we have to look at people and processes. Social engineering is a form of hacking that uses influence tactics.”

Phishing – and its aftermath – is the most serious concern for five out of six of security-focused decision makers, according to the Black Diamond, Wash.-based firm Osterman Research. “It is important to invest sufficiently in employee training so that the 'human firewall' can provide the best possible initial line of defense against increasingly sophisticated phishing and other social engineering attacks,” the firm stated.

Risk managers know it is far cheaper to train users than to pay the fines and heavy costs associated with a data breach, which Juniper Networks estimates to account for $2.1 trillion dollars by 2019.

Sjouwerman said the majority of KnowBe4's growth has taken place in the financial sector, an area that is targeted four times as often as other industries. He said companies in the financial sector have taken the initiative to move away from the annual, compliance-focused “break room” training approach to a more effective, behavioral-based approach – they've begun to use Kevin Mitnick Security Awareness Training, which teaches users how to recognize threats with a combination of online, on-demand training and simulated phishing attacks that arrive in their inbox at work.

“Since we are the only company to offer a crypto-ransom guarantee [KnowBe4 covers the ransom in Bitcoin if a customer gets hit with ransomware after training its users], we moved up on the priority list,” Sjouwerman explained.