Other key findings of the report include the following:

• The average total cost for an average company to contain malware is $1.9 million per year.
• Uncontained malware costs for an average sized company are as high as $105.9 million annually.
• The cost of business disruption due to phishing is $66.9 million per year.
• Employees waste an average of 4.16 hours annually due to phishing scams.
• The average annual cost to contain a credential compromise that originated from a successful phishing attack is $381,920. Uncontained credential compromises could cost a company as much as $105.9 million per year.

“In talking with security officers, we know that many do not expect much benefit from employee training as part of their defense against phishing attacks,” Dr. Larry Ponemon, chairman and founder for the Ponemon Institute, said. “This research proves that security officers should expect more from employee education and seek providers like Wombat Security who can provide results like these. As the threat landscape continues to intensify and phishing tactics become more sophisticated, this research shows that employees who have undergone security training are far less likely to fall victim to a phishing attack.”

Joe Ferrara, president/CEO of Wombat Security Technologies, said, “This is yet another proof point that an overall security posture is multifaceted and needs to include employee education to prevent against increasingly more sophisticated phishing attacks, which leave companies vulnerable to significant losses and business disruption. This research reveals the compelling value and ROI from putting in place a comprehensive security training program. Our methods have shown that a continuous training methodology does change employee behavior and reduce risk within an organization.”