The figures linked to cybercrime speak for themselves...
The average cost of a cyber attack on a business was around £900,000 in 2018 - which represented an increase of more than 50% on the previous year.
It has also been documented that these attacks have a highly negative impact on productivity, customer experience and brand reputation.
As a general rule, a “phishing attack” describes the process when an email is sent inviting a recipient to click on a link that subsequently leads to a malicious but harmless-looking website.
This website can subsequently launch a ransomware attack or surreptitiously steal passwords to break into the recipient's accounts.
Recently, "spear phishing" – when a specific individual is targeted - has also become more prevalent.
On these occasions, the email often appears to come from someone the user knows personally or professionally.
It’s as a consequence of the increasing number of these attacks that many businesses are assessing whether “Phishing as a Service” might be a proactive way to stop cyber criminals in their tracks.
In essence, Phishing as a Service enables businesses to assess just how susceptible they are to attacks by using “simulated real-world cyberattack scenarios” on their employees.
These “simulated attacks” track that company’s vulnerability to phishing by employee, department or region in a safe and controlled environment.
Most phishing emails are sent in bulk to thousands of users.
Holly Grace Williams, principal security consultant at Manchester-headqurtered cybersecurity company Secarma, said: "As with many security risks, a big part of the difficulty is organisational awareness.
"If organisations don’t know they have a problem, or can’t grade how bad it is, they won’t be able to respond to it appropriately.
"By sending benign phishing emails to staff members they are able to grade their risk more accurately.
"The benefit of Phishing as a Service platforms is that it takes the effort out of it – there’s no need to set up infrastructure or build software because it’s all there for you.
"This allows the customer to spend more time gathering metrics and less time messing about with unnecessary technicalities.
"By testing staff regularly, companies see susceptibility to a variety of phishing campaign types from simple to complex and both untargeted and targeted."
Secarma has helped a range of businesses become “more mature” against the risks of cyber-attacks.
WIlliams added: "Many companies find that their first phishing test goes badly, with huge numbers of staff either falling for the campaign or even just clicking through out of curiosity...
"By demonstrating the risk and the variety of possible campaigns attackers could use we help users practically see the ways that they can spot something is suspicious."
Secarma adds that after just a few phishing tests it often sees the numbers fall significantly as users become more aware of the problem.
"An important aspect is that security awareness training needs to be ongoing to be effective – with staff turnover, new staff members joining the team and people simply forgetting things over time," continued Williams.
So, how does Secarma keep up with - and consistently beat - the cyber criminals?
"It’s a little easier for us to keep across the latest developments in security, because we do it every day," concluded Williams.
"As we run many different security tests simultaneously for various customers it allows us to iteratively develop our techniques.
"We try to remain flexible and see what works - if something works then we’ll build on it.
"Plus of course, we’re always tracking what the bad guys are up to.
"If we see an effective phishing campaign in the wild - being used by criminals to target people - then we’ll analyse it, work out why it’s effective and then build that information back into our offering."
Lawrence Jones, CEO of UKFast says: "There’s no doubt about it. Phishing emails, much as we may laugh about Nigerian princes, are a significant threat to businesses.
"As many as 156 million phishing attacks are carried out every day and social engineering techniques are increasing in sophistication. It’s no wonder that phishing is the most common way for hackers to launch a cyber-attack.
"Attackers trick victims into clicking malicious links or opening attachments containing malware by disguising the emails as legitimate communications. By gathering information about their target in advance, they can tailor attacks to be incredibly convincing. The success rate of these attacks is worryingly high.
"The global ransomware attack WannaCry, which infected more than 200,000 computers including large parts of the NHS, originated from a simple phishing email.
"It's always the human element that is the weakest link in the security chain, so it’s incredibly important that businesses educate their teams about the risks of clicking on links or opening attachments within emails, and help them learn to spot the fakes.
"At UKFast, we’ve built a new platform which allows businesses to test their employees by sending out fake phishing emails and monitoring which team members are fooled by them. Training modules on how to spot phishing emails can then be delivered to those who fail the test. It’s an amazing way to strengthen your first line of defence – your people."
Ultimately, with phishing emails responsible for so many hacks and data breaches, there really is no excuse not to protect your business.