If you fall victim to a phishing scam, the loss of data, recovery costs, insurance company claim contests, loss of revenue, reputation damage, and loss of customer, vendor, and employee trust will happen regardless of a ransom payment. Paying the ransom does not guarantee file access and strengthens the position for the insurance company to contest your claim. 

“There is no good option here. Most of the implications are the same,” Polak said. “How do we tell the IRS we paid $50,000? What line item is that?” 

Recommended cybersecurity measures include performing all mandatory scheduled software updates for computers and firewalls, having strong multi-factor authentication, comprehensive employee training, VPNs, and token theft protection. Pavlinik said he moved StoredTech completely away from passwords in favor of FIDO keys, physical devices that use public key cryptography for authentication. Biometrics is another option. 

“Passwords are a dead, failed technology because we’re human and humans are not good at remembering things,” he said. 

Multi-factor authentication is also not as safe, as the running cost to access a personal phone is about $5,000, Pavlinik said. If they don’t have access to your phone, they might call and ask for the authenticator number. 

“Most people will comply. Social engineering attacks bypass technical security,” he said. “Humans are always the weakest link.” 

Employee education and vigilance is crucial to avoiding phishing attempts. The presenters stressed the importance of encouraging employees to slow down and take their time because phishing attempts rely on an urgent call to action to get a response. 

"Telling our teams to slow down is very important because they’re always working fast to solve issues for customers,” said Brian Burbridge, senior vice president, strategic accounts at Caliber Collision. 

Mitigation strategies can reduce the chances of a successful attack. Zero Trust Architecture reduces it by 40%-90%, strong multi-factor authentication 99.2%, anti-virus and extended detection and response 99%, 24/7 managed SOC 85%, token theft monitoring and protection 80%, sign-in protection 99.9%, security awareness training 80%, and updating software and hardware including firewalls 80%. 

The presenters emphasized the importance of there being no single strategy that offers 100% protection from phishing attacks because cybersecurity is like an onion, and you need layers on layers on layers to fully secure your business. 

The presentation ended with a QR code to scan for more information. It was a fake that notified the 22 audience members who scanned it that they could’ve compromised their personal device had it been real.