Study finds troubling perception gap in what causes cybersecurity incidents and data breaches

RICHMOND, Va. – A recent study published by Hive Systems found that the media, academia, and the general public vastly overestimate the prevalence of system intrusions while underestimating more common causes of cybersecurity incidents and data breaches. A comprehensive analysis of academic publications, media trends, and search engine results showed that while system intrusions account for only one-third of cybersecurity incidents and data breaches, more than two-thirds of media coverage and internet searches focused around the topic.

“Having more accurate conversations about how hackers affect businesses and families is critical,” said Alex Nette, Hive Systems CEO and Co-Founder. “If we’re focused on what we see in the news and online, it creates a bias that leads to cybersecurity investments in areas that may not reduce your risk.”

While the industry-standard 2023 Verizon Data Breach Investigation Report (DBIR) listed system intrusions as the most prevalent cause of cybersecurity incidents and data breaches (35% and 25% respectively), the public perception far outweighs its pervasiveness. According to the report, not only were internet searches for system intrusions nearly twice as common (55%), the second-most common tool for data breaches – basic web application attacks – was barely explored (<1%). 

Similarly, media coverage predominantly focused on system intrusions and social engineering – approximately 75% of all coverage. That amount of coverage equates to over 30% more than its frequency as reported by the DBIR. While The New York Times dedicated a majority of its coverage cybersecurity incident and data breach coverage to system intrusions (65%), The Guardian spent 30% of its coverage on social engineering – a stark difference in coverage between the two outlets. 

On the academic side, over three-quarters of all academic journals published focused on denial of service attacks – a topic that accounted for a minuscule 1% of total cybersecurity data breaches and only 40% of total cybersecurity incidents.

DBIR incident and breach classification patterns are based on clustering of data as opposed to how the cybersecurity industry tends to group them. Types of breaches include System Intrusion (e.g., ransomware, malware, stolen credentials), Social Engineering (e.g., phishing emails, texts, phone calls), Basic Web Application Attacks (e.g., SQL injection), Miscellaneous Errors (e.g., misconfigurations), Privilege Misuse (e.g., disgruntled employee data leak), Lost and Stolen Assets (e.g., stolen laptop or phone), Denial of Service (e.g., DDoS attacks) and Everything Else (e.g., ATM card skimmers).

The chart summarizing the research results is available for download here.