The Breach That Changed How I Think About Cyber Security

In February 2024, Change Healthcare — one of the largest health payment processors in the United States — was hit by a ransomware attack that disrupted pharmacies, hospitals, and insurance claims across the country for weeks. UnitedHealth Group, its parent company, later confirmed the breach affected approximately 100 million individuals. The attack vector? Stolen credentials on a remote access system that lacked multi-factor authentication.

That single incident captures everything broken about how most organizations approach cyber security today. Billions spent on perimeter tools, but a single compromised credential brought down critical healthcare infrastructure nationwide.

I've spent years working in this field, and the pattern repeats itself with brutal consistency. Organizations invest in the flashy and neglect the fundamental. This post is about what actually works — grounded in real data from 2025, real incidents, and practical steps you can implement without a seven-figure budget.

The State of Cyber Security: 2025 by the Numbers

The Verizon 2024 Data Breach Investigations Report (DBIR) found that 68% of breaches involved a human element — phishing, credential theft, social engineering, or simple mistakes. That number has hovered around two-thirds for years. It's not getting better because most organizations still treat security awareness as a checkbox, not a capability.

IBM's 2024 Cost of a Data Breach Report put the global average cost at $4.88 million per incident — the highest ever recorded. For U.S. organizations, that figure was significantly higher. Healthcare topped the chart for the fourteenth consecutive year.

Meanwhile, the FBI's Internet Crime Complaint Center (IC3) reported over $12.5 billion in losses from cybercrime in 2023. Business email compromise alone accounted for roughly $2.9 billion. These aren't abstract numbers — they represent real companies, real employees, and real consequences.

Why Spending More Doesn't Mean Better Protection

Here's what actually happens in most organizations I've worked with: they buy endpoint detection, deploy a firewall, subscribe to a threat intelligence feed, and call it a day. Then an employee clicks a phishing link and hands over their credentials to a threat actor operating out of a rented server in Eastern Europe.

The problem isn't a lack of tools. It's a lack of integration, a lack of training, and a stubborn refusal to address the human layer of defense. Your cyber security posture is only as strong as the least-trained person with access to your systems.

What a Threat Actor Sees When They Look at Your Organization

I want you to flip your perspective for a moment. Stop thinking like a defender. Think like an attacker.

When a threat actor evaluates a target, they're looking for the path of least resistance. They check LinkedIn for employee names and titles. They scrape your website for email formats. They probe your external-facing systems for known vulnerabilities. And then they craft a phishing email that looks like it came from your CEO, your IT department, or a trusted vendor.

The Social Engineering Kill Chain

Most successful attacks follow a predictable sequence:

  • Reconnaissance: The attacker gathers information about your organization, employees, and technology stack.
  • Weaponization: They craft a convincing lure — a phishing email, a fake login page, a voice call pretending to be IT support.
  • Delivery: The lure reaches an employee via email, SMS, phone, or even social media.
  • Exploitation: The employee clicks, authenticates, or provides information.
  • Action on objectives: The attacker moves laterally, escalates privileges, deploys ransomware, or exfiltrates data.

Every single step in this chain has a human decision point where training could have stopped the attack. That's why cybersecurity awareness training isn't a nice-to-have — it's a critical control.

The $4.88M Lesson Most Small Businesses Learn Too Late

Small and mid-sized businesses often assume they're too small to be targets. The data says otherwise. The Verizon DBIR consistently shows that smaller organizations are attacked at rates comparable to large enterprises — but with far fewer resources to recover.

A ransomware attack that costs a Fortune 500 company a bad quarter can permanently shut down a 50-person firm. I've seen it happen. A manufacturing company in the Midwest lost access to every file server and backup drive because the ransomware propagated through flat network segments with no segmentation and no offline backups. They paid the ransom. They still lost data.

The fix wasn't expensive technology. It was basic cyber security hygiene: network segmentation, offline backups, credential management, and employee training on phishing simulation exercises.

What Is Cyber Security, Really? (And Why Most Definitions Miss the Point)

If you search "what is cyber security," you'll get a hundred definitions about protecting systems, networks, and data from digital attacks. That's technically accurate and practically useless.

Cyber security is the practice of reducing the likelihood and impact of unauthorized access to your digital assets — through a combination of technology, processes, and trained people. The "trained people" part is what most organizations underinvest in. Technology fails when humans make poor decisions. Processes break when employees don't understand them.

That's why the most effective cyber security programs treat training as infrastructure, not overhead. When your employees can recognize a phishing attempt, question an unusual request, and report suspicious activity without hesitation, you've built a human firewall that no appliance can replicate.

Five Cyber Security Controls That Actually Reduce Risk in 2025

I'm not going to give you a list of 47 things. Here are five that, in my experience, deliver the most risk reduction per dollar spent.

1. Multi-Factor Authentication Everywhere

The Change Healthcare breach happened because MFA wasn't enabled on a remote access portal. That's it. One missing control, billions in damage. CISA has been urging organizations to implement MFA as a baseline for years. If you haven't done it on every externally accessible system and every privileged account, stop reading this and go do it now.

2. Phishing Simulation and Security Awareness Training

Running a phishing simulation once a year during Security Awareness Month isn't training — it's theater. Effective programs run continuous simulations, vary the difficulty, and provide immediate feedback when someone fails. Over time, click rates drop and reporting rates climb.

If you're looking for a structured approach, phishing awareness training designed for organizations can help you build that muscle memory across your entire workforce. The goal isn't to shame employees — it's to make recognition of social engineering instinctive.

3. Zero Trust Architecture

Zero trust isn't a product. It's a design philosophy: never trust, always verify. Every access request — whether from inside or outside the network — must be authenticated, authorized, and continuously validated. NIST Special Publication 800-207 provides the foundational framework.

In practical terms, this means microsegmentation, least-privilege access, and continuous monitoring. It also means abandoning the castle-and-moat model that assumes everything inside your perimeter is safe. In 2025, with remote work and cloud infrastructure, there is no perimeter.

4. Incident Response Planning (Tested, Not Just Written)

Every organization I've assessed has an incident response plan. Maybe 20% have actually tested it. A plan that hasn't been tabletop-exercised is a document, not a capability. Run a tabletop exercise quarterly. Include executives, not just IT. Make the scenarios realistic — a ransomware attack during a holiday weekend, a data breach discovered by a journalist, a business email compromise that already resulted in a wire transfer.

5. Patch Management With Actual Deadlines

CISA maintains its Known Exploited Vulnerabilities (KEV) catalog specifically to tell you which vulnerabilities are being actively exploited in the wild right now. If a vulnerability is on that list and you haven't patched it, you're not unlucky when you get breached — you're negligent. Set a policy: KEV-listed vulnerabilities patched within 48 hours. Everything else on a risk-prioritized schedule.

The Ransomware Problem Isn't Going Away

Ransomware attacks hit a new peak in 2024, with groups like LockBit, ALPHV/BlackCat, and Cl0p dominating the landscape before law enforcement disrupted some operations. But disruption isn't elimination. New groups emerge constantly, and ransomware-as-a-service has lowered the barrier to entry so far that relatively unsophisticated criminals can now launch devastating attacks.

Double extortion — encrypting data and threatening to leak it — is now standard practice. Some groups have moved to triple extortion, adding DDoS attacks or contacting victims' customers directly.

Your defense strategy must assume ransomware will get through. That means tested backups stored offline, network segmentation to limit lateral movement, and employees trained to recognize the phishing emails that serve as the initial access vector for most ransomware campaigns.

Credential Theft: The Silent Epidemic

Stolen credentials are the skeleton key of modern cybercrime. The Verizon DBIR identified stolen credentials as the top initial access method for breaches year after year. Infostealers — malware designed specifically to harvest usernames and passwords from browsers, email clients, and credential stores — have exploded in volume.

Dark web marketplaces sell credentials in bulk. Your employees' personal passwords, reused across work and personal accounts, are likely already exposed from previous breaches of consumer services. This is why MFA matters. This is why password managers matter. And this is why credential theft needs to be a core topic in your cybersecurity awareness training program.

Building a Cyber Security Culture, Not Just a Program

The organizations with the strongest security posture don't just have good tools and policies. They have a culture where security is everyone's responsibility — not just IT's.

That culture starts at the top. When the CEO takes the phishing simulation seriously and talks about it openly, employees follow. When security teams are seen as enablers rather than blockers, people actually report suspicious activity instead of ignoring it.

Three Signs Your Culture Is Working

  • Reporting rates go up, not just click rates going down. Employees who report phishing attempts are more valuable than employees who simply don't click.
  • People ask questions before acting on unusual requests. A culture of healthy skepticism stops business email compromise cold.
  • Security is discussed in business terms, not just technical jargon. When leadership understands risk in terms of revenue, reputation, and regulatory exposure, they fund the right controls.

What You Should Do This Week

I'm not going to tell you to boil the ocean. Here are four things you can do in the next seven days that will materially improve your cyber security posture:

  • Audit your MFA coverage. List every externally accessible system and every admin account. If MFA isn't enabled, enable it.
  • Run a phishing simulation. Use phishing awareness training tools to test your employees with a realistic scenario. Measure who clicks, who reports, and who ignores.
  • Check the CISA KEV catalog. Cross-reference it against your asset inventory. Patch anything that matches immediately.
  • Schedule a tabletop exercise. Pick a ransomware scenario. Invite your leadership team. Walk through the first 72 hours. You'll find gaps you didn't know existed.

Cyber security isn't a destination — it's an ongoing discipline. The threats evolve monthly. Your defenses need to evolve with them. The organizations that survive breaches aren't the ones with the biggest budgets. They're the ones that took the fundamentals seriously before the attack landed.