The Breach That Should Have Changed Everything

In March 2022, the Lapsus$ group breached Okta, Microsoft, Samsung, and Nvidia in rapid succession — not by deploying sophisticated zero-day exploits, but by buying stolen credentials, social engineering help desk employees, and exploiting MFA fatigue. A group reportedly led by teenagers embarrassed some of the most well-resourced cybersecurity teams on the planet.

That sequence of events tells you almost everything you need to know about the state of cybersecurity in 2022. The gap between what organizations spend on security tools and what they invest in the fundamentals — credential hygiene, employee awareness, access controls — remains enormous. And threat actors exploit that gap every single day.

This post is for anyone responsible for protecting an organization, whether you're a CISO, an IT manager at a 50-person company, or a business owner who just realized your cyber insurance premiums doubled. I'm going to walk through what's actually working right now, what's failing, and where to put your next dollar based on real breach data — not vendor hype.

The $4.35 Million Reality Check

IBM's 2022 Cost of a Data Breach Report pegged the global average cost of a data breach at $4.35 million — an all-time high. In the United States, that number hit $9.44 million. These aren't hypothetical figures. They include forensic investigation, legal fees, regulatory fines, customer notification, and the business you lose when your reputation takes a hit.

But here's the number that should really get your attention: organizations with fully deployed security AI and automation paid $3.05 million less per breach than those without. And companies that contained a breach in under 200 days saved over $1 million compared to those that took longer.

Speed and automation matter. But the most important finding in that report? The number one cost amplifier was — again — stolen or compromised credentials. They were the initial attack vector in 19% of breaches and took the longest to identify and contain, averaging 327 days.

What Cybersecurity Actually Means in Practice

It's Not a Product. It's a System.

I've seen organizations spend six figures on endpoint detection and response platforms while running Windows servers with default admin passwords. I've watched companies deploy next-gen firewalls but never train a single employee to recognize a phishing email. Cybersecurity isn't a product you buy. It's a system you build, test, and maintain.

That system has three layers that matter most: people, process, and technology — in that order. Flip that order and you'll end up with expensive tools protecting an organization where someone in accounting will still wire $200,000 to a threat actor pretending to be the CEO.

What Is Cybersecurity? (The Practical Definition)

Cybersecurity is the practice of protecting systems, networks, and data from digital attacks, unauthorized access, and damage. It encompasses everything from how you configure your email server to how you train your receptionist to handle a suspicious phone call. It includes vulnerability management, incident response planning, access control, encryption, monitoring, and — critically — security awareness training for every person who touches your network.

If your definition of cybersecurity stops at firewalls and antivirus, you're already behind.

The Three Attack Vectors That Own 2022

The 2022 Verizon Data Breach Investigations Report (DBIR) analyzed over 23,000 security incidents and 5,200 confirmed breaches. Three attack vectors dominated.

1. Credential Theft and Stuffing

Stolen credentials remain the most common way attackers get in. They buy them on dark web marketplaces, harvest them through phishing, or stuff them using automated tools that try leaked username/password combos against your login portals. If your employees reuse passwords — and statistically, most of them do — you're exposed.

Multi-factor authentication blocks the vast majority of credential stuffing attacks. But the Lapsus$ incidents proved that basic MFA implementations (especially push-notification-based) can be defeated through MFA fatigue attacks, where the attacker spams authentication requests until the user approves one just to make it stop.

The fix: number-matching MFA, hardware security keys, or FIDO2-based passwordless authentication. Not just "turn on MFA" — turn on the right MFA.

2. Phishing and Social Engineering

The Verizon DBIR found that 82% of breaches involved a human element — phishing, pretexting, social engineering, or human error. Phishing remains the top delivery mechanism for initial access, and it's getting harder to spot. Business email compromise (BEC) scams cost organizations $2.4 billion in 2021 according to the FBI IC3 2021 Internet Crime Report.

You can't firewall your way out of this. Your employees need to recognize social engineering in real time. That means ongoing phishing simulation and security awareness training — not a once-a-year compliance checkbox. I recommend starting with a structured phishing awareness training program that tests and educates simultaneously.

3. Ransomware

Ransomware attacks increased 13% year-over-year in the 2022 DBIR — a jump as large as the previous five years combined. And the attacks are no longer just about encryption. Double extortion (encrypt and exfiltrate, then threaten to publish) is now standard operating procedure for groups like Conti, LockBit, and BlackCat.

The Costa Rican government declared a national emergency in May 2022 after Conti ransomware crippled multiple government agencies. This wasn't a small business — it was a nation-state brought to its knees by a cybercriminal group.

Your ransomware defense needs to include tested offline backups, network segmentation, endpoint detection, and — again — employee training. Most ransomware still arrives via phishing emails or compromised credentials.

Zero Trust: Not a Buzzword Anymore

I was skeptical of zero trust for a long time. It felt like a marketing term more than an architecture. But the shift to remote and hybrid work made perimeter-based security models genuinely obsolete, and zero trust is the practical replacement.

The core principle is simple: never trust, always verify. Every user, device, and application must be authenticated and authorized before accessing any resource, regardless of whether they're inside or outside the network. NIST Special Publication 800-207 provides the authoritative framework.

In practice, zero trust means:

  • Micro-segmenting your network so a compromised workstation can't reach your domain controller
  • Enforcing least-privilege access — no one gets admin rights "just in case"
  • Continuously validating device health and user identity throughout a session
  • Logging and monitoring everything — you can't detect what you don't see

You don't implement zero trust overnight. You start with your most critical assets and work outward. But if you haven't started, 2022 is the year to begin.

The Training Gap That Keeps Costing You

Here's what actually happens in most organizations: an employee gets a 30-minute cybersecurity awareness module during onboarding, clicks through it while eating lunch, passes a five-question quiz, and never thinks about it again. Then, eight months later, that same employee clicks a phishing link that gives a threat actor access to your entire SharePoint environment.

Security awareness training works — but only when it's continuous, realistic, and measured. The IBM report found that organizations with security awareness training programs had breach costs $247,758 lower on average. That's a significant return on a relatively small investment.

Effective training includes:

  • Regular phishing simulations that mimic real-world campaigns — not obvious fake emails with broken English
  • Immediate feedback when someone fails a simulation, not a reprimand three weeks later
  • Role-specific training — your finance team faces different threats than your developers
  • Metrics you actually track — click rates, report rates, time-to-report

If you're looking for a starting point, our cybersecurity awareness training course covers the fundamentals that every employee in your organization needs to understand — from password hygiene to recognizing social engineering attacks.

Five Things to Do This Week

I'm not going to give you a 47-point cybersecurity roadmap. Here are five things you can do in the next five business days that will materially reduce your risk.

1. Audit Your MFA Coverage

Check every externally facing application and VPN. If any of them allow password-only authentication, fix it today. Then evaluate whether your MFA implementation is resistant to fatigue attacks. Push notifications alone aren't enough anymore.

2. Run a Phishing Simulation

Send a realistic phishing test to your entire organization. Use a current lure — a fake DocuSign request, a Microsoft 365 password expiration notice, or a shipping notification. Measure who clicks, who reports, and who ignores it. Use the results to target your training.

3. Verify Your Backups

When was the last time you actually restored from backup? Not "checked the backup log" — actually restored a system or dataset? If it's been more than 90 days, schedule a test restore this week. Ransomware loves organizations that assume their backups work.

4. Review Admin Accounts

Pull a list of every account with domain admin, local admin, or elevated cloud privileges. I guarantee you'll find accounts that belong to people who left the company, service accounts with passwords that haven't been rotated in years, and users with privileges they don't need. Clean it up.

5. Start a Training Program

If you don't have ongoing security awareness training, start now. Not next quarter. Not after the budget meeting. The average time from initial access to data exfiltration is shrinking — you don't have the luxury of waiting. A phishing awareness training program is one of the highest-ROI cybersecurity investments you can make.

The Vendor Problem

I need to say this directly: the cybersecurity industry has a vendor problem. There are over 3,500 security vendors right now, and many of them are selling overlapping tools that solve the same narrow problem. I've audited organizations running 60+ security tools that still couldn't detect a compromised admin account.

More tools don't equal better cybersecurity. Better coverage, better configuration, and better-trained people do. Before you buy another platform, ask yourself: have I fully deployed and tuned what I already have? Are my people trained to use it? Do I have the staff to monitor it?

If the answer to any of those is no, your next dollar belongs there — not on a new dashboard.

Cybersecurity Is a Business Function, Not an IT Problem

The most dangerous sentence I hear in boardrooms is, "We have an IT team that handles security." Cybersecurity is a business risk, not a technical one. When a breach hits, it's the CEO on camera apologizing, the CFO calculating the financial damage, and the general counsel managing the lawsuits.

The organizations that handle cybersecurity well treat it like they treat financial risk: board-level visibility, regular reporting, dedicated budget, and executive accountability. If your CISO (or whoever owns security) doesn't have a direct line to the CEO or the board, your governance structure has a gap that no technology can fix.

Where This Is All Heading

The threat landscape isn't slowing down. Ransomware-as-a-service has lowered the barrier to entry for cybercriminals. Initial access brokers sell footholds into corporate networks for a few hundred dollars. And the attack surface keeps expanding — cloud workloads, SaaS applications, IoT devices, remote workers on home networks.

But the fundamentals haven't changed. Patch your systems. Train your people. Enforce strong authentication. Segment your network. Test your incident response plan before you need it. Monitor your environment and actually investigate alerts.

Cybersecurity isn't about achieving perfect security — that doesn't exist. It's about making your organization harder to compromise than the next target, detecting intrusions fast when they happen, and having a tested plan to respond. The organizations doing those three things well are the ones that stay out of the headlines.

Start with what you can control today. Train your team on cybersecurity awareness. Run a phishing simulation. Audit your access controls. Each step you take closes a door that a threat actor was planning to walk through.