The study, independently conducted by Arlington Research on behalf of Egress, interviewed 538 senior managers responsible for IT security in the UK and US across vertical sectors including financial services, healthcare, banking and legal.

Key insights from respondents include:

• 93% had experienced data breaches via outbound email in the past 12 months
• Organizations reported at least an average of 180 incidents per year when sensitive data was put at risk, equating to approximately one every 12 working hours
• The most common breach types were replying to spear-phishing emails (80%); emails sent to the wrong recipients (80%); incorrect file attachments (80%)
• 62% rely on people-led reporting to identify outbound email data breaches
• 94% of surveyed organizations have seen outbound email volume increase during COVID-19. 68% say they have seen increases of between 26 and 75%
• 70% believe that remote working raises the risk of sensitive data being put at risk from outbound email data breaches

When asked to identify the root cause of their organization’s most serious breach incident in the past year, the most common factor was “an employee being tired or stressed”. The second most cited factor was “remote working”. In terms of the impact of the most serious breach incident, on an individual-level, employees received a formal warning in 46% of incidents, were fired in 27% and legal action was brought against them in 28%. At an organizational-level, 33% said it had caused financial damage and more than one-quarter said it had led to an investigation by a regulatory body.

Traditional email security tools are not solving this problem

The research also found that 16% of those surveyed had no technology in place to protect data shared by outbound email. Where technology was deployed, its adoption was patchy: 38% have Data Loss Prevention (DLP) tools in place, while 44% have message level encryption and 45% have password protection for sensitive documents. However, the study also found that, in one-third of the most serious breaches suffered, employees had not made use of the technology provided to prevent the breach.

Organizations still cannot paint a full picture of the risks, relying on people-led reporting to identify email breaches, despite severe repercussions

When an outbound email data breach happens, IT leaders were most likely to find out about it from employees. 20% said they would be alerted by the email recipient, 18% felt another employee would report it, while 24% said the employee who sent the email would disclose their error. However, given the penalties that respondents said were in place for employees who cause a breach, it is not guaranteed that they will be keen to own up, especially if the incident is serious. 46% said that the employee who caused a breach was given a formal warning, while legal action was taken in 28% of cases. In 27% of serious breach cases, respondents said the employee responsible was fired.