In the hustle and bustle of modern life, our mental energy is the most important currency we have. To preserve cognitive resources, the human brain subconsciously takes mental shortcuts, called cognitive biases, whenever and wherever it can. While these preconceptions do not necessarily reflect reality or rationality, we rely on them to expedite and simplify information processing. These biases influence and affect not only the way we think and behave, but also our decision-making process. Unfortunately, hackers exploit these cognitive biases to target employees with phishing attacks in order to gain access to corporate data.

To better understand the cognitive biases used, SecurityAdvisor assessed more than 500,000 malicious emails targeting senior leaders, mid-managers, and entry level employees, as well as IT, finance, human resources, and legal teams. The report reveals how cybercriminals are using cognitive bias techniques to target employees in social engineering attacks, as well as which cognitive biases are most popular by the role, department, and industry employees work in.

At a high level, here are a few findings from the report:

• Out of all cognitive biases, cybercriminals use the halo effect the most, which appeared in 29% of phishing attacks. Rounding out the top three most commonly used cognitive biases is hyperbolic discounting (28% of phishing attacks), followed by the curiosity effect (17%).
• C-suite executives are targeted by phishers almost 50 times more than a regular employee, targeted with scams that leverage a range of cognitive biases from fake speaking invitations from reputable universities or organizations (i.e., halo effect) to exclusive access to unnamed golf events (i.e. curiosity bias). 
• IT security teams are the second-highest targeted department and are targeted 43.5 times more than regular employees as a result of their access to a multitude of their organization’s systems. A majority of scams leverage the curiosity bias, with some of the most popular subject lines focused on securing remote workforces and top trends in data and analytics.
• The healthcare industry is most targeted by scams leveraging authority bias, recency effect, and loss aversion, while retailers are targeted by the halo effect, curiosity bias, and hyperbolic discounting.

To learn more about the specific cognitive biases as well as more report findings, click here.