C320 Verizon DBIR 2017-170424-18D OPT

The study has since evolved to include security incidents and not just breaches for many findings, but the rest of the statement holds true to this day. The information, provided in aggregate, is filtered in many ways to make it relevant to you (e.g., by industry, actor motive). It is a piece of the information security puzzle—an awesome corner piece that can get you started—but just a piece nonetheless. The rest is filled in by you. You (hopefully) know the controls that you do or do not currently have to mitigate the effectiveness of the threat actions most commonly taken against your industry. You know the assets that store sensitive data and the data flow within your environment. If you don’t – get on that. You also know your own incident and data-loss history. Use your own knowledge combined with the data from our report; they complement each other.