Download this article in PDF format.
Cyberattacks in the U.S. reached new highs in 2024, exposing data from nearly 170 million people in major breaches and pushing the average cost of a U.S. breach to $9.36 million, according to Hinkley Allen. Threat actors used everything from phishing to zero-day flaws, driving the impact higher each year. The issue keeps escalating as organizations face sharper risks than ever before.
The growing problem expands well outside of the U.S. Over the past four years, the global average number of weekly attacks more than doubled, climbing from 818 per organization in 2021 to 1,984 in 2025, according to the World Economic Forum’s Global Cybersecurity Outlook 2025. The report highlights how new technologies, geopolitical tensions and talent shortages are adding to the risk. Small businesses remain especially vulnerable, with many reporting limited cyber resilience.
“Despite the increasing number of attacks, industry analyst IANS reports stalling budgets for cybersecurity. Growth has slowed from 17% in 2022 to just 4% in 2025, rather than increasing in line with threat levels,” Andrea Willige writes in the WEF report. “Further complicating matters is an acute talent scarcity, making it not only hard but also expensive to recruit cybersecurity experts.”
Cybersecurity Awareness Month
As cyberattacks outpace organizational and governmental defenses, awareness and preparation matter more than ever. That’s the goal of Cybersecurity Awareness Month, which takes place every October. This year’s theme is Building a Cyber Strong America. The focus is on bolstering the nation’s infrastructure against growing cyber threats and strengthening resilience across every sector.
“Cybersecurity is more than an IT issue—it’s a public safety and economic security priority,” CISA emphasizes. “Many organizations are part of the nation’s critical infrastructure, from local utilities and transportation systems to hospitals, schools and public safety agencies.” It says small and medium size businesses also play an important role in critical infrastructure, with suppliers, contractors, vendors, manufacturers and other providers all working together to keep critical infrastructure operating.
Here are eight ways organizations can strengthen their cybersecurity strategies and stay ahead of evolving threats:
- Start with the fundamentals. Cybercriminals look for easy targets. Companies that skip the fundamentals make it easier for attackers to get in. CISA urges every organization to train employees to spot phishing attempts, require strong passwords and multifactor authentication, and keep business software up to date. These simple steps block many common entry points.
- Protect and monitor your data. Strong cybersecurity goes beyond prevention and focuses on preparation. Logging system activity helps teams detect suspicious behavior early. Regular data backups make recovery faster and less stressful after an incident. Encrypting files and devices adds another layer of protection, keeping sensitive information unreadable even if attackers gain access.
- Stay connected and share information. Cybersecurity is a shared responsibility and CISA encourages organizations to report cyber incidents to help alert others and strengthen defenses across industries. Public agencies should also consider moving to .gov domains to reduce impersonation risks and build public trust. Sharing threat information and staying informed helps everyone stay ahead of potential attacks.
- Combine skilled people with smart technology. The WEF reports that while cyberattacks continue to rise, cybersecurity budgets are slowing. Many companies are leaning on AI tools to help detect and respond to threats faster. But the organization also warns that attackers are using those same tools to create more advanced phishing, identity theft and zero-day attacks. The best approach is to pair human awareness with AI-driven defense, training employees to spot scams, question unusual requests and verify information before acting.
- Protect identity and verify communication. According to WEF, deepfakes and AI-generated content are now part of the cybercriminal toolkit. Criminals have used cloned voices and fake video calls to impersonate executives and steal millions. Businesses need strong identity checks for any financial or data-related requests. Building clear verification steps—like confirming with a second contact or secure channel—helps stop fraud before it spreads.
- Close the talent gap through collaboration. WEF’s Global Cybersecurity Outlook 2025 found that only 14% of organizations have the right cybersecurity talent. That shortage leaves most companies underprepared. To counter it, WEF urges collaboration among private companies, governments and global partners. Sharing threat data, training programs and best practices help strengthen defenses and build a more resilient world overall.
- Control physical access to your computers and create user accounts for each employee. Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended. “Make sure a separate user account is created for each employee and require strong passwords.,” the FCC advises. “Administrative privileges should only be given to trusted IT staff and key personnel.”
- Secure your Wi-Fi networks. This may sound like an obvious one, but if you have a Wi-Fi network for your workplace, make sure it is secure, encrypted and hidden. To hide your Wi-Fi network, set up your wireless access point or router so it does not broadcast the network name, known as the Service Set Identifier (SSID). Password protect access to the router.
