Regardless of where we fall on the crazy-secure to not-so-secure spectrum, the
quote above is a good road map to cybersecurity (and life in general). This report
aims to take a look at the times when things did not work as intended—not to
point fingers but to help us all learn and improve. In a time where almost everyone,
corporations and individuals alike, is looking at ways to do more with less, we believe
a close analysis of when our defenses failed can be very beneficial. While times of
great change are always challenging, they often also prompt us to take stock of our
situation and, if necessary, refocus both our viewpoint and our energies. Such is
the case with the DBIR this year. As a team, we decided to take a step back toward
the fundamental things that got us where we are, an intense focus on actual data
breaches analyzed using our own VERIS Framework. And speaking of VERIS, one
of the new goodies this refocusing brings is an even better mapping between VERIS
and MITRE ATT&CK through a collaboration with MITRE Engenuity and the Center
for Threat Informed Defense (CTID).2 It also helps that our parent organization, the
Verizon Threat Research Advisory Center (VTRAC),3 shared the most breaches ever
for us to analyze. Did you know it is VTRAC’s 20th anniversary this year? Save us a
slice of that cake, boss!
