TechOnPurpose Logo

TOP 7 Cyber Truths: #2 Everyone is at Risk – Everywhere

by | Feb 26, 2025

If you’re keeping up with prior TOP 7 Cyber Truths posts, this critical truth, EVERYONE is at Risk, should be pretty obvious by now.  If that’s not clear or you missed prior posts, I highly recommend you rewind and review those here.

When we say everyone is at risk, we literally mean everyone – not just your business, NPO, church, enterprise, or government entity – but literally each and every one of you. That includes your spouse, children, family, and even seniors like your grandparents. The horrors that are targeting seniors, robbing them of a lifetime of earnings and the descendants of their inheritance, are beyond evil and sadly ever present in malicious phone calls, emails, texts, and social media.

  • Did you know that bad actors are hijacking (copying) very legitimate marketing brochures, billboards, TV, and social ads and replacing QR codes with devastatingly malicious links?
  • Have you ever stumbled onto a random USB lying on the floor at Starbucks or the airport? DO NOT plug in random USBs you find in public places! These devices are too frequently intentionally placed with devastating viruses, key loggers, or ransomware.
  • Have you ever accessed personal email on a work device? This is a terrible idea. Personal email accounts are often targeted with legitimate-looking attachments or links that can lead to serious security breaches. This scenario can result in compromised data and malicious code being instantly transferred onto your company device, potentially spreading throughout the organization!

REMINDER: This is critical WISDOM (not fear tactics) meant to empower you to right-size your decision-making, to comprehensively protect your interests and future against a very real, sizable, and advancing threat. This is the exact intent of our entire TOP 7 Cyber Truths series, to equip you with comprehensive truth to make wiser decisions on:

  • What are [your] actual risks?
  • What should you do about those risks?
  • In what order?
  • At what cost?
  • All are grounded in universal cyber truth.

 

Let’s take a closer look at 10 alarming facts that highlight how everyone, every industry, everywhere is at risk from cyberattacks:

  1. INCREASE OF ATTACKS:  Cybercrime is projected to cost the world $10.5 trillion annually by 2025. This massive increase shows that cybercriminals are targeting more individuals and businesses, across all industries, at an unprecedented rate.
  2. GROWING ATTACK SURFACE:  As we all embrace digital transformation, we create more points of vulnerability. Everything from cloud storage and IoT devices to mobile apps exposes businesses to cyber threats.
  3. RANSOMWARE EXPANSION: Ransomware attacks surged 150% in 2020. Small and medium-sized businesses are particularly vulnerable as they often lack the resources to implement robust cybersecurity measures.
  4. SUPPLY CHAINS AT RISK: Cyberattacks on supply chains are on the rise, affecting businesses that may not have direct exposure to cybercriminals. A breach in a supplier’s system can lead to widespread disruption for others downstream.
  5. WE STILL MAKE MISTAKES(!): Over 90% of cyberattacks are linked to human error, such as weak passwords, unpatched software, or falling for phishing scams. Every employee is a potential vulnerability.
  6. HEALTHCARE ATTACKS ARE GROWING: The healthcare industry is increasingly targeted, with over 70% of healthcare organizations reporting at least one breach. Cybercriminals see healthcare data as incredibly valuable for fraud, identity theft, and ransom.
  7. CRITICAL INFRASTRUCTURE UNDER ATTACK: Critical infrastructure sectors, like energy, water, and transportation, are prime targets for cyberattacks. In 2020, a cyberattack on a US pipeline resulted in major fuel shortages, demonstrating the far-reaching impact on everyday life.
  8. STATE-SPONSORED ATTACKS: Nation-state actors are increasingly involved in cyberattacks, targeting everything from corporate espionage to national security. These sophisticated attacks are harder to detect and defend against.
  9. COST OF BREACHES GROWING: The average cost of a data breach was $4.45 million in 2023, with some industries like financial services and healthcare facing even higher costs. The financial repercussions can be devastating for businesses, especially SMEs.
  10. WE’RE NOT PREPARED: A staggering 60% of small businesses close within six months of experiencing a cyberattack, often due to the high costs and reputational damage. A majority of businesses, especially smaller ones, are unprepared and underfunded when it comes to cybersecurity.

This short list of facts demonstrates that no one is immune to cyber threats, and the stakes are higher than ever for large enterprises, small organizations, and individuals alike.

 

What’s Next?
So how do you protect your interests BEFORE you are a victim?

Now that you better comprehend the depth [COMPLEXITY] and breadth [EVERYONE – EVERYWHERE] you should continue your cybersecurity truth journey by grasping Truth #3 “There are NO Silver Bullets” for the problem. Then in Truth #4 “Assess. Assess. Assess!”, we’ll discuss steps you can take NOW to understand: What is my exposure? (What we call your “current cyber risk posture.”)

There’s no reason to wait for the next episode. You can claim your free 15-minute self-guided TOPCYBER21™ Cyber Risk Assessment now, or schedule time for a guided walk-through with one of our cyber experts! Visit topcyber21.help to learn more and start your journey to secure, reliable, trusted technology.


About the Author:

Matt Tankersley is a US Navy veteran and the Founder & CEO of TechOnPurpose. Matt is recognized as an innovator with over 35 years of experience in Information Technology specifically in the areas of collaboration, cloud, security, and managed services. Recognizing the complexity, risk and blindsides that business owners face led Matt to create the TOPCYBER21™ Framework, which simplifies how organizations operationalize cybersecurity.

Matt’s dedication to customer experience and unwavering belief that “Technology is at the Heart of Business today,” cast the foundation for our culture and simple operating philosophy: “We love what we do, who we do it with, and who we do it for.”

About TechOnPurpose:

Based in Austin, Texas, TechOnPurpose (“TOP”) delivers comprehensive managed IT and cybersecurity solutions to select clients globally. TOP’s approach to managed IT and cybersecurity continues to deliver simplified conversations and comprehensive, affordable solutions for our global customer family of Small & Medium Businesses and Non-Profits.

Chrome Zero Day Patch: Update Now

Chrome Zero Day Patch: Update Now

Chrome zero day patch #4 of 2026 covers two actively exploited vulnerabilities. CISA deadline: April 15. Your timeline should match.

View Next

Diagram showing how Texas cybersecurity law applies to every business, with two outcome paths — documented before a breach leads to safe harbor, documented after leads to full legal exposure

Texas Cybersecurity Law: What Every Business Must Know

⏱ 6 min readKey Takeaways Texas cybersecurity law already requires every business, regardless of size, to protect sensitive personal information and report breaches within 60 days of discovery. SB 2610 offers a safe harbor from punitive damages — but only if you can...
CVE dashboard showing NIST's "Not Scheduled" status replacing CVSS scores — patch prioritization without a score

NIST Just Derailed Patch Prioritization — Here’s Your Fix

⏱ 3 min readKey Takeaways NIST stopped automatic CVSS scoring for most CVEs on April 15 — the patch prioritization signal most organizations relied on just changed permanently. Only CVEs on CISA's KEV list, federal software, and EO 14028 critical software receive...
AI-Enabled Device Code Phishing — TechOnPurpose Identity & Access Management MFA Bypass Prevention

AI-Enabled Device Code Phishing Is Bypassing MFA — What Your Microsoft 365 Users Are Up Against

⏱ 4 min readKey Takeaways Device code phishing abuses a legitimate Microsoft OAuth flow — no passwords stolen, no MFA prompt triggered, full M365 access granted. AI-generated lures are now role-specific and hyper-personalized — standard phishing training won't catch...
Chrome Zero-Day Patch — TechOnPurpose TC21-05 Endpoint Patch Management Urgency

Chrome Zero Day Patch: Update Now

⏱ 4 min readKey Takeaways This chrome zero day patch isn’t routine maintenance — it covers two vulnerabilities already being weaponized. CVE-2026-5289 scored a 9.6 CVSS — a full sandbox escape. If exploited, an attacker owns the endpoint. CISA added CVE-2026-5281 to...
Russian CTRL Toolkit remote desktop hijacking — TechOnPurpose TC21-15 secure remote access defense

Russian Malware CTRL: Remote Desktop Hijacking Undetected

⏱ 4 min readKey Takeaways Newly disclosed Russian remote access toolkit called CTRL is enabling remote desktop hijacking attacks that bypass all known threat intelligence platforms — including VirusTotal CTRL is a newly disclosed Russian-origin remote access toolkit...
Old vulnerabilities cyber risk — TechOnPurpose patch management defense-in-depth

#CYBERinsanity: The Vulnerabilities Attacking You Today Were Published a Decade Ago

⏱ 5 min readKey Takeaways 32% of the most active exploits are old vulnerabilities, more than ten years old — patches exist, they're just not being applied. Attackers start with the low-hanging fruit: automated scans for known, unpatched flaws before deploying anything...
Defense in depth strategy — TechOnPurpose TOPCYBER21 cybersecurity framework protects your organization from vulnerability exploits

Why Patching Alone Won’t Stop 40% of Cyberattacks

⏱ 4 min readKey Takeaways A defense in depth strategy is no longer optional — it's the only architecture that holds when patching alone fails. Nearly 40% of all intrusions in Q4 2025 were caused by exploited vulnerabilities — not phishing, not credential theft. Some...
2026 National Cyber Strategy Blog Post image

2026 National Cybersecurity Strategy: What It Means for You

⏱ 5 min readKey Takeaways The White House's 2026 national cybersecurity strategy introduces six strategic pillars — the clearest federal signal yet that passive cyber defense is no longer acceptable. All six pillars align directly to the TOPCYBER21™ framework — if...
TechOnPurpose achieves MSSP Alert's prestigious 2025 Top 250 Managed Security Service Providers (MSSPs) list, ranking #159 globally—a significant jump of 32 positions from last year's #191.

TechOnPurpose Named to MSSP Alert’s 2025 List of Top 250 MSSPs – Climbs 32 Spots Year-Over-Year

TechOnPurpose is proud to announce its inclusion in MSSP Alert's prestigious 2025 Top 250 Managed Security Service Providers (MSSPs) list, ranking #159 globally - a significant jump of 32 positions from last year's #191. This marks the second consecutive year...
#STOPtheCYBERinsanity image - Is Pen Testing a Dollars-Before-Defense Mistake

#CYBERinsanity: When Pen Testing Becomes a Dollars-Before-Defense Mistake

The Fallacy of Pen Testing as a Priority in Cybersecurity If you’ve been following our STOP the #CYBERinsanity series, you already know this uncomfortable truth: Most cybersecurity failures aren’t caused by brilliant hackers or exotic zero-day exploits. They’re caused...
en_US