Based on the statistics provided, it seems that companies should put more money in defending against phishing, web and cloud attacks (especially S3 configuration). In addition, we should look into utilzing WAF design where the application looks at the number of counts someone tries to access a webserver (anything over 10-20 times) and they get the 401-404 error codes, this needs to be an automated action.



In addition, if we are not dealing with major countries or nation-states, then why not block entire countries; especially those that pose the greatest risk/threat.

Finally, we need to integrate into the mix a global phishing campaign where the attackers put in a email filtering list that updates it from the global providers like Google, Amazon, Microsoft, Cisco, Yahoo, IBM, Verizon and others to help thwart these attacks (utilize machine learning to comb through all of the data to come up with a score or ranking based on the type of attack (quantify the attack vector and threat, anything between 50-60% is put into an pending pool, 60-80% a warning or notification is sent and 80-100% it is automatically blocked by the software - tiered approach)