Despite more than a decade of talk, the seminal concept in cybersecurity of zero trust — the assumption that no user or device on a computer network can be trusted — hasn’t been implemented nearly as widely as one might expect from all of the attention.

While ransomware has been around for decades, its prevalence has exploded in the last few years. These attacks used to be perpetrated by individuals; now, they’re launched by networked groups of affiliates who buy and sell each other’s specialized skills and toolkits. Attacks were once unfocused and one-dimensional; now, they use targeted, multilayered tactics that are much harder to defend against and command much higher ransoms. Ransomware is expected to cause $42 billion in damages by the end of 2024.

While businesses are busy trying to protect themselves against ransomware attacks that spark headlines news, threat actors are sticking to one of the oldest and most effective hacking techniques—business email compromise (BEC).