Misconfigurations typically arise when organizations either choose not to manage or under-manage the devices employees use for work. This can be due to limited IT staffing, unclear standards, or a preference for unrestricted IT programs. To mitigate these risks, organizations should ensure that every device, whether company-owned or personal, meets baseline security standards before accessing sensitive data. Additionally, users should be engaged in maintaining proper device configurations over time, including timely updates to operating systems and applications.

Successful phishing attacks can lead to significant consequences, including the theft of work credentials, which may be used to access valuable business data or launch misinformation campaigns. This can result in personal data loss and financial exploitation. The report indicates that 31% of organizations had at least one user fall victim to a phishing attack, highlighting the ongoing risk these threats pose.

Legitimate software stores typically have well-defined processes for vetting applications and monitoring for abuses, as seen with the iOS App Store and Google Play Store. To protect users, organizations should assess the permissions requested by apps, maintain regular checks for stable and secure versions, and monitor known vulnerabilities. This proactive approach helps mitigate risks associated with third-party applications that may not be distributed through official channels.