Top 5 Cybersecurity Mistakes That Caused Havoc in 2024–2025

The Pattern Nobody Wants to Admit

Every major breach has a post-mortem. Every post-mortem has the same conclusion. And yet the same mistakes keep happening — not because organisations lack awareness, but because the gap between knowing and doing remains catastrophically wide.

2024 and 2025 produced some of the most damaging cyber incidents in recorded history. Change Healthcare paralysed US healthcare payments for weeks. Salt Typhoon compromised at least eight US telecommunications carriers. The Snowflake credential campaign exposed data across hundreds of organisations simultaneously. National Public Data leaked the personal records of nearly three billion individuals.

None of these required a zero-day. None required nation-state sophistication beyond what criminal groups now routinely deploy. All of them exploited mistakes that security teams already knew about. This analysis examines the five structural failures behind the havoc — and what closing them actually requires. For the broader framework behind proactive defence, see our piece on Exposure Management in Cybersecurity.

Deep Dive: The Five Mistakes That Keep Winning

Mistake 1 — Missing or Bypassed Multi-Factor Authentication

No single control failure caused more damage in 2024–2025 than the absence of properly implemented MFA. The evidence is unambiguous and damning.

Change Healthcare — the largest healthcare payment processor in the United States — was breached in February 2024 through a Citrix remote access portal that had no MFA enabled. The ALPHV/BlackCat ransomware group walked in using stolen credentials. UnitedHealth Group's CEO confirmed the company paid a $22 million ransom. Total estimated response costs reached $2.87 billion. The attack disrupted prescription processing and medical claims for nearly one-third of Americans.

Microsoft suffered two separate credential-based intrusions. The Midnight Blizzard (Russian state) attack in January 2024 exploited a legacy test tenant account with no MFA. Storm-0558 (Chinese state) forged authentication tokens to breach email accounts at approximately 25 organisations including US government agencies. The US Department of Homeland Security's Cyber Safety Review Board concluded the Microsoft intrusion "should never have happened" and that Microsoft's security culture required a fundamental overhaul.

Why it keeps happening:

● Legacy systems and third-party portals are routinely excluded from MFA rollouts — treated as exceptions that become permanent

● SMS and app-based MFA are now routinely bypassed by adversary-in-the-middle proxy toolkits (Evilginx, Modlishka) that harvest session tokens in real time

● Service accounts, shared accounts, and vendor accounts are systematically missed in MFA deployment programmes

What closing this gap actually requires:

Phishing-resistant MFA (FIDO2/passkeys) is now the meaningful security bar — not SMS OTP, not authenticator apps alone. Every internet-facing portal, including legacy systems and vendor access points, must be in scope. No exceptions architecture is the only architecture that works. For the identity-centric model that makes this operational, see our analysis of Zero Trust Architecture.

---

Mistake 2 — Unpatched Internet-Facing Systems

The 2024 Ivanti mass exploitation event demonstrated exactly what systematic exposure looks like at scale. Ivanti disclosed two zero-day vulnerabilities in January 2024 — a command injection flaw and an authentication bypass — that were already under active mass exploitation by a Chinese nation-state actor. CISA, the US primary cyber agency, was among the organisations breached. Thousands of organisations running unpatched Ivanti VPN appliances were compromised before patches could be deployed.

The pattern is not new. Ivanti followed Fortinet, Pulse Secure, Citrix, and Exchange — each of which produced mass exploitation events in prior years using the same playbook: identify a high-value internet-facing product with a large installed base, develop reliable exploitation, and scan the entire internet for vulnerable instances before defenders can patch.

The exploitation window has collapsed. In 2023, attackers took an average of 45 days to weaponise a newly published vulnerability. By 2025, that window had shrunk to 21 days — and for high-value targets, active exploitation frequently begins before a patch exists.

The compounding problem:

● Patch management remains siloed from vulnerability management in most organisations — creating a gap between knowing a patch exists and confirming it is deployed

● Internet-facing assets are frequently undiscovered in asset inventories — shadow IT, acquired infrastructure, and forgotten systems are not patched because no one knows they exist

● Risk-based prioritisation is still the exception — most patch programmes apply CVSS scores mechanically, missing that a CVE-5.4 on a perimeter system is more urgent than a CVE-9.8 on an isolated internal host

56% of organisations experienced a breach through an unknown or unmanaged internet-facing asset in 2025. You cannot patch what you cannot see.

---

Mistake 3 — Third-Party and Supply Chain Blind Spots

The Snowflake credential campaign of 2024 is the defining supply chain security event of the era. Attackers obtained credentials for data engineers who had administrative access to their employers' Snowflake cloud environments — credentials harvested by infostealer malware, not through any Snowflake vulnerability. The result: AT&T lost approximately 50 billion customer call and text records. Ticketmaster exposed data on 560 million users. The breach went undetected at Ticketmaster for nearly seven weeks.

AT&T suffered a second, separate breach in the same year — 73 million customer records stolen through vulnerabilities in a third-party vendor system, published on the dark web before AT&T confirmed the incident.

The structural problem is that most organisations apply rigorous security controls to their own systems and treat third-party access as a governance exercise rather than an active attack surface. Vendor risk assessments are completed annually on paper. The Salesforce OAuth supply chain attack in 2025 demonstrated the same gap at a different layer — stolen OAuth tokens gave attackers legitimate-looking access to 700-plus organisations using Salesforce instances, with 10 days of undetected data exfiltration before detection.

What the data shows:

Third-party risk is not a vendor management problem. It is a direct attack surface problem — and it needs to be treated with the same continuous monitoring discipline as internal infrastructure.

---

Mistake 4 — Human Error at Industrial Scale

The Verizon Data Breach Investigations Report 2025 confirmed what practitioners already knew but boards resist acknowledging: human error directly caused 60% of all breaches. Not sophisticated attackers. Not zero-days. People making mistakes under pressure in environments that make mistakes easy.

The Ascension Healthcare ransomware attack — one of the largest healthcare breaches of 2024, disrupting 140 hospitals across 19 US states — originated from a single employee who accidentally downloaded a malicious file. National Public Data, which exposed the records of nearly three billion individuals, left a zip file containing plain text usernames and passwords accessible on their own website.

Business Email Compromise, which relies entirely on human error rather than technical exploitation, reached record losses in 2025 — $6.3 billion globally, with a median loss of $50,000 per incident. Phishing attacks surged 4,151% since the public release of ChatGPT in late 2022, as AI-generated lures became indistinguishable from legitimate communications at scale.

Why training alone does not solve this:

Security awareness training is necessary and consistently insufficient as a primary control. The problem is structural: organisations build workflows that require humans to make security-critical decisions under time pressure, with incomplete information, in interfaces that do not surface risk signals clearly. Attackers study these workflows and design their attacks around the moments of highest cognitive load.

The effective countermeasure is removing the human decision point wherever possible — technical controls that make the correct action the default action, not the educated action. Phishing-resistant MFA removes the credential theft opportunity. Email authentication (DMARC, DKIM, SPF) eliminates spoofed sender domains. Privileged access workstations remove the attack surface for malicious downloads.

---

Mistake 5 — Delayed Detection and Inadequate Incident Response

Detection failure is the force multiplier for every other mistake on this list. A missing MFA control is a containable incident if detected in hours. It becomes a $2.87 billion catastrophe when dwell time extends to weeks.

The Ticketmaster breach went undetected for 49 days. The National Defence Corporation fell to InterLock ransomware that remained undetected for 4–6 weeks while exfiltrating 4.2 terabytes of defence contractor data. The Salt Typhoon campaign against US telecommunications carriers persisted for months before attribution — with attackers positioned to intercept communications of senior US government and political figures.

The CrowdStrike incident of July 2024 added a different dimension: a faulty software update from a trusted security vendor caused 8.5 million Windows systems to crash simultaneously — demonstrating that detection and response capabilities must account for supply chain failures in security tooling itself, not just external adversaries.

The detection gap by numbers:

• 21 days — average time attackers now take to exploit a newly published vulnerability
• 49 days — Ticketmaster's undetected dwell time before discovery
• 4–6 weeks — National Defence Corporation dwell time before ransomware deployment
• $4.88 million — average breach cost in 2024, rising directly with dwell time

Incident response plans that exist only as documents — untested, un-exercised, and unconnected to actual detection tooling — provide the illusion of preparedness without the substance. Tabletop exercises, breach simulations, and Breach and Attack Simulation (BAS) platforms that continuously validate whether controls actually stop what they claim to stop are the operational standard. For the continuous validation framework that makes this measurable, see our guide on the CTEM Framework Decision Model 2026.

Conclusion

The five mistakes documented here are not new discoveries. They appear in every major breach report, every post-incident review, and every security framework published in the last decade. The damage they caused in 2024 and 2025 is not evidence that the threat landscape became impossibly sophisticated. It is evidence that the execution gap between knowing and doing remains the primary determinant of breach outcomes.

Closing these gaps does not require revolutionary technology. It requires MFA on every internet-facing system without exception. It requires continuous asset discovery so that unpatched systems cannot hide. It requires treating third-party access as an active attack surface rather than a compliance exercise. It requires building workflows that remove human decision points from security-critical paths. And it requires detection and response capabilities that are tested continuously — not documented and forgotten.

The organisations that suffered the most in 2024–2025 were not outgunned. They were out-disciplined.

Frequently Asked Questions

---

Comparative Reference: The Five Mistakes and Their Real-World Consequences

Sources: Verizon DBIR 2025, IBM Cost of a Data Breach Report 2024, US DHS CSRB, CyberNeurix Threat Monitoring