> Maybe at one point, but at this point the general audience
> B) Knows enough to do things right
Reality check: https://blog.emsisoft.com/en/34822/the-state-of-ransomware-i...
Note that not all these incidents resulted from drive-by-downloads or elaborate hacks:
> Riviera Beach: In June, Riviera Beach, Florida, was hit with ransomware when a police department employee opened a malicious email attachment.
In 2019, people still click every e-mail attachment unchecked, even though e-mail attachments have been a primary vector for attacks for decades at this point.
Putting faith in the abilities of the average user is the first step towards disaster. The average user is not more aware or capable in 2020 than they were in 1995. People still carelessly put random USB drives into their machines, still open dodgy e-mail attachments and still download and execute installers and other executables from random websites.
Some sobering stats for mobile [1]:
> Less than 20% of mobile malware is delivered via a browser — the remainder of the payloads come through an app. (Source: RSA Current State of Cybercrime)
Last but unfortunately not least, unpatched systems are still presenting a completely avoidable attack vector for malware and ransomware, because users (both private and industrial/institutional) fail to update their systems [2].
So no, the harsh reality is that the average user is neither aware, nor capable of "doing things right".
[1] https://phoenixnap.com/blog/ransomware-statistics-facts
[2] https://www.mcafee.com/enterprise/en-us/assets/reports/rp-qu...