The exponential growth in data-breach risks is already outstripping the ability of any one company to completely contain them. Yet Verizon’s 2014 Data Breach Investigations Report suggests one powerful way for companies to marshal their risk management resources to get the best bang for their buck: triage.

By using a Big Data approach, the telecommunications company claims to have found nine basic patterns that make up 92 percent of all cyber security incidents and contends that it’s able to correlate the frequency with which each pattern occurs in particular industries. Only three threat patterns cover 72 percent of the security incidents in any industry, the report contends.

Hence, CFOs who run their company’s enterprise risk management (ERM) programs can focus first on nine areas where data breaches can occur:

• Miscellaneous errors, like an employee sending an email to the wrong person.
• Crimeware, including various forms of malware aimed at gaining control of systems.
• Misuse by insiders or privileged users.
• Physical theft or loss.
• Attacks on web applications.
• Denial-of-service attacks.
• Cyber-espionage.
• Point-of-sale intrusions.
• The planting of skimming devices able to read payment-card data.

Then, finance chiefs and corporate risk managers can get their companies to focus on the top cyber risks specific to their industries.  For instance, in financial services, 75 percent of the incidents come from web application attacks, distributed denial-of-service (DDoS) breaches and card skimming, according to the report.

At the same time, 54 percent of incidents involving manufacturers come from cyber-espionage and DDoS. Verizon also found that most breaches of retailers can be linked to DDoS attacks (33 percent) and point-of-sale intrusions (31 percent).

Among the nine patterns, the report finds cyber-espionage recorded three-fold increase compared with 2013, with 511 incidents. (The increase, however, partly stemmed from there being a bigger dataset.) Further, Verizon claimed that  such attacks were the most complex and diverse of the threat patterns.

The report also finds that DDoS attacks, intended to shut down the availability of networks and systems, have grown  year-over-year for the past three years.

The use of stolen or misused credentials ( such as user names or passwords) continues to be the top way to gain access to information, according to the report, which found that two out of three breaches exploit weak or stolen passwords.

For the report, Verizon analyzed more than 1,300 confirmed data breaches as well as more than 63,000 reported security incidents.