Cybercrime goes corporate: A trillion-dollar industry undermining global security

Cybercrime-as-a-Service (CaaS) makes hacking accessible, driving a booming illicit economy. Learn how AI fuels attacks and what businesses must do to defend.

- Punam Singh

The rapid expansion of “Cybercrime-as-a-service”, or we say, the industrialisation of deception.

The adversaries are no longer isolated hackers but increasingly sophisticated, business-minded entities, democratising malicious capabilities and allowing even low-skilled individuals to launch devastating attacks.

The CaaS market is a booming economy in the shadows, driving annual revenues into billions. While precise figures are elusive due to its illicit nature, reports suggest it's a substantial and growing market. CaaS contributes significantly, and the broader cybersecurity services market (which includes both legitimate and illicit services) is projected to reach hundreds of billions of dollars in the coming years. If measured as a country, cybercrime would already be the world's third-largest economy, with projected annual damages reaching US$ 10.5 trillion by 2025, as per some cybersecurity ventures. This growth is fueled by the same principles that drive legitimate businesses: specialisation, efficiency, and accessibility.

CaaS platforms function much like dark online marketplaces. They offer pre-made hacking kits, phishing templates, and even access to already compromised computer networks. These services significantly lower the entry barrier for aspiring criminals. For instance, “ransomware-as-a-service” (RaaS) kits enable users to deploy ransomware attacks with minimal technical knowledge, sometimes for as little as US$ 40 per month (as per IBM, Hornetsecurity reports). Phishing kits, providing ready-to-use cloned login portals and email templates, can be acquired for US$ 50 to 80 per month, with more advanced platforms costing up to US$ 250 (as per ID Agent, Kaspersky reports). This commoditisation allows individuals who might lack deep technical expertise to engage in lucrative cybercriminal endeavours.