What can companies and individuals do to protect themselves?
"Companies should definitely enforce more security policies," said Manky. "Security's becoming a board level discussion, so that's already happening, and it should continue to happen."
Part of any cybersecurity strategy should be the use of antivirus software, the education of employees not to click on unknown attachments or links as well as keeping software up to date, also know as patch management.
"A lot of these devices are not going to be patched that quickly or they might not have an update mechanism on them," said Manky. "Certainly, any time a patch becomes available, companies should enforce that because these are closing a lot of the holes where attackers are navigating through."
Here is how Gartner frames it for business seeking to protect themselves in 2016. "While some traditional controls have or will become less effective, techniques such as removing administrative privileges from endpoint users should not be forgotten. Similarly, vulnerability management, configuration management and other basic practices have to be priorities in organizations that have not yet implemented them effectively."
And ultimately, something is better than nothing, advises the firm: "Addressing priorities does not mean striving for perfection, but rather ensuring, at least, that critical exposures are remediated (or, if applicable, mitigated with compensating controls) and that the residual risks are minimal and acceptable (or at least enumerated and tracked)."