case study report online

How to Write a Case Study: Bookmarkable Guide & Template

Published: November 30, 2023

Earning the trust of prospective customers can be a struggle. Before you can even begin to expect to earn their business, you need to demonstrate your ability to deliver on what your product or service promises.

Sure, you could say that you're great at X or that you're way ahead of the competition when it comes to Y. But at the end of the day, what you really need to win new business is cold, hard proof.

One of the best ways to prove your worth is through a compelling case study. In fact, HubSpot’s 2020 State of Marketing report found that case studies are so compelling that they are the fifth most commonly used type of content used by marketers.

Below, I'll walk you through what a case study is, how to prepare for writing one, what you need to include in it, and how it can be an effective tactic. To jump to different areas of this post, click on the links below to automatically scroll.

Case Study Definition

Case study templates, how to write a case study.

• How to Format a Case Study

Business Case Study Examples

A case study is a specific challenge a business has faced, and the solution they've chosen to solve it. Case studies can vary greatly in length and focus on several details related to the initial challenge and applied solution, and can be presented in various forms like a video, white paper, blog post, etc.

In professional settings, it's common for a case study to tell the story of a successful business partnership between a vendor and a client. Perhaps the success you're highlighting is in the number of leads your client generated, customers closed, or revenue gained. Any one of these key performance indicators (KPIs) are examples of your company's services in action.

When done correctly, these examples of your work can chronicle the positive impact your business has on existing or previous customers and help you attract new clients.

Free Case Study Templates

Showcase your company's success using these three free case study templates.

• Data-Driven Case Study Template
• Product-Specific Case Study Template
• General Case Study Template

You're all set!

Click this link to access this resource at any time.

Why write a case study? 

I know, you’re thinking “ Okay, but why do I need to write one of these? ” The truth is that while case studies are a huge undertaking, they are powerful marketing tools that allow you to demonstrate the value of your product to potential customers using real-world examples. Here are a few reasons why you should write case studies. 

1. Explain Complex Topics or Concepts

Case studies give you the space to break down complex concepts, ideas, and strategies and show how they can be applied in a practical way. You can use real-world examples, like an existing client, and use their story to create a compelling narrative that shows how your product solved their issue and how those strategies can be repeated to help other customers get similar successful results.  

2. Show Expertise

Case studies are a great way to demonstrate your knowledge and expertise on a given topic or industry. This is where you get the opportunity to show off your problem-solving skills and how you’ve generated successful outcomes for clients you’ve worked with. 

3. Build Trust and Credibility

In addition to showing off the attributes above, case studies are an excellent way to build credibility. They’re often filled with data and thoroughly researched, which shows readers you’ve done your homework. They can have confidence in the solutions you’ve presented because they’ve read through as you’ve explained the problem and outlined step-by-step what it took to solve it. All of these elements working together enable you to build trust with potential customers.

4. Create Social Proof

Using existing clients that have seen success working with your brand builds social proof . People are more likely to choose your brand if they know that others have found success working with you. Case studies do just that — putting your success on display for potential customers to see. 

All of these attributes work together to help you gain more clients. Plus you can even use quotes from customers featured in these studies and repurpose them in other marketing content. Now that you know more about the benefits of producing a case study, let’s check out how long these documents should be. 

How long should a case study be?

The length of a case study will vary depending on the complexity of the project or topic discussed. However, as a general guideline, case studies typically range from 500 to 1,500 words. 

Whatever length you choose, it should provide a clear understanding of the challenge, the solution you implemented, and the results achieved. This may be easier said than done, but it's important to strike a balance between providing enough detail to make the case study informative and concise enough to keep the reader's interest.

The primary goal here is to effectively communicate the key points and takeaways of the case study. It’s worth noting that this shouldn’t be a wall of text. Use headings, subheadings, bullet points, charts, and other graphics to break up the content and make it more scannable for readers. We’ve also seen brands incorporate video elements into case studies listed on their site for a more engaging experience. 

Ultimately, the length of your case study should be determined by the amount of information necessary to convey the story and its impact without becoming too long. Next, let’s look at some templates to take the guesswork out of creating one. 

To help you arm your prospects with information they can trust, we've put together a step-by-step guide on how to create effective case studies for your business with free case study templates for creating your own.

Tell us a little about yourself below to gain access today:

And to give you more options, we’ll highlight some useful templates that serve different needs. But remember, there are endless possibilities when it comes to demonstrating the work your business has done.

1. General Case Study Template

Do you have a specific product or service that you’re trying to sell, but not enough reviews or success stories? This Product Specific case study template will help.

This template relies less on metrics, and more on highlighting the customer’s experience and satisfaction. As you follow the template instructions, you’ll be prompted to speak more about the benefits of the specific product, rather than your team’s process for working with the customer.

4. Bold Social Media Business Case Study Template

You can find templates that represent different niches, industries, or strategies that your business has found success in — like a bold social media business case study template.

In this template, you can tell the story of how your social media marketing strategy has helped you or your client through collaboration or sale of your service. Customize it to reflect the different marketing channels used in your business and show off how well your business has been able to boost traffic, engagement, follows, and more.

5. Lead Generation Business Case Study Template

It’s important to note that not every case study has to be the product of a sale or customer story, sometimes they can be informative lessons that your own business has experienced. A great example of this is the Lead Generation Business case study template.

If you’re looking to share operational successes regarding how your team has improved processes or content, you should include the stories of different team members involved, how the solution was found, and how it has made a difference in the work your business does.

Now that we’ve discussed different templates and ideas for how to use them, let’s break down how to create your own case study with one.

• Get started with case study templates.
• Determine the case study's objective.
• Establish a case study medium.
• Find the right case study candidate.
• Contact your candidate for permission to write about them.
• Ensure you have all the resources you need to proceed once you get a response.
• Download a case study email template.
• Define the process you want to follow with the client.
• Ensure you're asking the right questions.
• Layout your case study format.
• Publish and promote your case study.

1. Get started with case study templates.

Telling your customer's story is a delicate process — you need to highlight their success while naturally incorporating your business into their story.

If you're just getting started with case studies, we recommend you download HubSpot's Case Study Templates we mentioned before to kickstart the process.

2. Determine the case study's objective.

All business case studies are designed to demonstrate the value of your services, but they can focus on several different client objectives.

Your first step when writing a case study is to determine the objective or goal of the subject you're featuring. In other words, what will the client have succeeded in doing by the end of the piece?

The client objective you focus on will depend on what you want to prove to your future customers as a result of publishing this case study.

Your case study can focus on one of the following client objectives:

• Complying with government regulation
• Lowering business costs
• Becoming profitable
• Generating more leads
• Closing on more customers
• Generating more revenue
• Expanding into a new market
• Becoming more sustainable or energy-efficient

3. Establish a case study medium.

Next, you'll determine the medium in which you'll create the case study. In other words, how will you tell this story?

Case studies don't have to be simple, written one-pagers. Using different media in your case study can allow you to promote your final piece on different channels. For example, while a written case study might just live on your website and get featured in a Facebook post, you can post an infographic case study on Pinterest and a video case study on your YouTube channel.

Here are some different case study mediums to consider:

Written Case Study

Consider writing this case study in the form of an ebook and converting it to a downloadable PDF. Then, gate the PDF behind a landing page and form for readers to fill out before downloading the piece, allowing this case study to generate leads for your business.

Video Case Study

Plan on meeting with the client and shooting an interview. Seeing the subject, in person, talk about the service you provided them can go a long way in the eyes of your potential customers.

Infographic Case Study

Use the long, vertical format of an infographic to tell your success story from top to bottom. As you progress down the infographic, emphasize major KPIs using bigger text and charts that show the successes your client has had since working with you.

Podcast Case Study

Podcasts are a platform for you to have a candid conversation with your client. This type of case study can sound more real and human to your audience — they'll know the partnership between you and your client was a genuine success.

4. Find the right case study candidate.

Writing about your previous projects requires more than picking a client and telling a story. You need permission, quotes, and a plan. To start, here are a few things to look for in potential candidates.

Product Knowledge

It helps to select a customer who's well-versed in the logistics of your product or service. That way, he or she can better speak to the value of what you offer in a way that makes sense for future customers.

Remarkable Results

Clients that have seen the best results are going to make the strongest case studies. If their own businesses have seen an exemplary ROI from your product or service, they're more likely to convey the enthusiasm that you want prospects to feel, too.

One part of this step is to choose clients who have experienced unexpected success from your product or service. When you've provided non-traditional customers — in industries that you don't usually work with, for example — with positive results, it can help to remove doubts from prospects.

Recognizable Names

While small companies can have powerful stories, bigger or more notable brands tend to lend credibility to your own. In fact, 89% of consumers say they'll buy from a brand they already recognize over a competitor, especially if they already follow them on social media.

Customers that came to you after working with a competitor help highlight your competitive advantage and might even sway decisions in your favor.

5. Contact your candidate for permission to write about them.

To get the case study candidate involved, you have to set the stage for clear and open communication. That means outlining expectations and a timeline right away — not having those is one of the biggest culprits in delayed case study creation.

Most importantly at this point, however, is getting your subject's approval. When first reaching out to your case study candidate, provide them with the case study's objective and format — both of which you will have come up with in the first two steps above.

To get this initial permission from your subject, put yourself in their shoes — what would they want out of this case study? Although you're writing this for your own company's benefit, your subject is far more interested in the benefit it has for them.

Benefits to Offer Your Case Study Candidate

Here are four potential benefits you can promise your case study candidate to gain their approval.

Brand Exposure

Explain to your subject to whom this case study will be exposed, and how this exposure can help increase their brand awareness both in and beyond their own industry. In the B2B sector, brand awareness can be hard to collect outside one's own market, making case studies particularly useful to a client looking to expand their name's reach.

Employee Exposure

Allow your subject to provide quotes with credits back to specific employees. When this is an option for them, their brand isn't the only thing expanding its reach — their employees can get their name out there, too. This presents your subject with networking and career development opportunities they might not have otherwise.

Product Discount

This is a more tangible incentive you can offer your case study candidate, especially if they're a current customer of yours. If they agree to be your subject, offer them a product discount — or a free trial of another product — as a thank-you for their help creating your case study.

Backlinks and Website Traffic

Here's a benefit that is sure to resonate with your subject's marketing team: If you publish your case study on your website, and your study links back to your subject's website — known as a "backlink" — this small gesture can give them website traffic from visitors who click through to your subject's website.

Additionally, a backlink from you increases your subject's page authority in the eyes of Google. This helps them rank more highly in search engine results and collect traffic from readers who are already looking for information about their industry.

6. Ensure you have all the resources you need to proceed once you get a response.

So you know what you’re going to offer your candidate, it’s time that you prepare the resources needed for if and when they agree to participate, like a case study release form and success story letter.

Let's break those two down.

Case Study Release Form

This document can vary, depending on factors like the size of your business, the nature of your work, and what you intend to do with the case studies once they are completed. That said, you should typically aim to include the following in the Case Study Release Form:

• A clear explanation of why you are creating this case study and how it will be used.
• A statement defining the information and potentially trademarked information you expect to include about the company — things like names, logos, job titles, and pictures.
• An explanation of what you expect from the participant, beyond the completion of the case study. For example, is this customer willing to act as a reference or share feedback, and do you have permission to pass contact information along for these purposes?
• A note about compensation.

Success Story Letter

As noted in the sample email, this document serves as an outline for the entire case study process. Other than a brief explanation of how the customer will benefit from case study participation, you'll want to be sure to define the following steps in the Success Story Letter.

7. Download a case study email template.

While you gathered your resources, your candidate has gotten time to read over the proposal. When your candidate approves of your case study, it's time to send them a release form.

A case study release form tells you what you'll need from your chosen subject, like permission to use any brand names and share the project information publicly. Kick-off this process with an email that runs through exactly what they can expect from you, as well as what you need from them. To give you an idea of what that might look like, check out this sample email:

8. Define the process you want to follow with the client.

Before you can begin the case study, you have to have a clear outline of the case study process with your client. An example of an effective outline would include the following information.

The Acceptance

First, you'll need to receive internal approval from the company's marketing team. Once approved, the Release Form should be signed and returned to you. It's also a good time to determine a timeline that meets the needs and capabilities of both teams.

The Questionnaire

To ensure that you have a productive interview — which is one of the best ways to collect information for the case study — you'll want to ask the participant to complete a questionnaire before this conversation. That will provide your team with the necessary foundation to organize the interview, and get the most out of it.

The Interview

Once the questionnaire is completed, someone on your team should reach out to the participant to schedule a 30- to 60-minute interview, which should include a series of custom questions related to the customer's experience with your product or service.

The Draft Review

After the case study is composed, you'll want to send a draft to the customer, allowing an opportunity to give you feedback and edits.

The Final Approval

Once any necessary edits are completed, send a revised copy of the case study to the customer for final approval.

Once the case study goes live — on your website or elsewhere — it's best to contact the customer with a link to the page where the case study lives. Don't be afraid to ask your participants to share these links with their own networks, as it not only demonstrates your ability to deliver positive results and impressive growth, as well.

9. Ensure you're asking the right questions.

Before you execute the questionnaire and actual interview, make sure you're setting yourself up for success. A strong case study results from being prepared to ask the right questions. What do those look like? Here are a few examples to get you started:

• What are your goals?
• What challenges were you experiencing before purchasing our product or service?
• What made our product or service stand out against our competitors?
• What did your decision-making process look like?
• How have you benefited from using our product or service? (Where applicable, always ask for data.)

Keep in mind that the questionnaire is designed to help you gain insights into what sort of strong, success-focused questions to ask during the actual interview. And once you get to that stage, we recommend that you follow the "Golden Rule of Interviewing." Sounds fancy, right? It's actually quite simple — ask open-ended questions.

If you're looking to craft a compelling story, "yes" or "no" answers won't provide the details you need. Focus on questions that invite elaboration, such as, "Can you describe ...?" or, "Tell me about ..."

In terms of the interview structure, we recommend categorizing the questions and flowing them into six specific sections that will mirror a successful case study format. Combined, they'll allow you to gather enough information to put together a rich, comprehensive study.

Open with the customer's business.

The goal of this section is to generate a better understanding of the company's current challenges and goals, and how they fit into the landscape of their industry. Sample questions might include:

• How long have you been in business?
• How many employees do you have?
• What are some of the objectives of your department at this time?

Cite a problem or pain point.

To tell a compelling story, you need context. That helps match the customer's need with your solution. Sample questions might include:

• What challenges and objectives led you to look for a solution?
• What might have happened if you did not identify a solution?
• Did you explore other solutions before this that did not work out? If so, what happened?

Discuss the decision process.

Exploring how the customer decided to work with you helps to guide potential customers through their own decision-making processes. Sample questions might include:

• How did you hear about our product or service?
• Who was involved in the selection process?
• What was most important to you when evaluating your options?

Explain how a solution was implemented.

The focus here should be placed on the customer's experience during the onboarding process. Sample questions might include:

• How long did it take to get up and running?
• Did that meet your expectations?
• Who was involved in the process?

Explain how the solution works.

The goal of this section is to better understand how the customer is using your product or service. Sample questions might include:

• Is there a particular aspect of the product or service that you rely on most?
• Who is using the product or service?

End with the results.

In this section, you want to uncover impressive measurable outcomes — the more numbers, the better. Sample questions might include:

• How is the product or service helping you save time and increase productivity?
• In what ways does that enhance your competitive advantage?
• How much have you increased metrics X, Y, and Z?

10. Lay out your case study format.

When it comes time to take all of the information you've collected and actually turn it into something, it's easy to feel overwhelmed. Where should you start? What should you include? What's the best way to structure it?

To help you get a handle on this step, it's important to first understand that there is no one-size-fits-all when it comes to the ways you can present a case study. They can be very visual, which you'll see in some of the examples we've included below, and can sometimes be communicated mostly through video or photos, with a bit of accompanying text.

Here are the sections we suggest, which we'll cover in more detail down below:

• Title: Keep it short. Develop a succinct but interesting project name you can give the work you did with your subject.
• Subtitle: Use this copy to briefly elaborate on the accomplishment. What was done? The case study itself will explain how you got there.
• Executive Summary : A 2-4 sentence summary of the entire story. You'll want to follow it with 2-3 bullet points that display metrics showcasing success.
• About the Subject: An introduction to the person or company you served, which can be pulled from a LinkedIn Business profile or client website.
• Challenges and Objectives: A 2-3 paragraph description of the customer's challenges, before using your product or service. This section should also include the goals or objectives the customer set out to achieve.
• How Product/Service Helped: A 2-3 paragraph section that describes how your product or service provided a solution to their problem.
• Results: A 2-3 paragraph testimonial that proves how your product or service specifically benefited the person or company and helped achieve its goals. Include numbers to quantify your contributions.
• Supporting Visuals or Quotes: Pick one or two powerful quotes that you would feature at the bottom of the sections above, as well as a visual that supports the story you are telling.
• Future Plans: Everyone likes an epilogue. Comment on what's ahead for your case study subject, whether or not those plans involve you.
• Call to Action (CTA): Not every case study needs a CTA, but putting a passive one at the end of your case study can encourage your readers to take an action on your website after learning about the work you've done.

When laying out your case study, focus on conveying the information you've gathered in the most clear and concise way possible. Make it easy to scan and comprehend, and be sure to provide an attractive call-to-action at the bottom — that should provide readers an opportunity to learn more about your product or service.

11. Publish and promote your case study.

Once you've completed your case study, it's time to publish and promote it. Some case study formats have pretty obvious promotional outlets — a video case study can go on YouTube, just as an infographic case study can go on Pinterest.

But there are still other ways to publish and promote your case study. Here are a couple of ideas:

Lead Gen in a Blog Post

As stated earlier in this article, written case studies make terrific lead-generators if you convert them into a downloadable format, like a PDF. To generate leads from your case study, consider writing a blog post that tells an abbreviated story of your client's success and asking readers to fill out a form with their name and email address if they'd like to read the rest in your PDF.

Then, promote this blog post on social media, through a Facebook post or a tweet.

Published as a Page on Your Website

As a growing business, you might need to display your case study out in the open to gain the trust of your target audience.

Rather than gating it behind a landing page, publish your case study to its own page on your website, and direct people here from your homepage with a "Case Studies" or "Testimonials" button along your homepage's top navigation bar.

Format for a Case Study

The traditional case study format includes the following parts: a title and subtitle, a client profile, a summary of the customer’s challenges and objectives, an account of how your solution helped, and a description of the results. You might also want to include supporting visuals and quotes, future plans, and calls-to-action.

Image Source

The title is one of the most important parts of your case study. It should draw readers in while succinctly describing the potential benefits of working with your company. To that end, your title should:

• State the name of your custome r. Right away, the reader must learn which company used your products and services. This is especially important if your customer has a recognizable brand. If you work with individuals and not companies, you may omit the name and go with professional titles: “A Marketer…”, “A CFO…”, and so forth.
• State which product your customer used . Even if you only offer one product or service, or if your company name is the same as your product name, you should still include the name of your solution. That way, readers who are not familiar with your business can become aware of what you sell.
• Allude to the results achieved . You don’t necessarily need to provide hard numbers, but the title needs to represent the benefits, quickly. That way, if a reader doesn’t stay to read, they can walk away with the most essential information: Your product works.

The example above, “Crunch Fitness Increases Leads and Signups With HubSpot,” achieves all three — without being wordy. Keeping your title short and sweet is also essential.

2. Subtitle

Your subtitle is another essential part of your case study — don’t skip it, even if you think you’ve done the work with the title. In this section, include a brief summary of the challenges your customer was facing before they began to use your products and services. Then, drive the point home by reiterating the benefits your customer experienced by working with you.

The above example reads:

“Crunch Fitness was franchising rapidly when COVID-19 forced fitness clubs around the world to close their doors. But the company stayed agile by using HubSpot to increase leads and free trial signups.”

We like that the case study team expressed the urgency of the problem — opening more locations in the midst of a pandemic — and placed the focus on the customer’s ability to stay agile.

3. Executive Summary

The executive summary should provide a snapshot of your customer, their challenges, and the benefits they enjoyed from working with you. Think it’s too much? Think again — the purpose of the case study is to emphasize, again and again, how well your product works.

The good news is that depending on your design, the executive summary can be mixed with the subtitle or with the “About the Company” section. Many times, this section doesn’t need an explicit “Executive Summary” subheading. You do need, however, to provide a convenient snapshot for readers to scan.

In the above example, ADP included information about its customer in a scannable bullet-point format, then provided two sections: “Business Challenge” and “How ADP Helped.” We love how simple and easy the format is to follow for those who are unfamiliar with ADP or its typical customer.

4. About the Company

Readers need to know and understand who your customer is. This is important for several reasons: It helps your reader potentially relate to your customer, it defines your ideal client profile (which is essential to deter poor-fit prospects who might have reached out without knowing they were a poor fit), and it gives your customer an indirect boon by subtly promoting their products and services.

Feel free to keep this section as simple as possible. You can simply copy and paste information from the company’s LinkedIn, use a quote directly from your customer, or take a more creative storytelling approach.

In the above example, HubSpot included one paragraph of description for Crunch Fitness and a few bullet points. Below, ADP tells the story of its customer using an engaging, personable technique that effectively draws readers in.

5. Challenges and Objectives

The challenges and objectives section of your case study is the place to lay out, in detail, the difficulties your customer faced prior to working with you — and what they hoped to achieve when they enlisted your help.

In this section, you can be as brief or as descriptive as you’d like, but remember: Stress the urgency of the situation. Don’t understate how much your customer needed your solution (but don’t exaggerate and lie, either). Provide contextual information as necessary. For instance, the pandemic and societal factors may have contributed to the urgency of the need.

Take the above example from design consultancy IDEO:

“Educational opportunities for adults have become difficult to access in the United States, just when they’re needed most. To counter this trend, IDEO helped the city of South Bend and the Drucker Institute launch Bendable, a community-powered platform that connects people with opportunities to learn with and from each other.”

We love how IDEO mentions the difficulties the United States faces at large, the efforts its customer is taking to address these issues, and the steps IDEO took to help.

6. How Product/Service Helped

This is where you get your product or service to shine. Cover the specific benefits that your customer enjoyed and the features they gleaned the most use out of. You can also go into detail about how you worked with and for your customer. Maybe you met several times before choosing the right solution, or you consulted with external agencies to create the best package for them.

Whatever the case may be, try to illustrate how easy and pain-free it is to work with the representatives at your company. After all, potential customers aren’t looking to just purchase a product. They’re looking for a dependable provider that will strive to exceed their expectations.

In the above example, IDEO describes how it partnered with research institutes and spoke with learners to create Bendable, a free educational platform. We love how it shows its proactivity and thoroughness. It makes potential customers feel that IDEO might do something similar for them.

The results are essential, and the best part is that you don’t need to write the entirety of the case study before sharing them. Like HubSpot, IDEO, and ADP, you can include the results right below the subtitle or executive summary. Use data and numbers to substantiate the success of your efforts, but if you don’t have numbers, you can provide quotes from your customers.

We can’t overstate the importance of the results. In fact, if you wanted to create a short case study, you could include your title, challenge, solution (how your product helped), and result.

8. Supporting Visuals or Quotes

Let your customer speak for themselves by including quotes from the representatives who directly interfaced with your company.

Visuals can also help, even if they’re stock images. On one side, they can help you convey your customer’s industry, and on the other, they can indirectly convey your successes. For instance, a picture of a happy professional — even if they’re not your customer — will communicate that your product can lead to a happy client.

In this example from IDEO, we see a man standing in a boat. IDEO’s customer is neither the man pictured nor the manufacturer of the boat, but rather Conservation International, an environmental organization. This imagery provides a visually pleasing pattern interrupt to the page, while still conveying what the case study is about.

9. Future Plans

This is optional, but including future plans can help you close on a more positive, personable note than if you were to simply include a quote or the results. In this space, you can show that your product will remain in your customer’s tech stack for years to come, or that your services will continue to be instrumental to your customer’s success.

Alternatively, if you work only on time-bound projects, you can allude to the positive impact your customer will continue to see, even after years of the end of the contract.

10. Call to Action (CTA)

Not every case study needs a CTA, but we’d still encourage it. Putting one at the end of your case study will encourage your readers to take an action on your website after learning about the work you've done.

It will also make it easier for them to reach out, if they’re ready to start immediately. You don’t want to lose business just because they have to scroll all the way back up to reach out to your team.

To help you visualize this case study outline, check out the case study template below, which can also be downloaded here .

You drove the results, made the connection, set the expectations, used the questionnaire to conduct a successful interview, and boiled down your findings into a compelling story. And after all of that, you're left with a little piece of sales enabling gold — a case study.

To show you what a well-executed final product looks like, have a look at some of these marketing case study examples.

1. "Shopify Uses HubSpot CRM to Transform High Volume Sales Organization," by HubSpot

What's interesting about this case study is the way it leads with the customer. This reflects a major HubSpot value, which is to always solve for the customer first. The copy leads with a brief description of why Shopify uses HubSpot and is accompanied by a short video and some basic statistics on the company.

Notice that this case study uses mixed media. Yes, there is a short video, but it's elaborated upon in the additional text on the page. So, while case studies can use one or the other, don't be afraid to combine written copy with visuals to emphasize the project's success.

2. "New England Journal of Medicine," by Corey McPherson Nash

When branding and design studio Corey McPherson Nash showcases its work, it makes sense for it to be visual — after all, that's what they do. So in building the case study for the studio's work on the New England Journal of Medicine's integrated advertising campaign — a project that included the goal of promoting the client's digital presence — Corey McPherson Nash showed its audience what it did, rather than purely telling it.

Notice that the case study does include some light written copy — which includes the major points we've suggested — but lets the visuals do the talking, allowing users to really absorb the studio's services.

3. "Designing the Future of Urban Farming," by IDEO

Here's a design company that knows how to lead with simplicity in its case studies. As soon as the visitor arrives at the page, he or she is greeted with a big, bold photo, and two very simple columns of text — "The Challenge" and "The Outcome."

Immediately, IDEO has communicated two of the case study's major pillars. And while that's great — the company created a solution for vertical farming startup INFARM's challenge — it doesn't stop there. As the user scrolls down, those pillars are elaborated upon with comprehensive (but not overwhelming) copy that outlines what that process looked like, replete with quotes and additional visuals.

4. "Secure Wi-Fi Wins Big for Tournament," by WatchGuard

Then, there are the cases when visuals can tell almost the entire story — when executed correctly. Network security provider WatchGuard can do that through this video, which tells the story of how its services enhanced the attendee and vendor experience at the Windmill Ultimate Frisbee tournament.

5. Rock and Roll Hall of Fame Boosts Social Media Engagement and Brand Awareness with HubSpot

In the case study above , HubSpot uses photos, videos, screenshots, and helpful stats to tell the story of how the Rock and Roll Hall of Fame used the bot, CRM, and social media tools to gain brand awareness.

6. Small Desk Plant Business Ups Sales by 30% With Trello

This case study from Trello is straightforward and easy to understand. It begins by explaining the background of the company that decided to use it, what its goals were, and how it planned to use Trello to help them.

It then goes on to discuss how the software was implemented and what tasks and teams benefited from it. Towards the end, it explains the sales results that came from implementing the software and includes quotes from decision-makers at the company that implemented it.

7. Facebook's Mercedes Benz Success Story

Facebook's Success Stories page hosts a number of well-designed and easy-to-understand case studies that visually and editorially get to the bottom line quickly.

Each study begins with key stats that draw the reader in. Then it's organized by highlighting a problem or goal in the introduction, the process the company took to reach its goals, and the results. Then, in the end, Facebook notes the tools used in the case study.

Showcasing Your Work

You work hard at what you do. Now, it's time to show it to the world — and, perhaps more important, to potential customers. Before you show off the projects that make you the proudest, we hope you follow these important steps that will help you effectively communicate that work and leave all parties feeling good about it.

Editor's Note: This blog post was originally published in February 2017 but was updated for comprehensiveness and freshness in July 2021.

Don't forget to share this post!

Related articles.

How to Market an Ebook: 21 Ways to Promote Your Content Offers

7 Pieces of Content Your Audience Really Wants to See [New Data]

How to Write a Listicle [+ Examples and Ideas]

28 Case Study Examples Every Marketer Should See

What Is a White Paper? [FAQs]

What is an Advertorial? 8 Examples to Help You Write One

How to Create Marketing Offers That Don't Fall Flat

20 Creative Ways To Repurpose Content

16 Important Ways to Use Case Studies in Your Marketing

11 Ways to Make Your Blog Post Interactive

Showcase your company's success using these free case study templates.

Marketing software that helps you drive revenue, save time and resources, and measure and optimize your investments — all on one easy-to-use platform

Have a language expert improve your writing

Run a free plagiarism check in 10 minutes, generate accurate citations for free.

• Knowledge Base

Methodology

• What Is a Case Study? | Definition, Examples & Methods

What Is a Case Study? | Definition, Examples & Methods

Published on May 8, 2019 by Shona McCombes . Revised on November 20, 2023.

A case study is a detailed study of a specific subject, such as a person, group, place, event, organization, or phenomenon. Case studies are commonly used in social, educational, clinical, and business research.

A case study research design usually involves qualitative methods , but quantitative methods are sometimes also used. Case studies are good for describing , comparing, evaluating and understanding different aspects of a research problem .

Table of contents

When to do a case study, step 1: select a case, step 2: build a theoretical framework, step 3: collect your data, step 4: describe and analyze the case, other interesting articles.

A case study is an appropriate research design when you want to gain concrete, contextual, in-depth knowledge about a specific real-world subject. It allows you to explore the key characteristics, meanings, and implications of the case.

Case studies are often a good choice in a thesis or dissertation . They keep your project focused and manageable when you don’t have the time or resources to do large-scale research.

You might use just one complex case study where you explore a single subject in depth, or conduct multiple case studies to compare and illuminate different aspects of your research problem.

Here's why students love Scribbr's proofreading services

Discover proofreading & editing

Once you have developed your problem statement and research questions , you should be ready to choose the specific case that you want to focus on. A good case study should have the potential to:

• Provide new or unexpected insights into the subject
• Challenge or complicate existing assumptions and theories
• Propose practical courses of action to resolve a problem
• Open up new directions for future research

TipIf your research is more practical in nature and aims to simultaneously investigate an issue as you solve it, consider conducting action research instead.

Unlike quantitative or experimental research , a strong case study does not require a random or representative sample. In fact, case studies often deliberately focus on unusual, neglected, or outlying cases which may shed new light on the research problem.

Example of an outlying case studyIn the 1960s the town of Roseto, Pennsylvania was discovered to have extremely low rates of heart disease compared to the US average. It became an important case study for understanding previously neglected causes of heart disease.

However, you can also choose a more common or representative case to exemplify a particular category, experience or phenomenon.

Example of a representative case studyIn the 1920s, two sociologists used Muncie, Indiana as a case study of a typical American city that supposedly exemplified the changing culture of the US at the time.

While case studies focus more on concrete details than general theories, they should usually have some connection with theory in the field. This way the case study is not just an isolated description, but is integrated into existing knowledge about the topic. It might aim to:

• Exemplify a theory by showing how it explains the case under investigation
• Expand on a theory by uncovering new concepts and ideas that need to be incorporated
• Challenge a theory by exploring an outlier case that doesn’t fit with established assumptions

To ensure that your analysis of the case has a solid academic grounding, you should conduct a literature review of sources related to the topic and develop a theoretical framework . This means identifying key concepts and theories to guide your analysis and interpretation.

There are many different research methods you can use to collect data on your subject. Case studies tend to focus on qualitative data using methods such as interviews , observations , and analysis of primary and secondary sources (e.g., newspaper articles, photographs, official records). Sometimes a case study will also collect quantitative data.

Example of a mixed methods case studyFor a case study of a wind farm development in a rural area, you could collect quantitative data on employment rates and business revenue, collect qualitative data on local people’s perceptions and experiences, and analyze local and national media coverage of the development.

The aim is to gain as thorough an understanding as possible of the case and its context.

Prevent plagiarism. Run a free check.

In writing up the case study, you need to bring together all the relevant aspects to give as complete a picture as possible of the subject.

How you report your findings depends on the type of research you are doing. Some case studies are structured like a standard scientific paper or thesis , with separate sections or chapters for the methods , results and discussion .

Others are written in a more narrative style, aiming to explore the case from various angles and analyze its meanings and implications (for example, by using textual analysis or discourse analysis ).

In all cases, though, make sure to give contextual details about the case, connect it back to the literature and theory, and discuss how it fits into wider patterns or debates.

If you want to know more about statistics , methodology , or research bias , make sure to check out some of our other articles with explanations and examples.

• Normal distribution
• Degrees of freedom
• Null hypothesis
• Discourse analysis
• Control groups
• Mixed methods research
• Non-probability sampling
• Quantitative research
• Ecological validity

Research bias

• Rosenthal effect
• Implicit bias
• Cognitive bias
• Selection bias
• Negativity bias
• Status quo bias

Cite this Scribbr article

If you want to cite this source, you can copy and paste the citation or click the “Cite this Scribbr article” button to automatically add the citation to our free Citation Generator.

McCombes, S. (2023, November 20). What Is a Case Study? | Definition, Examples & Methods. Scribbr. Retrieved April 6, 2024, from https://www.scribbr.com/methodology/case-study/

Is this article helpful?

Shona McCombes

Other students also liked, primary vs. secondary sources | difference & examples, what is a theoretical framework | guide to organizing, what is action research | definition & examples, unlimited academic ai-proofreading.

✔ Document error-free in 5minutes ✔ Unlimited document corrections ✔ Specialized in correcting academic texts

How to write a case study — examples, templates, and tools

It’s a marketer’s job to communicate the effectiveness of a product or service to potential and current customers to convince them to buy and keep business moving. One of the best methods for doing this is to share success stories that are relatable to prospects and customers based on their pain points, experiences, and overall needs.

That’s where case studies come in. Case studies are an essential part of a content marketing plan. These in-depth stories of customer experiences are some of the most effective at demonstrating the value of a product or service. Yet many marketers don’t use them, whether because of their regimented formats or the process of customer involvement and approval.

A case study is a powerful tool for showcasing your hard work and the success your customer achieved. But writing a great case study can be difficult if you’ve never done it before or if it’s been a while. This guide will show you how to write an effective case study and provide real-world examples and templates that will keep readers engaged and support your business.

In this article, you’ll learn:

What is a case study?

How to write a case study, case study templates, case study examples, case study tools.

A case study is the detailed story of a customer’s experience with a product or service that demonstrates their success and often includes measurable outcomes. Case studies are used in a range of fields and for various reasons, from business to academic research. They’re especially impactful in marketing as brands work to convince and convert consumers with relatable, real-world stories of actual customer experiences.

The best case studies tell the story of a customer’s success, including the steps they took, the results they achieved, and the support they received from a brand along the way. To write a great case study, you need to:

• Celebrate the customer and make them — not a product or service — the star of the story.
• Craft the story with specific audiences or target segments in mind so that the story of one customer will be viewed as relatable and actionable for another customer.
• Write copy that is easy to read and engaging so that readers will gain the insights and messages intended.
• Follow a standardized format that includes all of the essentials a potential customer would find interesting and useful.
• Support all of the claims for success made in the story with data in the forms of hard numbers and customer statements.

Case studies are a type of review but more in depth, aiming to show — rather than just tell — the positive experiences that customers have with a brand. Notably, 89% of consumers read reviews before deciding to buy, and 79% view case study content as part of their purchasing process. When it comes to B2B sales, 52% of buyers rank case studies as an important part of their evaluation process.

Telling a brand story through the experience of a tried-and-true customer matters. The story is relatable to potential new customers as they imagine themselves in the shoes of the company or individual featured in the case study. Showcasing previous customers can help new ones see themselves engaging with your brand in the ways that are most meaningful to them.

Besides sharing the perspective of another customer, case studies stand out from other content marketing forms because they are based on evidence. Whether pulling from client testimonials or data-driven results, case studies tend to have more impact on new business because the story contains information that is both objective (data) and subjective (customer experience) — and the brand doesn’t sound too self-promotional.

Case studies are unique in that there’s a fairly standardized format for telling a customer’s story. But that doesn’t mean there isn’t room for creativity. It’s all about making sure that teams are clear on the goals for the case study — along with strategies for supporting content and channels — and understanding how the story fits within the framework of the company’s overall marketing goals.

Here are the basic steps to writing a good case study.

1. Identify your goal

Start by defining exactly who your case study will be designed to help. Case studies are about specific instances where a company works with a customer to achieve a goal. Identify which customers are likely to have these goals, as well as other needs the story should cover to appeal to them.

The answer is often found in one of the buyer personas that have been constructed as part of your larger marketing strategy. This can include anything from new leads generated by the marketing team to long-term customers that are being pressed for cross-sell opportunities. In all of these cases, demonstrating value through a relatable customer success story can be part of the solution to conversion.

2. Choose your client or subject

Who you highlight matters. Case studies tie brands together that might otherwise not cross paths. A writer will want to ensure that the highlighted customer aligns with their own company’s brand identity and offerings. Look for a customer with positive name recognition who has had great success with a product or service and is willing to be an advocate.

The client should also match up with the identified target audience. Whichever company or individual is selected should be a reflection of other potential customers who can see themselves in similar circumstances, having the same problems and possible solutions.

Some of the most compelling case studies feature customers who:

• Switch from one product or service to another while naming competitors that missed the mark.
• Experience measurable results that are relatable to others in a specific industry.
• Represent well-known brands and recognizable names that are likely to compel action.
• Advocate for a product or service as a champion and are well-versed in its advantages.

Whoever or whatever customer is selected, marketers must ensure they have the permission of the company involved before getting started. Some brands have strict review and approval procedures for any official marketing or promotional materials that include their name. Acquiring those approvals in advance will prevent any miscommunication or wasted effort if there is an issue with their legal or compliance teams.

3. Conduct research and compile data

Substantiating the claims made in a case study — either by the marketing team or customers themselves — adds validity to the story. To do this, include data and feedback from the client that defines what success looks like. This can be anything from demonstrating return on investment (ROI) to a specific metric the customer was striving to improve. Case studies should prove how an outcome was achieved and show tangible results that indicate to the customer that your solution is the right one.

This step could also include customer interviews. Make sure that the people being interviewed are key stakeholders in the purchase decision or deployment and use of the product or service that is being highlighted. Content writers should work off a set list of questions prepared in advance. It can be helpful to share these with the interviewees beforehand so they have time to consider and craft their responses. One of the best interview tactics to keep in mind is to ask questions where yes and no are not natural answers. This way, your subject will provide more open-ended responses that produce more meaningful content.

4. Choose the right format

There are a number of different ways to format a case study. Depending on what you hope to achieve, one style will be better than another. However, there are some common elements to include, such as:

• An engaging headline
• A subject and customer introduction
• The unique challenge or challenges the customer faced
• The solution the customer used to solve the problem
• The results achieved
• Data and statistics to back up claims of success
• A strong call to action (CTA) to engage with the vendor

It’s also important to note that while case studies are traditionally written as stories, they don’t have to be in a written format. Some companies choose to get more creative with their case studies and produce multimedia content, depending on their audience and objectives. Case study formats can include traditional print stories, interactive web or social content, data-heavy infographics, professionally shot videos, podcasts, and more.

5. Write your case study

We’ll go into more detail later about how exactly to write a case study, including templates and examples. Generally speaking, though, there are a few things to keep in mind when writing your case study.

• Be clear and concise. Readers want to get to the point of the story quickly and easily, and they’ll be looking to see themselves reflected in the story right from the start.
• Provide a big picture. Always make sure to explain who the client is, their goals, and how they achieved success in a short introduction to engage the reader.
• Construct a clear narrative. Stick to the story from the perspective of the customer and what they needed to solve instead of just listing product features or benefits.
• Leverage graphics. Incorporating infographics, charts, and sidebars can be a more engaging and eye-catching way to share key statistics and data in readable ways.
• Offer the right amount of detail. Most case studies are one or two pages with clear sections that a reader can skim to find the information most important to them.
• Include data to support claims. Show real results — both facts and figures and customer quotes — to demonstrate credibility and prove the solution works.

6. Promote your story

Marketers have a number of options for distribution of a freshly minted case study. Many brands choose to publish case studies on their website and post them on social media. This can help support SEO and organic content strategies while also boosting company credibility and trust as visitors see that other businesses have used the product or service.

Marketers are always looking for quality content they can use for lead generation. Consider offering a case study as gated content behind a form on a landing page or as an offer in an email message. One great way to do this is to summarize the content and tease the full story available for download after the user takes an action.

Sales teams can also leverage case studies, so be sure they are aware that the assets exist once they’re published. Especially when it comes to larger B2B sales, companies often ask for examples of similar customer challenges that have been solved.

Now that you’ve learned a bit about case studies and what they should include, you may be wondering how to start creating great customer story content. Here are a couple of templates you can use to structure your case study.

Template 1 — Challenge-solution-result format

• Start with an engaging title. This should be fewer than 70 characters long for SEO best practices. One of the best ways to approach the title is to include the customer’s name and a hint at the challenge they overcame in the end.
• Create an introduction. Lead with an explanation as to who the customer is, the need they had, and the opportunity they found with a specific product or solution. Writers can also suggest the success the customer experienced with the solution they chose.
• Present the challenge. This should be several paragraphs long and explain the problem the customer faced and the issues they were trying to solve. Details should tie into the company’s products and services naturally. This section needs to be the most relatable to the reader so they can picture themselves in a similar situation.
• Share the solution. Explain which product or service offered was the ideal fit for the customer and why. Feel free to delve into their experience setting up, purchasing, and onboarding the solution.
• Explain the results. Demonstrate the impact of the solution they chose by backing up their positive experience with data. Fill in with customer quotes and tangible, measurable results that show the effect of their choice.
• Ask for action. Include a CTA at the end of the case study that invites readers to reach out for more information, try a demo, or learn more — to nurture them further in the marketing pipeline. What you ask of the reader should tie directly into the goals that were established for the case study in the first place.

Template 2 — Data-driven format

• Start with an engaging title. Be sure to include a statistic or data point in the first 70 characters. Again, it’s best to include the customer’s name as part of the title.
• Create an overview. Share the customer’s background and a short version of the challenge they faced. Present the reason a particular product or service was chosen, and feel free to include quotes from the customer about their selection process.
• Present data point 1. Isolate the first metric that the customer used to define success and explain how the product or solution helped to achieve this goal. Provide data points and quotes to substantiate the claim that success was achieved.
• Present data point 2. Isolate the second metric that the customer used to define success and explain what the product or solution did to achieve this goal. Provide data points and quotes to substantiate the claim that success was achieved.
• Present data point 3. Isolate the final metric that the customer used to define success and explain what the product or solution did to achieve this goal. Provide data points and quotes to substantiate the claim that success was achieved.
• Summarize the results. Reiterate the fact that the customer was able to achieve success thanks to a specific product or service. Include quotes and statements that reflect customer satisfaction and suggest they plan to continue using the solution.
• Ask for action. Include a CTA at the end of the case study that asks readers to reach out for more information, try a demo, or learn more — to further nurture them in the marketing pipeline. Again, remember that this is where marketers can look to convert their content into action with the customer.

While templates are helpful, seeing a case study in action can also be a great way to learn. Here are some examples of how Adobe customers have experienced success.

Juniper Networks

One example is the Adobe and Juniper Networks case study , which puts the reader in the customer’s shoes. The beginning of the story quickly orients the reader so that they know exactly who the article is about and what they were trying to achieve. Solutions are outlined in a way that shows Adobe Experience Manager is the best choice and a natural fit for the customer. Along the way, quotes from the client are incorporated to help add validity to the statements. The results in the case study are conveyed with clear evidence of scale and volume using tangible data.

The story of Lenovo’s journey with Adobe is one that spans years of planning, implementation, and rollout. The Lenovo case study does a great job of consolidating all of this into a relatable journey that other enterprise organizations can see themselves taking, despite the project size. This case study also features descriptive headers and compelling visual elements that engage the reader and strengthen the content.

Tata Consulting

When it comes to using data to show customer results, this case study does an excellent job of conveying details and numbers in an easy-to-digest manner. Bullet points at the start break up the content while also helping the reader understand exactly what the case study will be about. Tata Consulting used Adobe to deliver elevated, engaging content experiences for a large telecommunications client of its own — an objective that’s relatable for a lot of companies.

Case studies are a vital tool for any marketing team as they enable you to demonstrate the value of your company’s products and services to others. They help marketers do their job and add credibility to a brand trying to promote its solutions by using the experiences and stories of real customers.

When you’re ready to get started with a case study:

• Think about a few goals you’d like to accomplish with your content.
• Make a list of successful clients that would be strong candidates for a case study.
• Reach out to the client to get their approval and conduct an interview.
• Gather the data to present an engaging and effective customer story.

Adobe can help

There are several Adobe products that can help you craft compelling case studies. Adobe Experience Platform helps you collect data and deliver great customer experiences across every channel. Once you’ve created your case studies, Experience Platform will help you deliver the right information to the right customer at the right time for maximum impact.

To learn more, watch the Adobe Experience Platform story .

Keep in mind that the best case studies are backed by data. That’s where Adobe Real-Time Customer Data Platform and Adobe Analytics come into play. With Real-Time CDP, you can gather the data you need to build a great case study and target specific customers to deliver the content to the right audience at the perfect moment.

Watch the Real-Time CDP overview video to learn more.

Finally, Adobe Analytics turns real-time data into real-time insights. It helps your business collect and synthesize data from multiple platforms to make more informed decisions and create the best case study possible.

Request a demo to learn more about Adobe Analytics.

https://business.adobe.com/blog/perspectives/b2b-ecommerce-10-case-studies-inspire-you

https://business.adobe.com/blog/basics/business-case

https://business.adobe.com/blog/basics/what-is-real-time-analytics

All You Wanted to Know About How to Write a Case Study

What do you study in your college? If you are a psychology, sociology, or anthropology student, we bet you might be familiar with what a case study is. This research method is used to study a certain person, group, or situation. In this guide from our dissertation writing service , you will learn how to write a case study professionally, from researching to citing sources properly. Also, we will explore different types of case studies and show you examples — so that you won’t have any other questions left.

What Is a Case Study?

A case study is a subcategory of research design which investigates problems and offers solutions. Case studies can range from academic research studies to corporate promotional tools trying to sell an idea—their scope is quite vast.

What Is the Difference Between a Research Paper and a Case Study?

While research papers turn the reader’s attention to a certain problem, case studies go even further. Case study guidelines require students to pay attention to details, examining issues closely and in-depth using different research methods. For example, case studies may be used to examine court cases if you study Law, or a patient's health history if you study Medicine. Case studies are also used in Marketing, which are thorough, empirically supported analysis of a good or service's performance. Well-designed case studies can be valuable for prospective customers as they can identify and solve the potential customers pain point.

Case studies involve a lot of storytelling – they usually examine particular cases for a person or a group of people. This method of research is very helpful, as it is very practical and can give a lot of hands-on information. Most commonly, the length of the case study is about 500-900 words, which is much less than the length of an average research paper.

The structure of a case study is very similar to storytelling. It has a protagonist or main character, which in your case is actually a problem you are trying to solve. You can use the system of 3 Acts to make it a compelling story. It should have an introduction, rising action, a climax where transformation occurs, falling action, and a solution.

Here is a rough formula for you to use in your case study:

Problem (Act I): > Solution (Act II) > Result (Act III) > Conclusion.

Types of Case Studies

The purpose of a case study is to provide detailed reports on an event, an institution, a place, future customers, or pretty much anything. There are a few common types of case study, but the type depends on the topic. The following are the most common domains where case studies are needed:

• Historical case studies are great to learn from. Historical events have a multitude of source info offering different perspectives. There are always modern parallels where these perspectives can be applied, compared, and thoroughly analyzed.
• Problem-oriented case studies are usually used for solving problems. These are often assigned as theoretical situations where you need to immerse yourself in the situation to examine it. Imagine you’re working for a startup and you’ve just noticed a significant flaw in your product’s design. Before taking it to the senior manager, you want to do a comprehensive study on the issue and provide solutions. On a greater scale, problem-oriented case studies are a vital part of relevant socio-economic discussions.
• Cumulative case studies collect information and offer comparisons. In business, case studies are often used to tell people about the value of a product.
• Critical case studies explore the causes and effects of a certain case.
• Illustrative case studies describe certain events, investigating outcomes and lessons learned.

Need a compelling case study? EssayPro has got you covered. Our experts are ready to provide you with detailed, insightful case studies that capture the essence of real-world scenarios. Elevate your academic work with our professional assistance.

Case Study Format

The case study format is typically made up of eight parts:

• Executive Summary. Explain what you will examine in the case study. Write an overview of the field you’re researching. Make a thesis statement and sum up the results of your observation in a maximum of 2 sentences.
• Background. Provide background information and the most relevant facts. Isolate the issues.
• Case Evaluation. Isolate the sections of the study you want to focus on. In it, explain why something is working or is not working.
• Proposed Solutions. Offer realistic ways to solve what isn’t working or how to improve its current condition. Explain why these solutions work by offering testable evidence.
• Conclusion. Summarize the main points from the case evaluations and proposed solutions. 6. Recommendations. Talk about the strategy that you should choose. Explain why this choice is the most appropriate.
• Implementation. Explain how to put the specific strategies into action.
• References. Provide all the citations.

How to Write a Case Study

Let's discover how to write a case study.

Setting Up the Research

When writing a case study, remember that research should always come first. Reading many different sources and analyzing other points of view will help you come up with more creative solutions. You can also conduct an actual interview to thoroughly investigate the customer story that you'll need for your case study. Including all of the necessary research, writing a case study may take some time. The research process involves doing the following:

• Define your objective. Explain the reason why you’re presenting your subject. Figure out where you will feature your case study; whether it is written, on video, shown as an infographic, streamed as a podcast, etc.
• Determine who will be the right candidate for your case study. Get permission, quotes, and other features that will make your case study effective. Get in touch with your candidate to see if they approve of being part of your work. Study that candidate’s situation and note down what caused it.
• Identify which various consequences could result from the situation. Follow these guidelines on how to start a case study: surf the net to find some general information you might find useful.
• Make a list of credible sources and examine them. Seek out important facts and highlight problems. Always write down your ideas and make sure to brainstorm.
• Focus on several key issues – why they exist, and how they impact your research subject. Think of several unique solutions. Draw from class discussions, readings, and personal experience. When writing a case study, focus on the best solution and explore it in depth. After having all your research in place, writing a case study will be easy. You may first want to check the rubric and criteria of your assignment for the correct case study structure.

Read Also: 'CREDIBLE SOURCES: WHAT ARE THEY?'

Although your instructor might be looking at slightly different criteria, every case study rubric essentially has the same standards. Your professor will want you to exhibit 8 different outcomes:

• Correctly identify the concepts, theories, and practices in the discipline.
• Identify the relevant theories and principles associated with the particular study.
• Evaluate legal and ethical principles and apply them to your decision-making.
• Recognize the global importance and contribution of your case.
• Construct a coherent summary and explanation of the study.
• Demonstrate analytical and critical-thinking skills.
• Explain the interrelationships between the environment and nature.
• Integrate theory and practice of the discipline within the analysis.

Need Case Study DONE FAST?

Pick a topic, tell us your requirements and get your paper on time.

Case Study Outline

Let's look at the structure of an outline based on the issue of the alcoholic addiction of 30 people.

Introduction

• Statement of the issue: Alcoholism is a disease rather than a weakness of character.
• Presentation of the problem: Alcoholism is affecting more than 14 million people in the USA, which makes it the third most common mental illness there.
• Explanation of the terms: In the past, alcoholism was commonly referred to as alcohol dependence or alcohol addiction. Alcoholism is now the more severe stage of this addiction in the disorder spectrum.
• Hypotheses: Drinking in excess can lead to the use of other drugs.
• Importance of your story: How the information you present can help people with their addictions.
• Background of the story: Include an explanation of why you chose this topic.
• Presentation of analysis and data: Describe the criteria for choosing 30 candidates, the structure of the interview, and the outcomes.
• Strong argument 1: ex. X% of candidates dealing with anxiety and depression...
• Strong argument 2: ex. X amount of people started drinking by their mid-teens.
• Strong argument 3: ex. X% of respondents’ parents had issues with alcohol.
• Concluding statement: I have researched if alcoholism is a disease and found out that…
• Recommendations: Ways and actions for preventing alcohol use.

Writing a Case Study Draft

After you’ve done your case study research and written the outline, it’s time to focus on the draft. In a draft, you have to develop and write your case study by using: the data which you collected throughout the research, interviews, and the analysis processes that were undertaken. Follow these rules for the draft:

• Your draft should contain at least 4 sections: an introduction; a body where you should include background information, an explanation of why you decided to do this case study, and a presentation of your main findings; a conclusion where you present data; and references.
• In the introduction, you should set the pace very clearly. You can even raise a question or quote someone you interviewed in the research phase. It must provide adequate background information on the topic. The background may include analyses of previous studies on your topic. Include the aim of your case here as well. Think of it as a thesis statement. The aim must describe the purpose of your work—presenting the issues that you want to tackle. Include background information, such as photos or videos you used when doing the research.
• Describe your unique research process, whether it was through interviews, observations, academic journals, etc. The next point includes providing the results of your research. Tell the audience what you found out. Why is this important, and what could be learned from it? Discuss the real implications of the problem and its significance in the world.
• Include quotes and data (such as findings, percentages, and awards). This will add a personal touch and better credibility to the case you present. Explain what results you find during your interviews in regards to the problem and how it developed. Also, write about solutions which have already been proposed by other people who have already written about this case.
• At the end of your case study, you should offer possible solutions, but don’t worry about solving them yourself.

Use Data to Illustrate Key Points in Your Case Study

Even though your case study is a story, it should be based on evidence. Use as much data as possible to illustrate your point. Without the right data, your case study may appear weak and the readers may not be able to relate to your issue as much as they should. Let's see the examples from essay writing service :

‍ With data: Alcoholism is affecting more than 14 million people in the USA, which makes it the third most common mental illness there. Without data: A lot of people suffer from alcoholism in the United States.

Try to include as many credible sources as possible. You may have terms or sources that could be hard for other cultures to understand. If this is the case, you should include them in the appendix or Notes for the Instructor or Professor.

Finalizing the Draft: Checklist

After you finish drafting your case study, polish it up by answering these ‘ask yourself’ questions and think about how to end your case study:

• Check that you follow the correct case study format, also in regards to text formatting.
• Check that your work is consistent with its referencing and citation style.
• Micro-editing — check for grammar and spelling issues.
• Macro-editing — does ‘the big picture’ come across to the reader? Is there enough raw data, such as real-life examples or personal experiences? Have you made your data collection process completely transparent? Does your analysis provide a clear conclusion, allowing for further research and practice?

Problems to avoid:

• Overgeneralization – Do not go into further research that deviates from the main problem.
• Failure to Document Limitations – Just as you have to clearly state the limitations of a general research study, you must describe the specific limitations inherent in the subject of analysis.
• Failure to Extrapolate All Possible Implications – Just as you don't want to over-generalize from your case study findings, you also have to be thorough in the consideration of all possible outcomes or recommendations derived from your findings.

How to Create a Title Page and Cite a Case Study

Let's see how to create an awesome title page.

Your title page depends on the prescribed citation format. The title page should include:

• A title that attracts some attention and describes your study
• The title should have the words “case study” in it
• The title should range between 5-9 words in length
• Your name and contact information
• Your finished paper should be only 500 to 1,500 words in length.With this type of assignment, write effectively and avoid fluff

Here is a template for the APA and MLA format title page:

There are some cases when you need to cite someone else's study in your own one – therefore, you need to master how to cite a case study. A case study is like a research paper when it comes to citations. You can cite it like you cite a book, depending on what style you need.

Citation Example in MLA ‍ Hill, Linda, Tarun Khanna, and Emily A. Stecker. HCL Technologies. Boston: Harvard Business Publishing, 2008. Print.

Citation Example in APA ‍ Hill, L., Khanna, T., & Stecker, E. A. (2008). HCL Technologies. Boston: Harvard Business Publishing.

Citation Example in Chicago Hill, Linda, Tarun Khanna, and Emily A. Stecker. HCL Technologies.

Case Study Examples

To give you an idea of a professional case study example, we gathered and linked some below.

Eastman Kodak Case Study

Case Study Example: Audi Trains Mexican Autoworkers in Germany

To conclude, a case study is one of the best methods of getting an overview of what happened to a person, a group, or a situation in practice. It allows you to have an in-depth glance at the real-life problems that businesses, healthcare industry, criminal justice, etc. may face. This insight helps us look at such situations in a different light. This is because we see scenarios that we otherwise would not, without necessarily being there. If you need custom essays , try our research paper writing services .

Get Help Form Qualified Writers

Crafting a case study is not easy. You might want to write one of high quality, but you don’t have the time or expertise. If you’re having trouble with your case study, help with essay request - we'll help. EssayPro writers have read and written countless case studies and are experts in endless disciplines. Request essay writing, editing, or proofreading assistance from our custom case study writing service , and all of your worries will be gone.

Don't Know Where to Start?

Crafting a case study is not easy. You might want to write one of high quality, but you don’t have the time or expertise. Request ' write my case study ' assistance from our service.

What Is A Case Study?

How to cite a case study in apa, how to write a case study, related articles.

Thank you for visiting nature.com. You are using a browser version with limited support for CSS. To obtain the best experience, we recommend you use a more up to date browser (or turn off compatibility mode in Internet Explorer). In the meantime, to ensure continued support, we are displaying the site without styles and JavaScript.

• View all journals
• Explore content
• About the journal
• Publish with us
• Sign up for alerts
• Published: 30 January 2023

A student guide to writing a case report

• Maeve McAllister 1  

BDJ Student volume  30 ,  pages 12–13 ( 2023 ) Cite this article

21 Accesses

Metrics details

As a student, it can be hard to know where to start when reading or writing a clinical case report either for university or out of special interest in a Journal. I have collated five top tips for writing an insightful and relevant case report.

A case report is a structured report of the clinical process of a patient's diagnostic pathway, including symptoms, signs, diagnosis, treatment planning (short and long term), clinical outcomes and follow-up. 1 Some of these case reports can sometimes have simple titles, to the more unusual, for example, 'Oral Tuberculosis', 'The escapee wisdom tooth', 'A difficult diagnosis'. They normally begin with the word 'Sir' and follow an introduction from this.

This is a preview of subscription content, access via your institution

Access options

Subscribe to this journal

We are sorry, but there is no personal subscription option available for your country.

Rent or buy this article

Prices vary by article type

Prices may be subject to local taxes which are calculated during checkout

Guidelines To Writing a Clinical Case Report. Heart Views 2017; 18 , 104-105.

British Dental Journal. Case reports. Available online at: www.nature.com/bdj/articles?searchType=journalSearch&sort=PubDate&type=case-report&page=2 (accessed August 17, 2022).

Chate R, Chate C. Achenbach's syndrome. Br Dent J 2021; 231: 147.

Abdulgani A, Muhamad, A-H and Watted N. Dental case report for publication; step by step. J Dent Med Sci 2014; 3 : 94-100.

Download references

Author information

Authors and affiliations.

Queen´s University Belfast, Belfast, United Kingdom

Maeve McAllister

You can also search for this author in PubMed   Google Scholar

Corresponding author

Correspondence to Maeve McAllister .

Rights and permissions

Reprints and permissions

About this article

Cite this article.

McAllister, M. A student guide to writing a case report. BDJ Student 30 , 12–13 (2023). https://doi.org/10.1038/s41406-023-0925-y

Download citation

Published : 30 January 2023

Issue Date : 30 January 2023

DOI : https://doi.org/10.1038/s41406-023-0925-y

Share this article

Anyone you share the following link with will be able to read this content:

Sorry, a shareable link is not currently available for this article.

Provided by the Springer Nature SharedIt content-sharing initiative

Quick links

• Explore articles by subject
• Guide to authors
• Editorial policies

Have a language expert improve your writing

Run a free plagiarism check in 10 minutes, automatically generate references for free.

• Knowledge Base
• Methodology
• Case Study | Definition, Examples & Methods

Case Study | Definition, Examples & Methods

Published on 5 May 2022 by Shona McCombes . Revised on 30 January 2023.

A case study is a detailed study of a specific subject, such as a person, group, place, event, organisation, or phenomenon. Case studies are commonly used in social, educational, clinical, and business research.

A case study research design usually involves qualitative methods , but quantitative methods are sometimes also used. Case studies are good for describing , comparing, evaluating, and understanding different aspects of a research problem .

Table of contents

When to do a case study, step 1: select a case, step 2: build a theoretical framework, step 3: collect your data, step 4: describe and analyse the case.

A case study is an appropriate research design when you want to gain concrete, contextual, in-depth knowledge about a specific real-world subject. It allows you to explore the key characteristics, meanings, and implications of the case.

Case studies are often a good choice in a thesis or dissertation . They keep your project focused and manageable when you don’t have the time or resources to do large-scale research.

You might use just one complex case study where you explore a single subject in depth, or conduct multiple case studies to compare and illuminate different aspects of your research problem.

Prevent plagiarism, run a free check.

Once you have developed your problem statement and research questions , you should be ready to choose the specific case that you want to focus on. A good case study should have the potential to:

• Provide new or unexpected insights into the subject
• Challenge or complicate existing assumptions and theories
• Propose practical courses of action to resolve a problem
• Open up new directions for future research

Unlike quantitative or experimental research, a strong case study does not require a random or representative sample. In fact, case studies often deliberately focus on unusual, neglected, or outlying cases which may shed new light on the research problem.

If you find yourself aiming to simultaneously investigate and solve an issue, consider conducting action research . As its name suggests, action research conducts research and takes action at the same time, and is highly iterative and flexible. 

However, you can also choose a more common or representative case to exemplify a particular category, experience, or phenomenon.

While case studies focus more on concrete details than general theories, they should usually have some connection with theory in the field. This way the case study is not just an isolated description, but is integrated into existing knowledge about the topic. It might aim to:

• Exemplify a theory by showing how it explains the case under investigation
• Expand on a theory by uncovering new concepts and ideas that need to be incorporated
• Challenge a theory by exploring an outlier case that doesn’t fit with established assumptions

To ensure that your analysis of the case has a solid academic grounding, you should conduct a literature review of sources related to the topic and develop a theoretical framework . This means identifying key concepts and theories to guide your analysis and interpretation.

There are many different research methods you can use to collect data on your subject. Case studies tend to focus on qualitative data using methods such as interviews, observations, and analysis of primary and secondary sources (e.g., newspaper articles, photographs, official records). Sometimes a case study will also collect quantitative data .

The aim is to gain as thorough an understanding as possible of the case and its context.

In writing up the case study, you need to bring together all the relevant aspects to give as complete a picture as possible of the subject.

How you report your findings depends on the type of research you are doing. Some case studies are structured like a standard scientific paper or thesis, with separate sections or chapters for the methods , results , and discussion .

Others are written in a more narrative style, aiming to explore the case from various angles and analyse its meanings and implications (for example, by using textual analysis or discourse analysis ).

In all cases, though, make sure to give contextual details about the case, connect it back to the literature and theory, and discuss how it fits into wider patterns or debates.

Cite this Scribbr article

If you want to cite this source, you can copy and paste the citation or click the ‘Cite this Scribbr article’ button to automatically add the citation to our free Reference Generator.

McCombes, S. (2023, January 30). Case Study | Definition, Examples & Methods. Scribbr. Retrieved 2 April 2024, from https://www.scribbr.co.uk/research-methods/case-studies/

Is this article helpful?

Shona McCombes

Other students also liked, correlational research | guide, design & examples, a quick guide to experimental design | 5 steps & examples, descriptive research design | definition, methods & examples.

We use essential cookies to make Venngage work. By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.

Manage Cookies

Cookies and similar technologies collect certain information about how you’re using our website. Some of them are essential, and without them you wouldn’t be able to use Venngage. But others are optional, and you get to choose whether we use them or not.

Strictly Necessary Cookies

These cookies are always on, as they’re essential for making Venngage work, and making it safe. Without these cookies, services you’ve asked for can’t be provided.

Show cookie providers

• Google Login

Functionality Cookies

These cookies help us provide enhanced functionality and personalisation, and remember your settings. They may be set by us or by third party providers.

Performance Cookies

These cookies help us analyze how many people are using Venngage, where they come from and how they're using it. If you opt out of these cookies, we can’t get feedback to make Venngage better for you and all our users.

• Google Analytics

Targeting Cookies

These cookies are set by our advertising partners to track your activity and show you relevant Venngage ads on other sites as you browse the internet.

• Google Tag Manager
• Infographics
• Daily Infographics
• Graphic Design
• Graphs and Charts
• Data Visualization
• Human Resources
• Training and Development
• Beginner Guides

Blog Graphic Design

15+ Professional Case Study Examples [Design Tips + Templates]

By Alice Corner , Jan 12, 2023

Have you ever bought something — within the last 10 years or so — without reading its reviews or without a recommendation or prior experience of using it?

If the answer is no — or at least, rarely — you get my point.

Positive reviews matter for selling to regular customers, and for B2B or SaaS businesses, detailed case studies are important too.

Wondering how to craft a compelling case study ? No worries—I’ve got you covered with 15 marketing case study templates , helpful tips, and examples to ensure your case study converts effectively.

Click to jump ahead:

• What is a Case Study?

Business Case Study Examples

Simple case study examples.

• Marketing Case Study Examples

Sales Case Study Examples

• Case Study FAQs

What is a case study?

A case study is an in-depth, detailed analysis of a specific real-world situation. For example, a case study can be about an individual, group, event, organization, or phenomenon. The purpose of a case study is to understand its complexities and gain insights into a particular instance or situation.

In the context of a business, however, case studies take customer success stories and explore how they use your product to help them achieve their business goals.

As well as being valuable marketing tools , case studies are a good way to evaluate your product as it allows you to objectively examine how others are using it.

It’s also a good way to interview your customers about why they work with you.

Related: What is a Case Study? [+6 Types of Case Studies]

Marketing Case Study Template

A marketing case study showcases how your product or services helped potential clients achieve their business goals. You can also create case studies of internal, successful marketing projects. A marketing case study typically includes:

• Company background and history
• The challenge
• How you helped
• Specific actions taken
• Visuals or Data
• Client testimonials

Here’s an example of a marketing case study template:

Whether you’re a B2B or B2C company, business case studies can be a powerful resource to help with your sales, marketing, and even internal departmental awareness.

Business and business management case studies should encompass strategic insights alongside anecdotal and qualitative findings, like in the business case study examples below.

Conduct a B2B case study by researching the company holistically

When it comes to writing a case study, make sure you approach the company holistically and analyze everything from their social media to their sales.

Think about every avenue your product or service has been of use to your case study company, and ask them about the impact this has had on their wider company goals.

In business case study examples like the one above, we can see that the company has been thought about holistically simply by the use of icons.

By combining social media icons with icons that show in-person communication we know that this is a well-researched and thorough case study.

This case study report example could also be used within an annual or end-of-year report.

Highlight the key takeaway from your marketing case study

To create a compelling case study, identify the key takeaways from your research. Use catchy language to sum up this information in a sentence, and present this sentence at the top of your page.

This is “at a glance” information and it allows people to gain a top-level understanding of the content immediately. 

You can use a large, bold, contrasting font to help this information stand out from the page and provide interest.

Learn  how to choose fonts  effectively with our Venngage guide and once you’ve done that.

Upload your fonts and  brand colors  to Venngage using the  My Brand Kit  tool and see them automatically applied to your designs.

The heading is the ideal place to put the most impactful information, as this is the first thing that people will read.

In this example, the stat of “Increase[d] lead quality by 90%” is used as the header. It makes customers want to read more to find out how exactly lead quality was increased by such a massive amount.

If you’re conducting an in-person interview, you could highlight a direct quote or insight provided by your interview subject.

Pick out a catchy sentence or phrase, or the key piece of information your interview subject provided and use that as a way to draw a potential customer in.

Use charts to visualize data in your business case studies

Charts are an excellent way to visualize data and to bring statistics and information to life. Charts make information easier to understand and to illustrate trends or patterns.

Making charts is even easier with Venngage.

In this consulting case study example, we can see that a chart has been used to demonstrate the difference in lead value within the Lead Elves case study.

Adding a chart here helps break up the information and add visual value to the case study. 

Using charts in your case study can also be useful if you’re creating a project management case study.

You could use a Gantt chart or a project timeline to show how you have managed the project successfully.

Use direct quotes to build trust in your marketing case study

To add an extra layer of authenticity you can include a direct quote from your customer within your case study.

According to research from Nielsen , 92% of people will trust a recommendation from a peer and 70% trust recommendations even if they’re from somebody they don’t know.

So if you have a customer or client who can’t stop singing your praises, make sure you get a direct quote from them and include it in your case study.

You can either lift part of the conversation or interview, or you can specifically request a quote. Make sure to ask for permission before using the quote.

This design uses a bright contrasting speech bubble to show that it includes a direct quote, and helps the quote stand out from the rest of the text.

This will help draw the customer’s attention directly to the quote, in turn influencing them to use your product or service.

Less is often more, and this is especially true when it comes to creating designs. Whilst you want to create a professional-looking, well-written and design case study – there’s no need to overcomplicate things.

These simple case study examples show that smart clean designs and informative content can be an effective way to showcase your successes.

Use colors and fonts to create a professional-looking case study

Business case studies shouldn’t be boring. In fact, they should be beautifully and professionally designed.

This means the normal rules of design apply. Use fonts, colors, and icons to create an interesting and visually appealing case study.

In this case study example, we can see how multiple fonts have been used to help differentiate between the headers and content, as well as complementary colors and eye-catching icons.

Marketing case study examples

Marketing case studies are incredibly useful for showing your marketing successes. Every successful marketing campaign relies on influencing a consumer’s behavior, and a great case study can be a great way to spotlight your biggest wins.

In the marketing case study examples below, a variety of designs and techniques to create impactful and effective case studies.

Show off impressive results with a bold marketing case study

Case studies are meant to show off your successes, so make sure you feature your positive results prominently. Using bold and bright colors as well as contrasting shapes, large bold fonts, and simple icons is a great way to highlight your wins.

In well-written case study examples like the one below, the big wins are highlighted on the second page with a bright orange color and are highlighted in circles.

Making the important data stand out is especially important when attracting a prospective customer with marketing case studies.

Use a simple but clear layout in your case study

Using a simple layout in your case study can be incredibly effective, like in the example of a case study below.

Keeping a clean white background, and using slim lines to help separate the sections is an easy way to format your case study.

Making the information clear helps draw attention to the important results, and it helps improve the  accessibility of the design .

Business case study examples like this would sit nicely within a larger report, with a consistent layout throughout.

Use visuals and icons to create an engaging and branded business case study

Nobody wants to read pages and pages of text — and that’s why Venngage wants to help you communicate your ideas visually.

Using icons, graphics, photos, or patterns helps create a much more engaging design. 

With this Blue Cap case study icons, colors, and impactful pattern designs have been used to create an engaging design that catches your eye.

Use a monochromatic color palette to create a professional and clean case study

Let your research shine by using a monochromatic and minimalistic color palette.

By sticking to one color, and leaving lots of blank space you can ensure your design doesn’t distract a potential customer from your case study content.

In this case study on Polygon Media, the design is simple and professional, and the layout allows the prospective customer to follow the flow of information.

The gradient effect on the left-hand column helps break up the white background and adds an interesting visual effect.

Did you know you can generate an accessible color palette with Venngage? Try our free accessible color palette generator today and create a case study that delivers and looks pleasant to the eye:

Add long term goals in your case study

When creating a case study it’s a great idea to look at both the short term and the long term goals of the company to gain the best understanding possible of the insights they provide.

Short-term goals will be what the company or person hopes to achieve in the next few months, and long-term goals are what the company hopes to achieve in the next few years.

Check out this modern pattern design example of a case study below:

In this case study example, the short and long-term goals are clearly distinguished by light blue boxes and placed side by side so that they are easy to compare.

Use a strong introductory paragraph to outline the overall strategy and goals before outlining the specific short-term and long-term goals to help with clarity.

This strategy can also be handy when creating a consulting case study.

Use data to make concrete points about your sales and successes

When conducting any sort of research stats, facts, and figures are like gold dust (aka, really valuable).

Being able to quantify your findings is important to help understand the information fully. Saying sales increased 10% is much more effective than saying sales increased.

While sales dashboards generally tend it make it all about the numbers and charts, in sales case study examples, like this one, the key data and findings can be presented with icons. This contributes to the potential customer’s better understanding of the report.

They can clearly comprehend the information and it shows that the case study has been well researched.

Use emotive, persuasive, or action based language in your marketing case study

Create a compelling case study by using emotive, persuasive and action-based language when customizing your case study template.

In this well-written case study example, we can see that phrases such as “Results that Speak Volumes” and “Drive Sales” have been used.

Using persuasive language like you would in a blog post. It helps inspire potential customers to take action now.

Keep your potential customers in mind when creating a customer case study for marketing

82% of marketers use case studies in their marketing  because it’s such an effective tool to help quickly gain customers’ trust and to showcase the potential of your product.

Why are case studies such an important tool in content marketing?

By writing a case study you’re telling potential customers that they can trust you because you’re showing them that other people do.

Not only that, but if you have a SaaS product, business case studies are a great way to show how other people are effectively using your product in their company.

In this case study, Network is demonstrating how their product has been used by Vortex Co. with great success; instantly showing other potential customers that their tool works and is worth using.

Related: 10+ Case Study Infographic Templates That Convert

Case studies are particularly effective as a sales technique.

A sales case study is like an extended customer testimonial, not only sharing opinions of your product – but showcasing the results you helped your customer achieve.

Make impactful statistics pop in your sales case study

Writing a case study doesn’t mean using text as the only medium for sharing results.

You should use icons to highlight areas of your research that are particularly interesting or relevant, like in this example of a case study:

Icons are a great way to help summarize information quickly and can act as visual cues to help draw the customer’s attention to certain areas of the page.

In some of the business case study examples above, icons are used to represent the impressive areas of growth and are presented in a way that grabs your attention.

Use high contrast shapes and colors to draw attention to key information in your sales case study

Help the key information stand out within your case study by using high contrast shapes and colors.

Use a complementary or contrasting color, or use a shape such as a rectangle or a circle for maximum impact.

This design has used dark blue rectangles to help separate the information and make it easier to read.

Coupled with icons and strong statistics, this information stands out on the page and is easily digestible and retainable for a potential customer.

Case Study Examples Summary

Once you have created your case study, it’s best practice to update your examples on a regular basis to include up-to-date statistics, data, and information.

You should update your business case study examples often if you are sharing them on your website .

It’s also important that your case study sits within your brand guidelines – find out how Venngage’s My Brand Kit tool can help you create consistently branded case study templates.

Case studies are important marketing tools – but they shouldn’t be the only tool in your toolbox. Content marketing is also a valuable way to earn consumer trust.

Case Study FAQ

Why should you write a case study.

Case studies are an effective marketing technique to engage potential customers and help build trust.

By producing case studies featuring your current clients or customers, you are showcasing how your tool or product can be used. You’re also showing that other people endorse your product.

In addition to being a good way to gather positive testimonials from existing customers , business case studies are good educational resources and can be shared amongst your company or team, and used as a reference for future projects.

How should you write a case study?

To create a great case study, you should think strategically. The first step, before starting your case study research, is to think about what you aim to learn or what you aim to prove.

You might be aiming to learn how a company makes sales or develops a new product. If this is the case, base your questions around this.

You can learn more about writing a case study  from our extensive guide.

Related: How to Present a Case Study like a Pro (With Examples)

Some good questions you could ask would be:

• Why do you use our tool or service?
• How often do you use our tool or service?
• What does the process of using our product look like to you?
• If our product didn’t exist, what would you be doing instead?
• What is the number one benefit you’ve found from using our tool?

You might also enjoy:

• 12 Essential Consulting Templates For Marketing, Planning and Branding
• Best Marketing Strategies for Consultants and Freelancers in 2019 [Study + Infographic]

Research Writing and Analysis

• NVivo Group and Study Sessions
• SPSS This link opens in a new window
• Statistical Analysis Group sessions
• Using Qualtrics
• Dissertation and Data Analysis Group Sessions
• Research Process Flow Chart
• Research Alignment This link opens in a new window
• Step 1: Seek Out Evidence
• Step 2: Explain
• Step 3: The Big Picture
• Step 4: Own It
• Step 5: Illustrate
• Annotated Bibliography
• Literature Review This link opens in a new window
• Systematic Reviews & Meta-Analyses
• How to Synthesize and Analyze
• Synthesis and Analysis Practice
• Synthesis and Analysis Group Sessions
• Problem Statement
• Purpose Statement
• Quantitative Research Questions
• Qualitative Research Questions
• Trustworthiness of Qualitative Data
• Analysis and Coding Example- Qualitative Data
• Thematic Data Analysis in Qualitative Design
• Dissertation to Journal Article This link opens in a new window
• International Journal of Online Graduate Education (IJOGE) This link opens in a new window
• Journal of Research in Innovative Teaching & Learning (JRIT&L) This link opens in a new window

Writing a Case Study

What is a case study?

A Case study is: 

• An in-depth research design that primarily uses a qualitative methodology but sometimes​​ includes quantitative methodology.
• Used to examine an identifiable problem confirmed through research.
• Used to investigate an individual, group of people, organization, or event.
• Used to mostly answer "how" and "why" questions.

What are the different types of case studies?

Note: These are the primary case studies. As you continue to research and learn

about case studies you will begin to find a robust list of different types. 

Who are your case study participants?

What is triangulation ? 

Validity and credibility are an essential part of the case study. Therefore, the researcher should include triangulation to ensure trustworthiness while accurately reflecting what the researcher seeks to investigate.

How to write a Case Study?

When developing a case study, there are different ways you could present the information, but remember to include the five parts for your case study.

Was this resource helpful?

• << Previous: Thematic Data Analysis in Qualitative Design
• Next: Journal Article Reporting Standards (JARS) >>
• Last Updated: Apr 2, 2024 6:35 PM
• URL: https://resources.nu.edu/researchtools

• Introduction
• About Case Study Reports

Section A: Overview

• Section B: Planning and Researching
• Section C: Parts of a Case Study
• Section D: Reviewing and Presenting
• Section E: Revising Your Work
• Section F: Resources
• Your Workspace
• Guided Writing Tools

• About Lab Reports
• Section C: Critical Features
• Section D: Parts of a Lab Report

• About Literature Review
• Section C: Parts of a Literature Review
• Section D: Critical Writing Skills

• About Reflective Writing
• Section B: How Can I Reflect?
• Section C: How Do I Get Started?
• Section D: Writing a Reflection

Case Study Report Prepared by University of Guelph

This section will provide you with an overview of case study reports and what components you should include when writing them.

What Will I Learn?

By successfully completing this section, you should be able to:

• describe what a case study report is and how it is used,
• identify the components of a case study and how they fit together, and
• explain why case studies are popular in business education.

Prepared by

In general, a case study is a historical or fictional description of a business situation. Case studies are stories that contain a particular management problem or decision that needs to be made. They are usually very detailed and contain information about key stakeholders, organizational processes, products, markets, financials, and so on.

The case study method of teaching plays an important role in management education (e.g., Banning, 2003) and is commonly used in management education programs (e.g., Conger & Xin, 2000). Case studies present vivid and engaging examples of realistic business situations that allow students to apply theoretical concepts (Barkley, Cross, & Major, 2005).

A Case Study Is:

a partial, historical, clinical study of a situation which has confronted a practising administrator or managerial group. Presented in a narrative form to encourage student involvement, it provides data—substantive and process—essential to analysis of a specific situation, for the framing of alternative action programs, and for their implementation, recognising the complexity and ambiguity of the practical world.

(Barnes, Christensen, and Hansen, 1994, p. 44)

As Barnes et al. (1994) explain in the definition above, an engaging case study will provide a managerial dilemma that models the complexity of real world business decisions. Moreover, these decisions need to be made considering the analysis of data, assessment of viable alternatives, proposed recommendations, and associated implementation plan.

Components of A Case Study Report

What should a case study report include.

The components of a case study report will vary depending on the preferences of your institution and instructor. Be sure to refer to your assignment instructions to find out what will be required in your context.

Most case study reports will include the following major sections and components:

• Cover page including basic student and class information
• Table of contents showing where key parts of the report can be found
• Executive summary of the key recommendations and points of the report
• Introduction to the report and identification of the focal problem being faced
• Analysis of the problem and application of course/program content
• Decision criteria and possible alternatives for solving the problem
• Recommendation for solving the problem
• Implementation plan for executing the recommendation and ensuring its success
• Exhibits that help to elaborate upon the content included in the report
• Reference list of any sources that were used at any point in the case study project

There are many possible subsections within these components. The following information provides a more detailed explanation of each component as well as specific strategies to help with writing.

Case Study Report Template

What are the components of a case study presentation.

The components of a case study presentation will likely also vary depending on the preferences of your institution and instructor; however, most case study presentations will likely include an oral as well as a visual (e.g., PowerPoint) summary of the 10 major sections and components. The case study report template provided will give you with a method for presenting your case study project as well as specific strategies to help with presenting the various sections.

Case Study Report Outline Template

This outline sample of a Case Study Report should serve as a useful guide to help you get started.

Download PDF

Download the Case Study Report Outline Template .

Preview: PDF Worksheet

Business Courses and Case Studies

Why do business courses use case studies.

This short video introduces business case study reports by highlighting why case studies are popular in business education and what you can expect as a learner completing a case study report.

Business Case Studies

Video : Four awesome things about business case studies.

Business Case Studies | MP4 Video (01:03)

Four awesome things about business case studies. Number one; case studies give you a chance to examine business problems you might actually encounter in real life. Cases are based on real situations or realistic scenarios simulating complex and ambiguous problems from the business world. Number two; case studies can help you strengthen your critical thinking and problem-solving skills. You'll get practice analyzing stakeholders, organizational processes, and financial constraints. And you'll learn how to make decisions and solve problems in a safe and transparent environment. Number three; case studies are not lectures [snoring]. Enough said. Number four; case study assignments combine writing, research and oral presentation sells. All stuff you want to get better, right?

Self Assessment

• Which of the following was part of the definition of a case study as presented in this section?
• Which of the following was not one of the major sections and components mentioned in this section?
• Case studies were first developed as:
• The components of a case study report will likely be exactly the same across institutions and instructors.

Key Takeaways and References

Key takeaways & references, key takeaways.

• Case studies are rich, vivid situational exercises that can be used to make decisions and solve problems in a safe and transparent environment.
• Most case study reports follow an established pattern of core components with some variations depending on the context of the report.
• Case study reports allow business students an opportunity to hone their critical thinking skills for the complex and ambiguous situations that they are likely to encounter at work.

Banning, K. (2003). The effect of the case method on tolerance for ambiguity . Journal of Management Education, 27, 556–568.

Barkley, E. F, Cross, K. P. & Major, C. H. (2005). Collaborative learning techniques: A handbook for college faculty . San-Francisco: Jossey-Bass.

Barnes, L. B., Christensen, C. R., & Hansen, A. B. (1994). Teaching and the case method (3rd ed.). Cambridge, MA: Harvard Business School Press.

Conger, J. A., & Xin, K. (2000). Executive education in the 21st century . Journal of Management Education, 24, 73–101.

Redpath, L. (2012). Confronting the bias against on-line learning in management education . Academy of Management Learning & Education, 11, 125–140.

University of Guelph. (2015). Four awesome things about business case studies [WriteOnline_GUELPHIntro.mp4]. Published with GoAnimate: http://goanimate.com.

University of Guelph. (2015). Case Study Report Outline Template . (PDF).

Young, S. (2006). Student views of effective online teaching in higher education . The American Journal of Distance Education, 20, 65–77.

Next Section Overview

In Section B: Planning and Researching, we will explore how to analyze your case study report assignment and create a writing plan.

Organizing Your Social Sciences Research Assignments

• Annotated Bibliography
• Analyzing a Scholarly Journal Article
• Group Presentations
• Dealing with Nervousness
• Using Visual Aids
• Grading Someone Else's Paper
• Types of Structured Group Activities
• Group Project Survival Skills
• Leading a Class Discussion
• Multiple Book Review Essay
• Reviewing Collected Works
• Writing a Case Analysis Paper
• Writing a Case Study
• About Informed Consent
• Writing Field Notes
• Writing a Policy Memo
• Writing a Reflective Paper
• Writing a Research Proposal
• Generative AI and Writing
• Acknowledgments

Definition and Introduction

Case analysis is a problem-based teaching and learning method that involves critically analyzing complex scenarios within an organizational setting for the purpose of placing the student in a “real world” situation and applying reflection and critical thinking skills to contemplate appropriate solutions, decisions, or recommended courses of action. It is considered a more effective teaching technique than in-class role playing or simulation activities. The analytical process is often guided by questions provided by the instructor that ask students to contemplate relationships between the facts and critical incidents described in the case.

Cases generally include both descriptive and statistical elements and rely on students applying abductive reasoning to develop and argue for preferred or best outcomes [i.e., case scenarios rarely have a single correct or perfect answer based on the evidence provided]. Rather than emphasizing theories or concepts, case analysis assignments emphasize building a bridge of relevancy between abstract thinking and practical application and, by so doing, teaches the value of both within a specific area of professional practice.

Given this, the purpose of a case analysis paper is to present a structured and logically organized format for analyzing the case situation. It can be assigned to students individually or as a small group assignment and it may include an in-class presentation component. Case analysis is predominately taught in economics and business-related courses, but it is also a method of teaching and learning found in other applied social sciences disciplines, such as, social work, public relations, education, journalism, and public administration.

Ellet, William. The Case Study Handbook: A Student's Guide . Revised Edition. Boston, MA: Harvard Business School Publishing, 2018; Christoph Rasche and Achim Seisreiner. Guidelines for Business Case Analysis . University of Potsdam; Writing a Case Analysis . Writing Center, Baruch College; Volpe, Guglielmo. "Case Teaching in Economics: History, Practice and Evidence." Cogent Economics and Finance 3 (December 2015). doi:https://doi.org/10.1080/23322039.2015.1120977.

How to Approach Writing a Case Analysis Paper

The organization and structure of a case analysis paper can vary depending on the organizational setting, the situation, and how your professor wants you to approach the assignment. Nevertheless, preparing to write a case analysis paper involves several important steps. As Hawes notes, a case analysis assignment “...is useful in developing the ability to get to the heart of a problem, analyze it thoroughly, and to indicate the appropriate solution as well as how it should be implemented” [p.48]. This statement encapsulates how you should approach preparing to write a case analysis paper.

Before you begin to write your paper, consider the following analytical procedures:

• Review the case to get an overview of the situation . A case can be only a few pages in length, however, it is most often very lengthy and contains a significant amount of detailed background information and statistics, with multilayered descriptions of the scenario, the roles and behaviors of various stakeholder groups, and situational events. Therefore, a quick reading of the case will help you gain an overall sense of the situation and illuminate the types of issues and problems that you will need to address in your paper. If your professor has provided questions intended to help frame your analysis, use them to guide your initial reading of the case.
• Read the case thoroughly . After gaining a general overview of the case, carefully read the content again with the purpose of understanding key circumstances, events, and behaviors among stakeholder groups. Look for information or data that appears contradictory, extraneous, or misleading. At this point, you should be taking notes as you read because this will help you develop a general outline of your paper. The aim is to obtain a complete understanding of the situation so that you can begin contemplating tentative answers to any questions your professor has provided or, if they have not provided, developing answers to your own questions about the case scenario and its connection to the course readings,lectures, and class discussions.
• Determine key stakeholder groups, issues, and events and the relationships they all have to each other . As you analyze the content, pay particular attention to identifying individuals, groups, or organizations described in the case and identify evidence of any problems or issues of concern that impact the situation in a negative way. Other things to look for include identifying any assumptions being made by or about each stakeholder, potential biased explanations or actions, explicit demands or ultimatums , and the underlying concerns that motivate these behaviors among stakeholders. The goal at this stage is to develop a comprehensive understanding of the situational and behavioral dynamics of the case and the explicit and implicit consequences of each of these actions.
• Identify the core problems . The next step in most case analysis assignments is to discern what the core [i.e., most damaging, detrimental, injurious] problems are within the organizational setting and to determine their implications. The purpose at this stage of preparing to write your analysis paper is to distinguish between the symptoms of core problems and the core problems themselves and to decide which of these must be addressed immediately and which problems do not appear critical but may escalate over time. Identify evidence from the case to support your decisions by determining what information or data is essential to addressing the core problems and what information is not relevant or is misleading.
• Explore alternative solutions . As noted, case analysis scenarios rarely have only one correct answer. Therefore, it is important to keep in mind that the process of analyzing the case and diagnosing core problems, while based on evidence, is a subjective process open to various avenues of interpretation. This means that you must consider alternative solutions or courses of action by critically examining strengths and weaknesses, risk factors, and the differences between short and long-term solutions. For each possible solution or course of action, consider the consequences they may have related to their implementation and how these recommendations might lead to new problems. Also, consider thinking about your recommended solutions or courses of action in relation to issues of fairness, equity, and inclusion.
• Decide on a final set of recommendations . The last stage in preparing to write a case analysis paper is to assert an opinion or viewpoint about the recommendations needed to help resolve the core problems as you see them and to make a persuasive argument for supporting this point of view. Prepare a clear rationale for your recommendations based on examining each element of your analysis. Anticipate possible obstacles that could derail their implementation. Consider any counter-arguments that could be made concerning the validity of your recommended actions. Finally, describe a set of criteria and measurable indicators that could be applied to evaluating the effectiveness of your implementation plan.

Use these steps as the framework for writing your paper. Remember that the more detailed you are in taking notes as you critically examine each element of the case, the more information you will have to draw from when you begin to write. This will save you time.

NOTE : If the process of preparing to write a case analysis paper is assigned as a student group project, consider having each member of the group analyze a specific element of the case, including drafting answers to the corresponding questions used by your professor to frame the analysis. This will help make the analytical process more efficient and ensure that the distribution of work is equitable. This can also facilitate who is responsible for drafting each part of the final case analysis paper and, if applicable, the in-class presentation.

Framework for Case Analysis . College of Management. University of Massachusetts; Hawes, Jon M. "Teaching is Not Telling: The Case Method as a Form of Interactive Learning." Journal for Advancement of Marketing Education 5 (Winter 2004): 47-54; Rasche, Christoph and Achim Seisreiner. Guidelines for Business Case Analysis . University of Potsdam; Writing a Case Study Analysis . University of Arizona Global Campus Writing Center; Van Ness, Raymond K. A Guide to Case Analysis . School of Business. State University of New York, Albany; Writing a Case Analysis . Business School, University of New South Wales.

Structure and Writing Style

A case analysis paper should be detailed, concise, persuasive, clearly written, and professional in tone and in the use of language . As with other forms of college-level academic writing, declarative statements that convey information, provide a fact, or offer an explanation or any recommended courses of action should be based on evidence. If allowed by your professor, any external sources used to support your analysis, such as course readings, should be properly cited under a list of references. The organization and structure of case analysis papers can vary depending on your professor’s preferred format, but its structure generally follows the steps used for analyzing the case.

Introduction

The introduction should provide a succinct but thorough descriptive overview of the main facts, issues, and core problems of the case . The introduction should also include a brief summary of the most relevant details about the situation and organizational setting. This includes defining the theoretical framework or conceptual model on which any questions were used to frame your analysis.

Following the rules of most college-level research papers, the introduction should then inform the reader how the paper will be organized. This includes describing the major sections of the paper and the order in which they will be presented. Unless you are told to do so by your professor, you do not need to preview your final recommendations in the introduction. U nlike most college-level research papers , the introduction does not include a statement about the significance of your findings because a case analysis assignment does not involve contributing new knowledge about a research problem.

Background Analysis

Background analysis can vary depending on any guiding questions provided by your professor and the underlying concept or theory that the case is based upon. In general, however, this section of your paper should focus on:

• Providing an overarching analysis of problems identified from the case scenario, including identifying events that stakeholders find challenging or troublesome,
• Identifying assumptions made by each stakeholder and any apparent biases they may exhibit,
• Describing any demands or claims made by or forced upon key stakeholders, and
• Highlighting any issues of concern or complaints expressed by stakeholders in response to those demands or claims.

These aspects of the case are often in the form of behavioral responses expressed by individuals or groups within the organizational setting. However, note that problems in a case situation can also be reflected in data [or the lack thereof] and in the decision-making, operational, cultural, or institutional structure of the organization. Additionally, demands or claims can be either internal and external to the organization [e.g., a case analysis involving a president considering arms sales to Saudi Arabia could include managing internal demands from White House advisors as well as demands from members of Congress].

Throughout this section, present all relevant evidence from the case that supports your analysis. Do not simply claim there is a problem, an assumption, a demand, or a concern; tell the reader what part of the case informed how you identified these background elements.

Identification of Problems

In most case analysis assignments, there are problems, and then there are problems . Each problem can reflect a multitude of underlying symptoms that are detrimental to the interests of the organization. The purpose of identifying problems is to teach students how to differentiate between problems that vary in severity, impact, and relative importance. Given this, problems can be described in three general forms: those that must be addressed immediately, those that should be addressed but the impact is not severe, and those that do not require immediate attention and can be set aside for the time being.

All of the problems you identify from the case should be identified in this section of your paper, with a description based on evidence explaining the problem variances. If the assignment asks you to conduct research to further support your assessment of the problems, include this in your explanation. Remember to cite those sources in a list of references. Use specific evidence from the case and apply appropriate concepts, theories, and models discussed in class or in relevant course readings to highlight and explain the key problems [or problem] that you believe must be solved immediately and describe the underlying symptoms and why they are so critical.

Alternative Solutions

This section is where you provide specific, realistic, and evidence-based solutions to the problems you have identified and make recommendations about how to alleviate the underlying symptomatic conditions impacting the organizational setting. For each solution, you must explain why it was chosen and provide clear evidence to support your reasoning. This can include, for example, course readings and class discussions as well as research resources, such as, books, journal articles, research reports, or government documents. In some cases, your professor may encourage you to include personal, anecdotal experiences as evidence to support why you chose a particular solution or set of solutions. Using anecdotal evidence helps promote reflective thinking about the process of determining what qualifies as a core problem and relevant solution .

Throughout this part of the paper, keep in mind the entire array of problems that must be addressed and describe in detail the solutions that might be implemented to resolve these problems.

Recommended Courses of Action

In some case analysis assignments, your professor may ask you to combine the alternative solutions section with your recommended courses of action. However, it is important to know the difference between the two. A solution refers to the answer to a problem. A course of action refers to a procedure or deliberate sequence of activities adopted to proactively confront a situation, often in the context of accomplishing a goal. In this context, proposed courses of action are based on your analysis of alternative solutions. Your description and justification for pursuing each course of action should represent the overall plan for implementing your recommendations.

For each course of action, you need to explain the rationale for your recommendation in a way that confronts challenges, explains risks, and anticipates any counter-arguments from stakeholders. Do this by considering the strengths and weaknesses of each course of action framed in relation to how the action is expected to resolve the core problems presented, the possible ways the action may affect remaining problems, and how the recommended action will be perceived by each stakeholder.

In addition, you should describe the criteria needed to measure how well the implementation of these actions is working and explain which individuals or groups are responsible for ensuring your recommendations are successful. In addition, always consider the law of unintended consequences. Outline difficulties that may arise in implementing each course of action and describe how implementing the proposed courses of action [either individually or collectively] may lead to new problems [both large and small].

Throughout this section, you must consider the costs and benefits of recommending your courses of action in relation to uncertainties or missing information and the negative consequences of success.

The conclusion should be brief and introspective. Unlike a research paper, the conclusion in a case analysis paper does not include a summary of key findings and their significance, a statement about how the study contributed to existing knowledge, or indicate opportunities for future research.

Begin by synthesizing the core problems presented in the case and the relevance of your recommended solutions. This can include an explanation of what you have learned about the case in the context of your answers to the questions provided by your professor. The conclusion is also where you link what you learned from analyzing the case with the course readings or class discussions. This can further demonstrate your understanding of the relationships between the practical case situation and the theoretical and abstract content of assigned readings and other course content.

Problems to Avoid

The literature on case analysis assignments often includes examples of difficulties students have with applying methods of critical analysis and effectively reporting the results of their assessment of the situation. A common reason cited by scholars is that the application of this type of teaching and learning method is limited to applied fields of social and behavioral sciences and, as a result, writing a case analysis paper can be unfamiliar to most students entering college.

After you have drafted your paper, proofread the narrative flow and revise any of these common errors:

• Unnecessary detail in the background section . The background section should highlight the essential elements of the case based on your analysis. Focus on summarizing the facts and highlighting the key factors that become relevant in the other sections of the paper by eliminating any unnecessary information.
• Analysis relies too much on opinion . Your analysis is interpretive, but the narrative must be connected clearly to evidence from the case and any models and theories discussed in class or in course readings. Any positions or arguments you make should be supported by evidence.
• Analysis does not focus on the most important elements of the case . Your paper should provide a thorough overview of the case. However, the analysis should focus on providing evidence about what you identify are the key events, stakeholders, issues, and problems. Emphasize what you identify as the most critical aspects of the case to be developed throughout your analysis. Be thorough but succinct.
• Writing is too descriptive . A paper with too much descriptive information detracts from your analysis of the complexities of the case situation. Questions about what happened, where, when, and by whom should only be included as essential information leading to your examination of questions related to why, how, and for what purpose.
• Inadequate definition of a core problem and associated symptoms . A common error found in case analysis papers is recommending a solution or course of action without adequately defining or demonstrating that you understand the problem. Make sure you have clearly described the problem and its impact and scope within the organizational setting. Ensure that you have adequately described the root causes w hen describing the symptoms of the problem.
• Recommendations lack specificity . Identify any use of vague statements and indeterminate terminology, such as, “A particular experience” or “a large increase to the budget.” These statements cannot be measured and, as a result, there is no way to evaluate their successful implementation. Provide specific data and use direct language in describing recommended actions.
• Unrealistic, exaggerated, or unattainable recommendations . Review your recommendations to ensure that they are based on the situational facts of the case. Your recommended solutions and courses of action must be based on realistic assumptions and fit within the constraints of the situation. Also note that the case scenario has already happened, therefore, any speculation or arguments about what could have occurred if the circumstances were different should be revised or eliminated.

Bee, Lian Song et al. "Business Students' Perspectives on Case Method Coaching for Problem-Based Learning: Impacts on Student Engagement and Learning Performance in Higher Education." Education & Training 64 (2022): 416-432; The Case Analysis . Fred Meijer Center for Writing and Michigan Authors. Grand Valley State University; Georgallis, Panikos and Kayleigh Bruijn. "Sustainability Teaching using Case-Based Debates." Journal of International Education in Business 15 (2022): 147-163; Hawes, Jon M. "Teaching is Not Telling: The Case Method as a Form of Interactive Learning." Journal for Advancement of Marketing Education 5 (Winter 2004): 47-54; Georgallis, Panikos, and Kayleigh Bruijn. "Sustainability Teaching Using Case-based Debates." Journal of International Education in Business 15 (2022): 147-163; .Dean,  Kathy Lund and Charles J. Fornaciari. "How to Create and Use Experiential Case-Based Exercises in a Management Classroom." Journal of Management Education 26 (October 2002): 586-603; Klebba, Joanne M. and Janet G. Hamilton. "Structured Case Analysis: Developing Critical Thinking Skills in a Marketing Case Course." Journal of Marketing Education 29 (August 2007): 132-137, 139; Klein, Norman. "The Case Discussion Method Revisited: Some Questions about Student Skills." Exchange: The Organizational Behavior Teaching Journal 6 (November 1981): 30-32; Mukherjee, Arup. "Effective Use of In-Class Mini Case Analysis for Discovery Learning in an Undergraduate MIS Course." The Journal of Computer Information Systems 40 (Spring 2000): 15-23; Pessoa, Silviaet al. "Scaffolding the Case Analysis in an Organizational Behavior Course: Making Analytical Language Explicit." Journal of Management Education 46 (2022): 226-251: Ramsey, V. J. and L. D. Dodge. "Case Analysis: A Structured Approach." Exchange: The Organizational Behavior Teaching Journal 6 (November 1981): 27-29; Schweitzer, Karen. "How to Write and Format a Business Case Study." ThoughtCo. https://www.thoughtco.com/how-to-write-and-format-a-business-case-study-466324 (accessed December 5, 2022); Reddy, C. D. "Teaching Research Methodology: Everything's a Case." Electronic Journal of Business Research Methods 18 (December 2020): 178-188; Volpe, Guglielmo. "Case Teaching in Economics: History, Practice and Evidence." Cogent Economics and Finance 3 (December 2015). doi:https://doi.org/10.1080/23322039.2015.1120977.

Writing Tip

Ca se Study and Case Analysis Are Not the Same!

Confusion often exists between what it means to write a paper that uses a case study research design and writing a paper that analyzes a case; they are two different types of approaches to learning in the social and behavioral sciences. Professors as well as educational researchers contribute to this confusion because they often use the term "case study" when describing the subject of analysis for a case analysis paper. But you are not studying a case for the purpose of generating a comprehensive, multi-faceted understanding of a research problem. R ather, you are critically analyzing a specific scenario to argue logically for recommended solutions and courses of action that lead to optimal outcomes applicable to professional practice.

To avoid any confusion, here are twelve characteristics that delineate the differences between writing a paper using the case study research method and writing a case analysis paper:

• Case study is a method of in-depth research and rigorous inquiry ; case analysis is a reliable method of teaching and learning . A case study is a modality of research that investigates a phenomenon for the purpose of creating new knowledge, solving a problem, or testing a hypothesis using empirical evidence derived from the case being studied. Often, the results are used to generalize about a larger population or within a wider context. The writing adheres to the traditional standards of a scholarly research study. A case analysis is a pedagogical tool used to teach students how to reflect and think critically about a practical, real-life problem in an organizational setting.
• The researcher is responsible for identifying the case to study; a case analysis is assigned by your professor . As the researcher, you choose the case study to investigate in support of obtaining new knowledge and understanding about the research problem. The case in a case analysis assignment is almost always provided, and sometimes written, by your professor and either given to every student in class to analyze individually or to a small group of students, or students select a case to analyze from a predetermined list.
• A case study is indeterminate and boundless; a case analysis is predetermined and confined . A case study can be almost anything [see item 9 below] as long as it relates directly to examining the research problem. This relationship is the only limit to what a researcher can choose as the subject of their case study. The content of a case analysis is determined by your professor and its parameters are well-defined and limited to elucidating insights of practical value applied to practice.
• Case study is fact-based and describes actual events or situations; case analysis can be entirely fictional or adapted from an actual situation . The entire content of a case study must be grounded in reality to be a valid subject of investigation in an empirical research study. A case analysis only needs to set the stage for critically examining a situation in practice and, therefore, can be entirely fictional or adapted, all or in-part, from an actual situation.
• Research using a case study method must adhere to principles of intellectual honesty and academic integrity; a case analysis scenario can include misleading or false information . A case study paper must report research objectively and factually to ensure that any findings are understood to be logically correct and trustworthy. A case analysis scenario may include misleading or false information intended to deliberately distract from the central issues of the case. The purpose is to teach students how to sort through conflicting or useless information in order to come up with the preferred solution. Any use of misleading or false information in academic research is considered unethical.
• Case study is linked to a research problem; case analysis is linked to a practical situation or scenario . In the social sciences, the subject of an investigation is most often framed as a problem that must be researched in order to generate new knowledge leading to a solution. Case analysis narratives are grounded in real life scenarios for the purpose of examining the realities of decision-making behavior and processes within organizational settings. A case analysis assignments include a problem or set of problems to be analyzed. However, the goal is centered around the act of identifying and evaluating courses of action leading to best possible outcomes.
• The purpose of a case study is to create new knowledge through research; the purpose of a case analysis is to teach new understanding . Case studies are a choice of methodological design intended to create new knowledge about resolving a research problem. A case analysis is a mode of teaching and learning intended to create new understanding and an awareness of uncertainty applied to practice through acts of critical thinking and reflection.
• A case study seeks to identify the best possible solution to a research problem; case analysis can have an indeterminate set of solutions or outcomes . Your role in studying a case is to discover the most logical, evidence-based ways to address a research problem. A case analysis assignment rarely has a single correct answer because one of the goals is to force students to confront the real life dynamics of uncertainly, ambiguity, and missing or conflicting information within professional practice. Under these conditions, a perfect outcome or solution almost never exists.
• Case study is unbounded and relies on gathering external information; case analysis is a self-contained subject of analysis . The scope of a case study chosen as a method of research is bounded. However, the researcher is free to gather whatever information and data is necessary to investigate its relevance to understanding the research problem. For a case analysis assignment, your professor will often ask you to examine solutions or recommended courses of action based solely on facts and information from the case.
• Case study can be a person, place, object, issue, event, condition, or phenomenon; a case analysis is a carefully constructed synopsis of events, situations, and behaviors . The research problem dictates the type of case being studied and, therefore, the design can encompass almost anything tangible as long as it fulfills the objective of generating new knowledge and understanding. A case analysis is in the form of a narrative containing descriptions of facts, situations, processes, rules, and behaviors within a particular setting and under a specific set of circumstances.
• Case study can represent an open-ended subject of inquiry; a case analysis is a narrative about something that has happened in the past . A case study is not restricted by time and can encompass an event or issue with no temporal limit or end. For example, the current war in Ukraine can be used as a case study of how medical personnel help civilians during a large military conflict, even though circumstances around this event are still evolving. A case analysis can be used to elicit critical thinking about current or future situations in practice, but the case itself is a narrative about something finite and that has taken place in the past.
• Multiple case studies can be used in a research study; case analysis involves examining a single scenario . Case study research can use two or more cases to examine a problem, often for the purpose of conducting a comparative investigation intended to discover hidden relationships, document emerging trends, or determine variations among different examples. A case analysis assignment typically describes a stand-alone, self-contained situation and any comparisons among cases are conducted during in-class discussions and/or student presentations.

The Case Analysis . Fred Meijer Center for Writing and Michigan Authors. Grand Valley State University; Mills, Albert J. , Gabrielle Durepos, and Eiden Wiebe, editors. Encyclopedia of Case Study Research . Thousand Oaks, CA: SAGE Publications, 2010; Ramsey, V. J. and L. D. Dodge. "Case Analysis: A Structured Approach." Exchange: The Organizational Behavior Teaching Journal 6 (November 1981): 27-29; Yin, Robert K. Case Study Research and Applications: Design and Methods . 6th edition. Thousand Oaks, CA: Sage, 2017; Crowe, Sarah et al. “The Case Study Approach.” BMC Medical Research Methodology 11 (2011):  doi: 10.1186/1471-2288-11-100; Yin, Robert K. Case Study Research: Design and Methods . 4th edition. Thousand Oaks, CA: Sage Publishing; 1994.

• << Previous: Reviewing Collected Works
• Next: Writing a Case Study >>
• Last Updated: Mar 6, 2024 1:00 PM
• URL: https://libguides.usc.edu/writingguide/assignments

An official website of the United States government

The .gov means it’s official. Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

The site is secure. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

• Publications
• Account settings

Preview improvements coming to the PMC website in October 2024. Learn More or Try it out now .

• Advanced Search
• Journal List
• J Med Case Rep

How to choose the best journal for your case report

Richard a. rison.

1 University of Southern California Keck School of Medicine, Los Angeles County Medical Center, 12401 Washington Blvd., Whittier, CA 90602 USA

2 PIH Health Hospital-Whittier Stroke Center, PIH Health Hospital Non-Invasive Vascular Laboratory, 12401 Washington Blvd., Whittier, CA 90602 USA

Jennifer Kelly Shepphird

3 JKS Science & Medical Writing, Los Angeles, CA USA

Michael R. Kidd

4 Faculty of Medicine, Nursing and Health Sciences, Flinders University, GPO Box 2100, Adelaide, SA 5001 Australia

5 Department of Family & Community Medicine, University of Toronto, 500 University Avenue, Toronto, M5G 1V7 Canada

Since the establishment of the Journal of Medical Case Reports in 2006, the number of journals that publish case reports has increased rapidly, and most of these journals are open access. Open access publishing usually requires authors to pay publication fees while offering the articles online, free of charge, and free of most copyright and licensing restrictions. The movement for open access has gained support in the research community, with the publishers BioMed Central and PLOS ONE becoming leaders in scientific publishing in their number of articles and citations. As the number of open access publishers has exploded, so too has the number of publishers that act in bad faith to profit from the open access model. Simple guidelines have been developed and resources are available to help authors choose a suitable journal for publication of their case reports.

Case reports offer unique value to the body of medical knowledge by describing new diseases, disease mechanisms, therapeutic approaches, and adverse or beneficial effects of drugs. The act of recording, discussing with colleagues, and publishing clinical observations as case reports remains essential to the art of medicine and patient care [ 1 ]. These short communications generate or enforce hypotheses that may lead to further evaluation in larger study designs [ 2 ]. In providing detailed descriptions of the symptoms, signs, diagnosis, treatment, and follow-up of an individual patient, case reports reflect clinical experience and support medical progress. By design, the format lacks statistical sampling, placing it at the bottom of the hierarchy of clinical evidence. Case reports do not include controls, have limited sample size (one to a few individuals), and are unblinded, limitations that require a cautious approach to interpretation of findings. General medical journals publish case reports sparingly, often only publishing those that provide new information on adverse events that can be linked to an intervention [ 3 , 4 ]. Journal editors may limit inclusion of case reports because they are cited less often than meta-analyses and randomized controlled trials, which negatively affects a journal’s impact factor.

The merits of large randomized studies are well known, but many clinicians recognize the value of case reports as a complement to evidence-based medicine. The case-based nature of clinical practice often is at odds with the population-based nature of research studies, where the findings may have little relevance to an individual patient. Narrow inclusion criteria and the absence of co-morbidities in randomized trials often create a disconnection between typical patient populations and populations represented in research studies [ 3 ]. Case reports provide enough detail on one or a small number of patients for clinicians to relate to their own practice. They are educational and interesting to read. For the challenging and patient-centered task of reporting on individual cases with inherent heterogeneous human variability in clinical research and the goal of applicability to real-life circumstances, the CARE guidelines provide a framework for completeness and transparency in case reports. The guidelines aid in finding the balance between adequate detail and concise writing [ 5 ].

In response to renewed interest and acknowledgment of their value, the number of peer-reviewed journals that publish case reports has increased in recent years to more than 160 [ 6 ]. In the digital era of paperless journals with few space restrictions, the case report has seen a resurgence. The digital format facilitates searches, which is a key factor in their utility [ 7 ]. Most of the case report journals are open access and have high acceptance rates. As the number of new scientific journals increases, so do the number of questionable publishers that mislead researchers regarding fees, peer review, and academic credentials. The process of submitting scientific work for publication now includes the need for thorough vetting of potential publishers.

New case report journals

In line with the growing demand for case report publishing opportunities, the number of new peer-reviewed journals that focus on case reports had increased to more than 160 journals produced by 78 publishers by mid-2015. Figure  1 shows that the number of case report journals increased rapidly beginning in 2007, a timeframe that coincides with the Great Recession of the late 2000s and the concomitant decline in federal and other funding for basic science and other research. Some of the new journals cover general medicine and others cover specific therapeutic areas. Most case report journals (94%) are open access and approximately 40% are indexed in PubMed. Clinical issues covered by case report journals include previously unreported adverse effects of drugs or other treatments, unexpected events that occur in the course of observing or treating a patient, observations on disease pathogenesis, presentations and/or management of new and emerging diseases, new therapeutic approaches, ethical challenges in patient management, and strategies for preventing or overcoming medical errors [ 6 , 8 ].

Number of case report journals by year. The number of journals that publish case reports has increased rapidly since 2007. (Reprinted with permission from Akers [ 6 ])

Open access publishing offers freely available and unrestricted use of research and scholarship, which many researchers see as vital to efficient dissemination of science in the digital world [ 9 ]. The open access model usually requires authors to pay submission and publication fees upon acceptance, typically between US $300 and $1200 [ 6 ]. The move toward making scholarly publications more accessible through open access has continued to gain supporters among the research community. The open access publisher BioMed Central launched in 2000 with 231 articles published that year in 60 journals. In 2015, the numbers increased to more than 30,000 articles in over 290 journals. In 2014, BioMed Central articles were accessed more than 277 million times and had 426,000 citations [ 10 ]. Similarly, the number of publications from the open access publisher PLOS ONE, increased from 138 at its inception in 2006 to 28,107 in 2015 [ 11 ].

Case report journals

Reprinted with permission from Akers [ 6 ]

Controversial journals and publishers

As scientific publishing shifts from a business model of subscription revenue to open access, the number of open access journals has exploded. However, the proliferation of journals that will publish seemingly anything for a fee has caused alarm among many in the global research community. Alongside many respected open access publishers, others have entered the space acting in bad faith. Some see it as the “dark side” of open access, a growing collection of pseudo-academic, prestigiously titled journals, many of which have similar but not quite identical websites and names to those of well-known established journals. Many of the websites look sufficiently impressive that non-experts doing online research have trouble distinguishing credible research from junk. Experienced academics have been misled into submitting manuscripts and even serving on editorial boards for pseudo-academic journals, agreements that often are difficult to undo. Most of these journals do not post their publication fees, and often authors are not informed of fees until after submitting a manuscript. Withdrawal of a manuscript, which is necessary before submitting the same paper to a legitimate journal, may require payment of the high fees first [ 12 ]. For some authors, this means their work may be lost essentially to the disreputable publisher. Many researchers have complained about poorly executed or absent peer review, hidden fees for submission and publication, and unapproved inclusion of researchers’ names on editorial boards.

Jeffrey Beall, a librarian and associate professor at Auraria Library at the University of Colorado, Denver, coined the term “predatory open access publishing” to describe this situation. He is a critic of open access publishing, blaming the system for creating the problem of predatory publishers. His blog Scholarly Open Access, although removed by Beall for unknown reasons in January 2017, closely monitored the increasing number of open access publishers and alerted readers to individuals, publishers, publications, meetings, and scholarly metrics that, in the view of Mr Beall, appeared to exploit the open access model [ 13 ]. He maintained a list of “potential, possible, or probable predatory scholarly open-access publishers” and another list of standalone journals. His criteria for inclusion on the lists were derived from the Code of Conduct for Journal Publishers from the Committee on Publication Ethics (COPE), and Principles of Transparency and Best Practice in Scholarly Publishing from COPE, the Open Access Scholarly Publishers Association (OASPA), and the World Association of Medical Editors [ 14 – 16 ]. Similarly, information in these communications may help authors to discern whether they can trust a particular publisher or journal. The Federal Trade Commission (FTC) in the USA has taken notice of questionable publication practices. In August 2016 it filed a suit against the OMICS Group, a global conglomerate based in India that publishes more than 700 open access journals. The suit claimed that the OMICS Group misled researchers, particularly with regard to their peer-review process (or lack thereof) and high fees that were not readily apparent to authors upon manuscript submission [ 17 ]. The purpose of the lawsuit, according to the FTC, is to better inform authors of publishing fees and to have a more transparent peer-review system [ 18 ]. The case is still to be litigated in federal court in Nevada at the time of writing this article.

The challenge for watchdogs and authors alike is to decide when a publisher is untrustworthy or simply unprofessional. Some publishers may fall under suspicion due to poor copy editing or amateurish website design, but this may not reflect an outright neglect of scholarly standards. It is important not to blacklist startup publishers who lack experience. Another problem with maintaining lists of disreputable publishers is that because copycat journals are often short-lived, the blacklist will continue to grow but individual entries may quickly become obsolete.

Choose the right journal: Think. Check. Submit.

The “Think. Check. Submit.” campaign arose in response to concerns about publishing practices, and the effort is supported by a coalition of scholarly publishing organizations. “Think. Check. Submit.” takes a positive approach to help researchers identify credible journals, providing up-to-date guidance for choosing where to publish [ 18 , 19 ]. To ascertain whether a journal is trusted, authors are advised to follow this checklist:

• Have you read any articles in the journal before?
• Is it easy to discover the latest papers in the journal?
• Is the publisher name clearly displayed on the journal website?
• Can you contact the publisher by telephone, email, and post?
• Does the journal site explain what these fees are for and when they will be charged?
• Have you heard of the editorial board members?
• Do members of the editorial board mention the journal on their own websites?
• Do they belong to the COPE?
• If the journal is open access, is it listed in the Directory of Open Access Journals (DOAJ)?
• If the journal is open access, does the publisher belong to the OASPA?
• Is the publisher a member of another trade association?

In addition to consulting colleagues and academic librarians for journal suggestions, authors have available to them several online resources. BioMed Central previously collaborated with Edanz, a company that assists authors in navigating the publication process, to create the author academy [ 10 ]. The free online guide describes best practices in writing and publishing a manuscript, including sections on choosing a journal, writing the manuscript, and publication ethics, among others. BioMed Central now contracts with Nature Research Editing Services and American Journal Experts, both of which offer similar services [ 20 , 21 ].

Several automated search tools help identify suitable journals as well. Authors insert keywords from their manuscript abstract into a search engine, which then compares the words to many online publications and Edanz Journal Selector covers a broad range of journals. The online tool is free, and Edanz also offers a journal selection service (US $300) in which experts use their publication experience to identify up to four of the best journals for a given paper [ 22 ]. The Journal/Author Name Estimator (Jane) focuses on biomedical science journals by searching the Medline database published by the US National Library of Medicine [ 23 ]. Other online services offered by publishers Springer and Elsevier suggest journals from their own extensive catalogues [ 24 , 25 ].

Impact factor

Journal impact factors, calculated and published by Thomson Reuters, measure the average number of citations per published article for papers published over a 2-year period. Despite the fact that the simple metric can be misleading, the impact factor has become, over time, a marker of journal prestige and desirability. The judgment of a paper’s value is often based more on the journal in which it appears than on its content. Many researchers contend that reliance on impact factors undervalues disciplines or study designs, such as case reports, which have lower citation rates. Overall, the number of citations of an article is commensurate with hierarchies of evidence, with meta-analyses receiving more citations than any other study design. Case reports typically receive few citations, although there are notable exceptions [ 26 ]. The number of citations of an article, however, does not necessarily reflect how widely the article has been read or the dissemination of the findings in mainstream media [ 27 ].

Efforts to embrace a broader view of value in scientific communication, and perhaps diminish the influence of impact factors, have emerged. Journals of the American Society for Microbiology (ASM) no longer advertise impact factors on their websites. Similarly, in recognizing that impact factors are just one of a number of metrics, Nature journals list a suite of citation-based metrics. Only one case report journal, Taylor & Francis’s Neurocase , has received an impact factor (1.124), dating back to 1998.

Medicine/National Institutes of Health Indexed research databases are often curated to ensure the quality of included publications. Clarivate Analytics (formerly Thomson Reuters) offers The Web of Science™, as one such example, and recently introduced the “Emerging Sources Citation Index” to complement their more selective indexes. This collection reflects the growing number of peer-reviewed publications of regional importance and in emerging fields [ 28 ].

In conclusion, the growth in number of case report journals has provided authors multiple avenues for publication but, at the same time, it has introduced a new level of uncertainty in the journal selection process. Factors to consider when choosing a journal are: the topics the journal covers, the target audience, length restrictions, and the time to publication. Open access publications, such as the Journal of Medical Case Reports from BioMed Central, offer high visibility, relatively rapid publication, and transparent publication policies. The reputation of the journal plays an increasingly important part of the decision, requiring thorough vetting of potential journals.

Acknowledgements

We thank the reviewers for their insightful and helpful comments on our editorial.

Authors’ contributions

All authors read and approved the final manuscript.

Competing interests

RAR is a Deputy Editor and MRK is the Editor-in-Chief of Journal of Medical Case Reports . JKS has nothing to disclose.

Publisher’s Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Contributor Information

Richard A. Rison, Email: ude.csu@nosir .

Jennifer Kelly Shepphird, Email: moc.gnitirwskj@nej .

Michael R. Kidd, Email: [email protected] .

• AI Case Study Generator

Generate professional and engaging case studies effortlessly with our free AI Case Study creator. Simplify the process and showcase your success.

• Browse all Apps
• Acronym Generator
• Active to Passive Voice Converter
• AI Answer Generator
• AI Essay Generator
• AI Letter Generator
• AI Product Roadmap Generator
• AI Content & Copy Generator
• Amazon Ad Headline Generator
• Amazon Product Bullet Points Generator
• Amazon Product Title Generator
• Article Rewriter
• Author Bio Generator
• Blog Heading Expander
• Blog Outline Generator
• Blog Ideas Generator
• Blog Insights Generator
• Blog Introduction Generator
• Blog Post Generator‍
• Blog Section Writer
• Blog Title Alternatives Generator
• Blog Title Generator
• Bullet Points Generator
• Bullet Points to Paragraph Generator
• AI Case Study Title Generator
• Checklists Ideas Generator
• Compelling Bullet Points Generator
• Conclusion Generator
• Content Expander
• Content Idea Generator
• Content Readability Improver
• Content Tone Changer
• Courses Ideas Generator
• eBay Ad Headline Generator
• eBay Product Bullet Points Generator
• eBay Product Description Generator
• eBay Product Title Generator
• Ebooks Ideas Generator
• Editorial Calendar Generator
• Essay Title Generator
• Etsy Ad Headline Generator
• Etsy Product Bullet Points Generator
• Etsy Product Description Generator
• Etsy Product Title Generator
• First to Third Person Converter
• Flipkart Ad Headline Generator
• Flipkart Product Bullet Points Generator
• Flipkart Product Description Generator
• Flipkart Product Title Generator
• Headline Generator - 100% Free AI Tool
• Headline Intro Generator
• Hook Generator
• Local Services Description Generator
• Negative Keyword List Generator
• Pain Agitate Solution Generator
• Paragraph Generator
• Paragraph Shredder
• Paraphrasing Tool (Paraphraser)
• Passive to Active Voice Converter
• Personal Bio Generator (Profile Bio)
• Poll Question and Answers Generator
• Post and Caption Ideas Generator
• Product or Service Generator
• Product Review Generator
• Sentence Rewriter
• Subheadings Generator
• AI Summarizing Tool: Summary Generator
• Synopsis Generator
• Text Extender
• Video Marketing Strategy Generator
• Add Emoji to Text
• Amazon Product Description Generator
• Baby Name Generator: Find the Unique Baby Names
• Chat Message Reply Writer
• Course Description Generator
• Course Name Generator
• Email Subject Line Generator
• Email Writer & Generator
• Excel Formula Generator
• FAQs Generator
• Fitness Exercise & Workout Generator
• Grammar Checker
• Image Generator
• Restaurant Review Generator
• Song Lyrics Generator
• Story Plot Generator
• Storyteller | Storymaker
• Text Rewriter
• What to do?
• Facebook Bio Generator
• Facebook Group Post Comment Generator
• Facebook Group Post Generator
• Facebook Hashtag Generator
• Facebook Poll Questions Generator
• Facebook Post Comment Generator
• Facebook Post Generator
• Hacker News Post Comment Generator
• Hacker News Post Generator
• Hashtag Generator
• IndieHackers Post Generator
• IndieHackers Post Comment Generator
• Instagram Bio Generator
• Instagram Caption Generator
• Instagram Hashtag Generator
• Instagram Reels Ideas Generator
• Instagram Reel Script Generator
• Instagram Threads Bio Generator
• Instagram (meta) Threads Generator
• LinkedIn Hashtag Generator
• LinkedIn Poll Questions Generator
• Linkedin Summary Generator
• LinkedIn Experience Description Generator
• Linkedin Headline Generator
• LinkedIn Post Comment Generator
• LinkedIn Post Generator
• LinkedIn Recommendation Generator
• Pinterest Bio Generator
• Pinterest Board Name Generator
• Pinterest Description Generator
• Pinterest Hashtag Generator
• Poem Generator
• Quora Answer Generator
• Quora Questions Generator
• Reddit Post Generator
• Social Media Content Calendar Generator
• TikTok Bio Generator
• TikTok Caption Generator
• TikTok Content Ideas Generator
• TikTok Hashtag Generator
• TikTok Script Generator
• TikTok Ads Generator
• Tweet Generator AI Tool
• Tweet Ideas Generator
• Tweet Reply Generator
• Twitter Bio Generator
• Twitter Hashtag Generator
• Twitter Poll Questions Generator
• Whatsapp Campaign Template
• YouTube Channel Name Generator
• Youtube Hashtag Generator
• Youtube Shorts Ideas Generator
• Youtube Shorts Script Generator
• YouTube Tags Generator
• YouTube Title Generator
• YouTube Video Script Generator
• About Us Page Generator
• Advertisement Script Generator
• Advertising Campaign Generator
• AI Email Newsletter Generator
• AI SWOT Analysis Generator
• AIDA Generator
• Before After Bridge Copy Generator
• Buyer Challenges Generator
• Buyer Persona Generator
• Call to Action Generator
• Content Brief Generator
• Content Calendar Generator
• Digital Marketing Strategy Generator
• Elevator Pitch Generator
• Email Campaign Template
• Podcast Episode Title Generator AI Tool
• Facebook Ads Generator
• Feature Advantage Benefit Generator
• Feature to Benefit Converter
• Glossary Generator
• Go To Market Strategy Generator
• Google Ad Headline Generator
• AI Google Ads Copy Generator
• AI Google Sheets Formula Generator
• Identify Popular Questions
• Landing Page and Website Copies Generator
• Lead Magnet Generator
• LinkedIn Ad Generator
• Listicle Generator
• Marketing Plan Generator
• Marketing Segmentation Generator
• AI Podcast Name Generator Tool
• Podcast Questions Generator
• Customer Persona Generator
• Press Release Ideas Generator
• Press Release Quote Generator
• Press release Writer
• Product Launch Checklist Generator
• Product Name Generator
• AI Q&A Generator
• Questions and Answers Generator
• Reply to Reviews and Messages Generator
• Slide Decks Ideas Generator
• Slideshare presentations Ideas Generator
• SMS Campaign Template
• Survey Question Generator
• Talking Points Generator
• Twitter Ads Generator
• Youtube Channel Description Generator
• Youtube Video Description Generator
• Youtube Video Ideas Generator
• Webinar Title Generator
• Webinars Ideas Generator
• Whitepapers Ideas Generator
• YouTube Video Topic Ideas Generator
• Keyword Research Strategies Generator
• Keywords Extractor
• Keywords Generator
• Long Tail Keyword Generator
• Meta Description Generator
• SEO Meta Title Generator
• Sales & Cold Calling Script Generator
• Content Comparison Generator
• AI Follow-Up Email Generator
• Icebreaker Generator
• LinkedIn Connection Request Generator
• LinkedIn Followup Message Generator
• LinkedIn Inmail Generator
• LinkedIn Message Generator
• Pain Point Generator
• Proposal Generator
• Sales Qualifying Questions Generator
• AI Sales Email Generator
• Sales Pitch Deck Generator
• Voice Message Generator
• Closing Ticket Response Writer
• Request for Testimonial Email Generator
• Support Ticket Auto Reply Writer
• AI Support Ticket Explainer
• Support Ticket Reply Writer
• Ticket Resolution Delay Response Writer
• Billing Reminder Email Writer
• Customer Contract Summarizer
• Customer QBR Presentation Writer
• Business Meeting Summary Generator
• Monthly Product Newsletter Writer
• Product Questions for Customer Generator
• Business Name Generator
• Business idea pitch generator
• Business ideas generator
• Company Slogan Generator
• Core Values Generator
• Domain Name Generator
• Event Description generator
• Event ideas generator
• Metaphor Generator
• Micro SaaS ideas Generator
• Project Plan Generator
• Startup ideas Generator
• Vision and Mission Generator
• Product Description Generator AI Tool
• Product Description with Bullet Points Generator
• SMS and Notifications Generator
• Tagline and Headline Generator
• Testimonial and Review Generator
• Value Prop Generator
• Informative
• Inspirational
• English (US)
• English (UK) Premium
• English (Australia) Premium
• English (Canada) Premium
• English (India) Premium
• English (Singapore) Premium
• English (New Zealand) Premium
• English (South Africa) Premium
• Spanish (Spain) Premium
• Spanish (Mexico) Premium
• Spanish (United States) Premium
• Arabic (Saudi Arabia)
• Arabic (Egypt) Premium
• Arabic (United Arab Emirates) Premium
• Arabic (Kuwait) Premium
• Arabic (Bahrain) Premium
• Arabic (Qatar) Premium
• Arabic (Oman) Premium
• Arabic (Jordan) Premium
• Arabic (Lebanon) Premium
• Danish (Denmark) Premium
• German (Germany)
• German (Switzerland) Premium
• German (Austria) Premium
• French (France)
• French (Canada) Premium
• French (Switzerland) Premium
• French (Belgium) Premium
• Italian (Italy)
• Italian (Switzerland) Premium
• Dutch (Netherlands) Premium
• Dutch (Belgium) Premium
• Russian (Russia)
• Portuguese (Portugal)
• Portuguese (Brazil) Premium
• Chinese (China) Premium
• Chinese (Taiwan) Premium
• Chinese (Hong Kong) Premium
• Chinese (Singapore) Premium
• Korean (South Korea) Premium
• Japanese (Japan)
• Finnish (Finland) Premium
• Greek (Greece) Premium
• Czech (Czech Republic) Premium
• Swedish (Sweden) Premium
• Norwegian (Norway) Premium
• Turkish (Turkey) Premium
• Polish (Poland) Premium
• Romanian (Romania) Premium
• Hungarian (Hungary) Premium
• Thai (Thailand) Premium
• Hebrew (Israel) Premium
• Hindi (India)
• Indonesian (Indonesia) Premium
• Vietnamese (Vietnam) Premium
• Malay (Malaysia) Premium
• Tagalog (Philippines) Premium
• Swahili (Kenya) Premium
• Swahili (Tanzania) Premium
• Zulu (South Africa) Premium
• Xhosa (South Africa) Premium
• Amharic (Ethiopia) Premium
• Tamil (India) Premium
• Tamil (Sri Lanka) Premium
• Bengali (Bangladesh) Premium
• Bengali (India) Premium
• Punjabi (Pakistan) Premium
• Punjabi (India) Premium
• Marathi (India) Premium
• Telugu (India) Premium
• Kannada (India) Premium
• Gujarati (India) Premium
• Oriya (India) Premium
• Malayalam (India) Premium
• Urdu (Pakistan)
• Urdu (India) Premium
• Persian (Iran) Premium
• Azerbaijani (Azerbaijan) Premium
• Ukrainian (Ukraine) Premium
• Belarusian (Belarus) Premium
• Catalan (Spain) Premium
• Basque (Spain) Premium
• Galician (Spain) Premium
• Slovak (Slovakia) Premium
• Lithuanian (Lithuania) Premium
• Latvian (Latvia) Premium
• Estonian (Estonia) Premium
• Bulgarian (Bulgaria) Premium
• Albanian (Albania) Premium
• Croatian (Croatia) Premium
• Slovenian (Slovenia) Premium
• Bosnian (Bosnia and Herzegovina) Premium
• Serbian (Serbia) Premium
• Macedonian (North Macedonia) Premium
• Montenegrin (Montenegro) Premium
• Maltese (Malta) Premium
• Irish (Ireland) Premium
• Welsh (United Kingdom) Premium
• Scots Gaelic (United Kingdom) Premium
• Icelandic (Iceland) Premium
• Luxembourgish (Luxembourg) Premium
• Afrikaans (South Africa) Premium
• Hausa (Nigeria) Premium
• Yoruba (Nigeria) Premium
• Somali (Somalia) Premium
• Tigrinya (Eritrea) Premium
• Kinyarwanda (Rwanda) Premium
• Sesotho (Lesotho) Premium
• Shona (Zimbabwe) Premium
• Sinhala (Sri Lanka) Premium
• Dhivehi (Maldives) Premium
• Burmese (Myanmar) Premium
• Lao (Laos) Premium
• Khmer (Cambodia) Premium
• Mongolian (Mongolia) Premium
• Tibetan (China) Premium
• Uighur (China) Premium
• Pashto (Afghanistan) Premium
• Dari (Afghanistan) Premium
• Nepali (Nepal) Premium
• Dzongkha (Bhutan) Premium
• Sesotho (South Africa) Premium
• Setswana (Botswana) Premium
• Seselwa Creole (Seychelles) Premium
• Mauritian Creole (Mauritius) Premium
• Haitian Creole (Haiti) Premium
• Greenlandic (Greenland) Premium
• Faroese (Faroe Islands) Premium
• Samoan (Samoa) Premium
• Tongan (Tonga) Premium

Popular Writing Apps

This Free AI-Powered Acronym Generator creates unique abbreviations for any word or phrase, enhancing communication and clarity

This Free Active to Passive Voice Converter effortlessly transforms text, improving clarity and enhancing writing structure

This Free AI Answer Generator effortlessly generates answers to any question, providing valuable insights and solutions

LogicBall's Best AI Essay Writer creates high-quality, well-structured, and accurate essays in minutes, providing valuable content and saving time for users

Discover our Free AI Letter Generator for personalized formal or informal letters. Effortlessly craft messages and enhance communication

This Project Plan Generator creates detailed plans, providing you with structured frameworks for your projects efficiently

This Free AI Content & Copy Generator crafts high-quality & unique content and marketing copy, enhancing brand communication effortlessly

This Free AI Amazon Ad Headline Generator instantly creates compelling headlines, maximizing ad impact and driving sales

This AI Amazon Product Bullet Points Generator effortlessly creates compelling bullet points, enhancing product visibility and sales potential.

Case Study Generator

Unlock the power of our case study creator tool—Generate compelling case studies effortlessly with our creator and captivate your audience. With just a few clicks, our smart technology helps you understand data, find trends, and make insightful reports, making your experience better and improving your SEO strategy.

What is a Case Study

A case study is like a detailed story that looks closely at a particular situation, person, or event, especially in the business world. It's a way to understand how things work in real life and learn valuable lessons. For instance, if a business wanted to figure out how another one became successful, they might study that business as a case study.

Let's say there's a small company that started selling handmade products online and became successful. A case study about this business could explain the challenges they faced, the strategies they used to grow, and the results they achieved. By reading this case study, other businesses could learn useful tips and apply them to their situations to improve and succeed.

7 Tips For Writing Great Case Studies

• Pick a Familiar Topic: Choose a client or project that your audience can relate to. This makes it easier for them to see how your solutions might work for their situations.
• Clear Structure: Start with a concise introduction that sets the stage for the case study. Clearly outline the problem, solution, and results to make your case study easy to follow.
• Engaging Storytelling: Turn your case study into a compelling narrative. Use real-world examples, anecdotes, and quotes to make it relatable and interesting for your audience.
• Focus on the Problem: Clearly define the problem or challenge your case study addresses. This helps readers understand the context and sets the foundation for the solution.
• Highlight Solutions: Showcase the strategies or solutions implemented to overcome the problem. Provide details about the process, tools used, and any unique approaches that contributed to the success.
• Optimize for SEO: By incorporating your case study into a blog post using a blog post generator, you enhance its visibility and reach. This, in turn, improves the search engine rankings of your blog post, attracting more organic traffic.
• Quantify Results: Use data and metrics to quantify the impact of your solutions. Whether it's increased revenue, improved efficiency, or customer satisfaction, concrete results add credibility and demonstrate the value of your case study.

What is a Case Study Creator

A free case study generator is a tool or system designed to automatically create detailed case studies. It typically uses predefined templates and may incorporate artificial intelligence (AI) to generate comprehensive analyses of specific situations, events, or individuals.

This tool streamlines the process of crafting informative case studies by extracting key details, analyzing data, and presenting the information in a structured format.

Case study generators are valuable for businesses, students, or professionals seeking to efficiently produce well-organized and insightful case studies without the need for extensive manual effort.

Benefits of Using Case Study Generator

In today's competitive landscape, showcasing your product or service successes is vital. While case studies offer a compelling way to do this, starting from scratch can be time-consuming. That's where case study generators step in, providing a robust solution to streamline the process and unlock various advantages.

• Easy and Quick: A case study generator makes it simple to create detailed studies without spending a lot of time. It's a fast and efficient way to compile information.
• Accessible Online: As an online case study generator, you can use it from anywhere with an internet connection. No need for installations or downloads.
• Free of Cost: Many case study creators are free to use, eliminating the need for any financial investment. This makes it budget-friendly for businesses or individuals.
• AI-Powered Insights: Some generators use AI (artificial intelligence) to analyze data and provide valuable insights. This adds depth and accuracy to your case studies.
• Save Time and Effort: Generate a polished case study in minutes, automating tasks like data analysis and content creation. This frees up your time to focus on other aspects of your business.
• Enhance Quality and Consistency: Case study creators offer templates and AI-powered suggestions, ensuring your studies are well-structured and visually appealing. Consistent quality strengthens your brand image.
• Improve Brand Awareness and Credibility: Sharing case studies on your platforms increases brand awareness and builds trust. Positive impacts on others establish you as a credible provider.
• Boost Lead Generation and Sales: Compelling case studies build trust and showcase your value, attracting leads and converting them into customers, ultimately boosting your sales.
• Increase Customer Engagement and Loyalty: Case studies provide insights into your company, fostering deeper connections, increasing engagement, and promoting long-term loyalty.
• Improve Your Writing Skills: Free AI Case study generators act as learning tools, offering guidance on structure, content, and storytelling. Studying generated drafts refines your writing skills for crafting impactful case studies in the future.

How AI Case Study Generator Works

An online case study generator works by leveraging artificial intelligence algorithms to analyze and synthesize information, creating comprehensive case studies. Here's a simplified explanation of its functioning:

Data Input:

Algorithm analysis:, content generation:, language processing:, who needs a case study creator.

Anyone looking to create informative and detailed case studies can benefit from using an online case study generator. This tool is useful for

Businesses:

Professionals:, individuals:, marketing professionals:, researchers:, why opt for our case study creator.

Are you on the lookout for a top-notch case study generator that combines outstanding features with user-friendliness, all at no cost and without the need for registration? Your search ends here. Our AI-driven case study generator is the ideal solution for you. Here's why you should choose our tool:

Craft Case Study in 50+ Languages:

Incorporate keywords in case study:, user-friendly interface:, 100% free, no registration:, 20+ diverse tones for versatile styles:, how much does your case study creator cost, do i need any writing experience to use a case study generator, what types of case studies can i create with a case study creator, what are some common mistakes people make when creating case studies.

• Not focusing on the benefits to the reader.
• Not using data and results to support their claims.
• Not telling a compelling story.
• Not using visuals effectively.
• Not promoting their case study.

Can I customize the generated case study?

Is the generated content unique.

• International edition
• Australia edition
• Europe edition

Prostate cancer cases worldwide likely to double by 2040, analysis finds

Largest study of its kind predicts 85% increase in deaths from the disease in same period as more men live longer

The number of men diagnosed with prostate cancer worldwide is projected to double to 2.9 million a year by 2040, with annual deaths predicted to rise by 85%, according to the largest study of its kind.

Prostate cancer is already a major cause of death and disability, and the most common form of male cancer in more than 100 countries. But with populations ageing and life expectancy rising globally, a new analysis forecasts a dramatic surge in cases and deaths over the next 15 years.

Diagnoses are projected to increase from 1.4m a year in 2020 to 2.9m by 2040, which will mean about 330 men being told they have the disease every hour.

The number of deaths worldwide is predicted to rise by 85% over the 20-year period, from 375,000 in 2020 to almost 700,000 by 2040. The true death toll will probably be higher, experts say, because of underdiagnosis and missing data in low- and middle-income countries.

The findings were published in the Lancet as part of its landmark commission on prostate cancer, and will be presented at the European Association of Urology’s annual congress in Paris on Saturday.

Ageing populations and increasing life expectancy mean the number of older men worldwide who are living for longer is rising. As the main risk factors for prostate cancer – such as being 50 or older and having a family history of the disease – are unavoidable, experts say it will be impossible to prevent the surge in cases simply via lifestyle changes or public health interventions.

However, wider awareness of the symptoms of the disease, access to testing initiatives, earlier diagnosis, and advances in treatments could still help reduce the burden and save lives, according to the authors of the 40-page report.

“As more and more men around the world live to middle and old age, there will be an inevitable rise in the number of prostate cancer cases,” said Prof Nick James, the lead author of the study. “We know this surge in cases is coming, so we need to start planning and take action now.”

“Evidence-based interventions, such as improved early detection and education programmes, will help to save lives and prevent ill health from prostate cancer in the years to come,” added James, a professor of prostate cancer research at the Institute of Cancer Research, London, and a consultant clinical oncologist at the Royal Marsden NHS foundation trust.

James said there was a global need for new and improved ways to test for the disease, to reduce overdiagnosis and overtreatment while detecting potentially lethal tumours earlier.

Boosting knowledge among men and their families of signs to look for was also key, according to the report.

Symptoms of prostate cancer can include needing to urinate more frequently, often during the night; needing to rush to the toilet; difficulty in starting to pee; feeling that your bladder has not emptied fully, and blood in your urine or semen.

These symptoms do not always mean you have prostate cancer. Many men’s prostates become larger as they get older because of a condition called benign prostate enlargement. Signs that prostate cancer may have spread include testicle, back or bone pain, a loss of appetite, and unintentional weight loss.

The study also highlighted the need for more research to better understand prostate cancer in black men, as most research has focused on white men.

Alfred Samuels was 54 when he learned he had advanced prostate cancer in 2012. He had worked in the entertainment industry for three decades, providing security for celebrities including Beyoncé and Bob Dylan – but the shock diagnosis ended his career overnight. Doctors ruled out surgery when tests showed his cancer had spread, and the father of six started to lose hope.

However, he then joined a clinical trial and began treatment with a drug that is now extending the lives of thousands of men worldwide. Twelve years later, Samuels, from Harrow in north-west London, has welcomed six grandchildren to the world and pivoted to a second career raising awareness of cancer research.

“Due to the late stage that my prostate cancer was diagnosed, I wouldn’t be here today if I hadn’t been able to access a clinical trial. It was my lifeline,” said Samuels, now 66. “This report has been a long time coming. Now it needs to be mandatory to record ethnicity in clinical trials, and trials must reflect the ethnic diversity of the population, so that we can find better treatments for people like me.”

Amy Rylance, the head of improving care at the charity Prostate Cancer UK, said the Lancet report was a “a timely call to action”. She added that healthcare systems must do better at recognising those at highest risk: black men and men with a family history of prostate cancer or genetic risk factors such as BRCA variations .

• Prostate cancer
• Cancer research
• Medical research
• Men's health

More on this story

Study offers hope in identifying high-risk prostate cancer patients

Getting fitter can reduce prostate cancer risk by 35%, study finds

New prostate cancer treatment may be ‘on the horizon’, say scientists

Lock, Stock and Two Smoking Barrels actor Jake Abraham dies aged 56

Radiotherapy doses for prostate cancer could be cut by three-quarters, trial finds

BBC presenter Nick Owen announces prostate cancer diagnosis

UK prostate cancer screening programme ‘could be running in three years’

Thousands of UK men to benefit after NHS approves prostate cancer drug

Scientists launch search for genetic test to spot killer prostate cancer

Most viewed.

More than 1 in 8 mothers report being mistreated during childbirth, study says

(CNN) - About 13% of new mothers say they were mistreated by medical staff during childbirth.

A new study shows more than 1 out of 8 new mothers are shouted at, scolded or ignored by a healthcare provider during their deliveries.

Some new mothers said they were denied treatment, according to the publication Jama Open Network. Others said their healthcare provider forced them to undergo treatment that they didn’t want.

Researchers also reported higher rates of mistreatment among Black and multiracial individuals.

The experiences of more than 4,400 post-partum mothers were used for the study.

Copyright 2024 CNN Newsource. All rights reserved.

Update in the case of a missing Grant Parish man

Bill to increase state minimum wage introduced to La. Senate

Spring ‘Herb Day’ at Kent House draws large crowd

Rapides Parish schools prepare for solar eclipse

Buy groceries at Walmart recently? You could get up to $500 as part of a class action settlement

Latest news.

Morgan Wallen arrested for allegedly throwing chair off of roof

Israel, Gaza becomes a political obstacle for Biden

Vatican blasts sex change surgery, surrogacy and gender theory as grave threats to human dignity

Biden will talk about student debt relief in Wisconsin after primary voting delivered warning signs

UConn, Purdue set to collide in NCAA title game after dominating March Madness

Portal login

ASD Cyber Threat Report 2022-2023

This rating relates to the complexity of the advice and information provided on the page.

Content written for

Attachments.

• ASD's Cyber Threat Report 2022-2023 7.67MB .pdf
• Fact Sheets - Businesses & Organisations - 2022-2023 190KB .pdf
• Fact sheets - Critical Infrastructure - 2022-2023 172KB .pdf
• Fact Sheets - Individuals - 2022-2023 173KB .pdf

I am pleased to present the Annual Cyber Threat Report 2022–23 developed by the Australian Signals Directorate (ASD).

As the Defence Strategic Review made clear, in the post-Second World War period Australia was protected by its geography and the limited ability of other nations in the region to project combat power. In the current strategic era, Australia’s geographic advantages have been eroded as more countries have enhanced their ability to project combat power across greater ranges, including through the rapid development of cyber capabilities. 

Australia’s region, the Indo-Pacific, is also now seeing growing competition on multiple levels – economic, military, strategic and diplomatic – framed by competing values and narratives. 

In this context, Australian governments, critical infrastructure, businesses and households continue to be the target of malicious cyber actors. This report illustrates that both state and non-state actors continue to show the intent and capability to compromise Australia’s networks. It also highlights the added complexity posed by emerging technologies such as artificial intelligence.

The report demonstrates the persistent threat that state cyber capabilities pose to Australia. This threat extends beyond cyber espionage campaigns to disruptive activities against Australia’s essential services. The report also confirms that the borderless and multi-billion dollar cybercrime industry continues to cause significant harm to Australia, with Australians remaining an attractive target for cybercriminal syndicates around the world.

Through case studies, the report demonstrates the persistence and tenacity of these cyber actors. It shows that these adversaries constantly test vulnerabilities in Australia’s cyber ecosystem and employ a range of techniques to evade Australia’s cyber defences.

The threat environment characterised in this report underscores the importance of ASD’s work in defending Australia’s security and prosperity. It also reinforces the significance of the Australian Government’s investment in ASD’s cyber and intelligence capabilities under Project REDSPICE (Resilience, Effects, Defence, Space, Intelligence, Cyber, Enablers).

It is clear we must maintain an enduring focus on cyber security in Australia. The Australian Government is committed to leading our nation’s efforts to bolster our cyber resilience. 

We also know that the best cyber defences are founded on genuine partnerships between and across the public and private sectors. The development of this report, which draws on insights from across the Commonwealth Government, our international partners, Australian industry and the community, is a testament to this collaboration.

This report presents a clear picture of the cyber threat landscape we face and is a vital part of Australia’s collective efforts to enhance our cyber resilience.

The Hon Richard Marles, MP Deputy Prime Minister and Minister for Defence

About ASD’s ACSC

ASD’s Australian Cyber Security Centre (ACSC) is the Australian Government’s technical authority on cyber security. The ACSC brings together capabilities to improve Australia’s national cyber resilience and its services include:

• the Australian Cyber Security Hotline, which is contactable 24 hours a day, 7 days a week, via 1300 CYBER1 (1300 292 371)
• publishing alerts, technical advice, advisories and notifications on significant cyber security threats
• cyber threat monitoring and intelligence sharing with partners, including through the Cyber Threat Intelligence Sharing (CTIS) platform
• helping Australian entities respond to cyber security incidents
• exercises and uplift activities to enhance the cyber security resilience of Australian entities
• supporting collaboration between over 110,000 Australian organisations and individuals on cyber security issues through ASD’s Cyber Security Partnership Program.

The most effective cyber security is collaborative and partnerships are key to this work. ASD thanks all of the organisations that contributed to this report. This includes Australian local, state, territory and federal government agencies, and industry partners.

Executive summary

Malicious cyber activity continued to pose a risk to Australia’s security and prosperity in the FY 2022-23. A range of malicious cyber actors showed the intent and capability needed to compromise vital systems, and Australian networks were regularly targeted by both opportunistic and more deliberate malicious cyber activity.

ASD responded to over 1,100 cyber security incidents from Australian entities. Separately, nearly 94,000 reports were made to law enforcement through ReportCyber – around one every 6 minutes.

ASD identified a number of key cyber security trends in FY 2022–23:

State actors focused on critical infrastructure – data theft and disruption of business.

Globally, government and critical infrastructure networks were targeted by state cyber actors as part of ongoing information-gathering campaigns or disruption activities. The AUKUS partnership, with its focus on nuclear submarines and other advanced military capabilities, is likely a target for state actors looking to steal intellectual property for their own military programs. Cyber operations are increasingly the preferred vector for state actors to conduct espionage and foreign interference.

In 2022–23, ASD joined international partners to call out Russia’s Federal Security Service’s use of ‘Snake’ malware for cyber espionage, and also highlighted activity associated with a People’s Republic of China state-sponsored cyber actor that used ‘living-off-the-land’ techniques to compromise critical infrastructure organisations.

Australian critical infrastructure was targeted via increasingly interconnected systems .

Operational technology connected to the internet and into corporate networks has provided opportunities for malicious cyber actors to attack these systems. In 2022–23, ASD responded to 143 cyber security incidents related to critical infrastructure.

Cybercriminals continued to adapt tactics to extract maximum payment from victims. 

Cybercriminals constantly evolved their operations against Australian organisations, fuelled by a global industry of access brokers and extortionists. ASD responded to 127 extortion-related incidents: 118 of these incidents involved ransomware or other forms of restriction to systems, files or accounts. Business email compromise remained a key vector to conduct cybercrime. Ransomware also remained a highly destructive cybercrime type, as did hacktivists’ denial-of-service attacks, impacting organisations’ business operations.

Data breaches impacted many Australians .

Significant data breaches resulted in millions of Australians having their information stolen and leaked on the dark web.

One in 5 critical vulnerabilities was exploited within 48 hours.

This was despite patching or mitigation advice being available. Malicious cyber actors used these critical flaws to cause significant incidents and compromise networks, aided by inadequate patching.

Cyber security is increasingly challenged by complex ICT supply chains and advances in fields such as artificial intelligence. To boost cyber security, Australia must consider not only technical controls such as ASD’s Essential Eight, but also growing a positive cyber-secure culture across business and the community. This includes prioritising secure-by-design and secure-by-default products during both development (vendors) and procurement (customers).

ASD’s first year of REDSPICE increased cyber threat intelligence sharing, the uplift of critical infrastructure, and an enhanced 24/7 national incident response capability.

Genuine partnerships across both the public and private sectors have remained essential to Australia’s cyber resilience; and ASD’s Cyber Security Partnership Program has grown to include over 110,000 organisations and individuals.

Year in review

What asd saw.

Average cost of cybercrime per report, up 14 per cent

• small business: $46,000
• medium business: $97,200
• large business: $71,600.

Nearly 94,000 cybercrime reports, up 23 per cent

• on average a report every 6 minutes
• an increase from 1 report every 7 minutes.

Answered over 33,000 calls to the Australian Cyber Security Hotline, up 32 per cent

• on average 90 calls per day
• an increase from 69 calls per day.

Top 3 cybercrime types for individuals

• identity fraud
• online banking fraud
• online shopping fraud.

Top 3 cybercrime types for business

• email compromise
• business email compromise (BEC) fraud
• online banking fraud.

Publicly reported common vulnerabilities and exposures (CVEs) increased 20 per cent.

What ASD did

• Responded to over 1,100 cyber security incidents , similar to last year.
• 10 per cent of all incidents responded to included  ransomware , similar to last year.
• Notified 158 entities of ransomware activity on their networks, compared to 148 last year, roughly a  7 per cent increase.
• Australian Protective Domain Name System blocked over 67 million malicious domain requests, up 176 per cent.
• Domain Takedown Service  blocked over 127,000 attacks against Australian servers, up 336 per cent.
• Cyber Threat Intelligence Sharing partners  grew by 688 per cent  to over 250 partners.
• issued 103 High-priority Operational Taskings, up 110 per cent
• distributed around 4,900 reports to approximately 1,360 organisations, up 16 per cent and 32 per cent respectively.
• 3 CI-UPs completed covering 6 CI assets
• 3 CI-UPs in progress
• 20 CI-UP Info Packs sent
• 5 CI-UP workshops held.
• Notified 7 critical infrastructure entities of suspicious cyber activity , up from 5 last year.
• Published or updated 34 PROTECT  and Information Security Manual (ISM)   guidance publications .
• Published 64 alerts, advisories, incident and insight reports  on cyber.gov.au and the Partnership Portal.
• Individual Partners up 24 per cent
• Business Partners up 37 per cent
• Network Partners up 29 per cent.
• Led 20 cyber security exercises  involving over 75 organisations  to strengthen Australia’s cyber resilience.
• Briefed board members and company directors covering 33 per cent of the ASX200.

ASD is able to build a national cyber threat picture, in part due to the timely and rich reporting of cyber security incidents by members of the public and Australian business. This aggregation of cyber security incident data enables ASD to inform threat mitigation advice with the latest trends and threats posed by malicious cyber actors. Any degradation in the quantity or quality of information reported to ASD harms cyber security outcomes. Information reported to ASD is anonymised prior to it being communicated to the community.

ASD categorises each incident it responds to on a scale of Category 1 (C1), the most severe, to Category 6 (C6), the least severe. Incidents are categorised on severity of effect, extent of compromise, and significance of the organisation.

The number of C2 incidents rose from 2 in FY 2021–22 to 5 in FY 2022–23. This includes significant data breaches involving cybercriminals exfiltrating data from critical infrastructure for the purposes of financial gain.

Cyber security incidents are consistent with last financial year, with around 15 per cent of all incidents being categorised C3 or above. Of the C3 incidents, over 30 per cent related to organisations self-identifying as critical infrastructure, with transport (21 per cent), energy (17 per cent), and higher education and research (17 per cent) the most affected sectors.

The most common C3 incident type was compromised assets, network or infrastructure (23 per cent), followed by data breaches (19 per cent) and ransomware (14 per cent). Common activities leading to C3 incidents included exploitation of public–facing applications (20 per cent) and phishing (17 per cent).

Almost a quarter (24 per cent) of C3 incidents involved a tipper, where ASD notified the affected organisations of suspicious activity.

While reports of low-level malicious attacks are often categorised as unsuccessful, reports of unsuccessful activity are still indicative of continual targeting of Australian entities.

Cyber security incidents by sector

Compared to 2021–22, the information media and telecommunications sector fell out of the top 5 reporting sectors.

Government sectors and regulated critical infrastructure have reporting obligations, which may explain the relatively high reporting rate for these sectors compared with others.

ASD categorises sectors following the Australian and New Zealand Standard Industrial Classification (ANZSIC) Divisions from the Australian Bureau of Statistics. The public safety and administration division encompasses several sectors including federal, state, territory and local governments, public order and safety services, and Defence.

Table 3 : The top 10 reporting sectors

Chapter 1: Exploitation

• Half of vulnerabilities were exploited within 2 weeks of a patch, or of mitigation advice being released, highlighting the risks entities take by not promptly patching.
• Patching vulnerabilities in internet-facing services should occur within 2 weeks, or 48 hours if an exploit exists.
• Vulnerable internet-facing devices and applications are convenient targets for malicious cyber actors. In addition to patching, unnecessary internet-facing services should be disabled.

Vulnerable and exposed

As Australians integrate more technology into their lives and businesses, the number of possible weak points or vectors for malicious cyber actors to exploit – known as the attack surface – grows. The larger the attack surface, the harder it is to defend. Malicious cyber actors often exploit security weaknesses found in ICT, known as common vulnerabilities and exposures (CVEs), to break into systems, steal data, or even take complete control over a system.

The number of published CVEs has been steadily on the rise. The US National Vulnerability Database published 19,379 CVEs in FY 2020–21, 24,266 CVEs in FY 2021–22, and 29,019 CVEs in FY 2022–23.

To identify the rates at which CVEs were exploited after a patch or mitigation was made available, ASD analysed 60 CVEs covering 1 July 2020 to 28 February 2023. The analysis found around 82 per cent of vulnerabilities had an attack vector of ‘network’ under the Common Vulnerability Scoring Scheme. This indicates that malicious actors prefer vulnerabilities that are remotely exploitable and are present on internet-facing or edge devices. Exploitation of these vulnerabilities allows malicious actors to pivot into internal networks. The analysis also found:

• 1 in 5 vulnerabilities was exploited within 48 hours of a patch or mitigation advice being released
• half of the vulnerabilities were exploited within 2 weeks of a patch or mitigation advice being released
• 2 in 5 vulnerabilities were exploited more than one month after a patch or mitigation advice was released.

Despite more than 90 per cent of CVEs having a patch or mitigation advice available within 2 weeks of public disclosure, 50 per cent of the CVEs were still exploited more than 2 weeks after that patch or mitigation advice was published. This highlights the risk entities carry when not patching promptly. These risks are heightened when a proof-of-concept code is available and shared online, as malicious cyber actors can leverage this code for use in automated tools, lowering the barrier for exploitation.

ASD observed that Log4Shell (CVE-2021-44228) and ProxyLogon (CVE-2021-26855) were by far the most commonly exploited vulnerabilities throughout the analysis period, with these 2 vulnerabilities representing 29 per cent of all CVE-related incidents.

CVEs do not have an expiration date. In one instance, ASD observed that malicious cyber actors successfully exploited an unpatched 7-year-old CVE. Additionally, ASD still receives periodic reports of WannaCry malware – 6 years after its release – which is likely due to old, infected legacy machines being powered on and connected to networks. Incidents like this highlight the importance of patching as soon as possible, and also demonstrate the long tail of risks that unpatched and legacy systems can pose to entities.

During 2022–23, ASD published many alerts warning Australians of vulnerabilities, such as the critical remote code execution vulnerability in Fortinet devices (CVE-2022-40684), and a high-severity vulnerability present in Microsoft Outlook for Windows (CVE-2023-23397). ASD also published a joint Five-Eyes advisory detailing the top 12 CVEs most frequently and routinely exploited by malicious cyber actors for the 2022 calendar year.

To help mitigate vulnerabilities, ASD recommends all entities patch, update or otherwise mitigate vulnerabilities in online services and internet-facing devices within 48 hours when vulnerabilities are assessed as critical by vendors or when working exploits exist. Otherwise, vulnerabilities should be patched, updated or otherwise mitigated within 2 weeks. Entities with limited cyber security expertise who are unable to patch rapidly should consider using a reputable cloud service provider or managed service provider that can help ensure timely patching.

ASD acknowledges not all entities may be able to immediately patch, update or apply mitigations for vulnerabilities due to high-availability business requirements or system limitations. In such cases, entities should consider compensating controls like disabling unnecessary internet-facing services, strengthening access controls, enforcing network separation, and closely monitoring systems for anomalous activity. Entities should ensure decision makers understand the level of risk they hold and the potential consequences should their systems or data be compromised as a result of a malicious actor exploiting unmitigated vulnerabilities.

Further patching advice can be found in ASD’s Assessing Vulnerabilities and Applying Patches guide.

Cyber hygiene

In addition to patching, effective cyber security hygiene is vital. At cyber.gov.au, ASD has published a range of easy-to-understand advice and guides tailored for individuals, small and medium business, enterprises, and critical infrastructure providers.

All Australians should:

• enable multi-factor authentication (MFA) for online services where available
• use long, unique passphrases for every account if MFA is not available, particularly for services like email and banking (password managers can assist with such activities)
• turn on automatic updates for all software – do not ignore installation prompts
• regularly back up important files and device configuration settings
• be alert for phishing messages and scams
• sign up for the ASD’s free Alert Service
• report cybercrime to ReportCyber.

Australian organisations should also:

• only use reputable cloud service providers and managed service providers that implement appropriate cyber security measures
• regularly test cyber security detection, incident response, business continuity and disaster recovery plans
• review the cyber security posture of remote workers, including their use of communication, collaboration and business productivity software
• train staff on cyber security matters, in particular how to recognise scams and phishing attempts
• implement relevant guidance from ASD’s Essential Eight Maturity Model, Strategies to Mitigate Cyber Security Incidents and Information Security Manual
• join ASD’s Cyber Security Partnership Program
• report cybercrime and cyber security incidents to ReportCyber.

Case study 1: Malicious cyber actors exploit devices 2 years after patch

On 24 May 2019, Fortinet, a US vendor that creates cyber security products, released a security advisory and accompanying patch for CVE-2018-13379, which was a severe vulnerability that required immediate patching.

On 2 April 2021, the US Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory on the exploitation of Fortinet FortiOS vulnerabilities, which indicated advanced persistent threat (APT) groups were scanning devices for CVE-2018-13379 and likely to gain access to multiple government, commercial, and technology services networks.

On 3 April 2021, ASD released an alert reminding organisations that APT groups had been observed exploiting CVE-2018-13379. Later, in September 2021, ASD received a report of a successful exploitation of CVE-2018-13379 against an Australian entity. Despite being vulnerable for more than 2 years, the victim’s device had not been patched.

While it is difficult to ascertain how widely Fortinet devices are used globally, researchers identified around 50,000 targets that remained vulnerable 2 years after the patch was released. This number is so significant that it was added to CISA’s Top Routinely Exploited Vulnerabilities list.

The primary mitigation against these attacks is to patch vulnerabilities as soon as possible. If patching is not immediately possible, the entity should consider removing internet access from Fortinet devices until other mitigations can be implemented.

Case study 2: A network compromise at the Shire of Serpentine Jarrahdale

The rural Shire of Serpentine Jarrahdale, 45 kilometres from the Perth CBD, may seem an unlikely place for malicious cyber activity to unfold. But, in early 2023, the Shire experienced a network compromise. Shire ICT Manager Matthew Younger said the malicious cyber actor took advantage of a public-facing system. ‘We’re quite diligent with our patching, but unfortunately we missed an update to our remote work server,’ Mr Younger said.

Before taking immediate remediation action, the Shire’s ICT team held a conference call with ASD to discuss the best way to manage the compromise, and Mr Younger said ASD’s help was first-class. ‘We put a perimeter around the compromised server, checked for lateral movement, and gathered evidence to work out what happened. Everything we found led back to the importance of the Essential Eight.’

ASD also sent an incident responder to help the Shire’s ICT team capture virtual machine snapshots and log data. ASD handles incident data with strict confidentiality, and such data helps its analysts understand how cyber security incidents occur and produces intelligence to help build the national cyber threat picture and to prevent further attacks.

Mr Younger said that after the compromise, the Shire doubled-down on its efforts to implement ASD’s Essential Eight. ‘We enforced passphrases, we improved our information security policies, and we improved our user security training. We also validated our controls through penetration testing and phishing exercises.’

Mr Younger credits much of the Shire’s success to its agile leadership who, with limited resources, foster the right security culture to both respond to cyber threats and implement mitigations.

CVE-2020-5902

BIG-IP refers to a suite of products from cyber security vendor F5, which includes firewall and application delivery solutions. On 1 July 2020, F5 released a security advisory detailing a critical vulnerability in their BIG-IP Traffic Management User Interface (TMUI). Within 48 hours of patch release, security researchers discovered malicious cyber actors scanning for and exploiting unpatched devices.

The Essential Eight

ASD’s Essential Eight are some of the most effective cyber security mitigation strategies, and includes:

ASD uses its cyber threat intelligence to ensure its cyber security advice is contemporary and actionable. ASD’s advice is not formed in a silo. Feedback from partners across government and industry, such as how cyber security mitigations are implemented within organisations, is important. Feedback helps ASD update advice like the Essential Eight.

More information on the Essential Eight, including the Essential Eight Assessment Process Guide and Essential Eight Maturity Model Frequently Asked Questions , can be found at cyber.gov.au.

Chapter 2: Critical infrastructure

• During FY 2022–23, Australian critical infrastructure networks regularly experienced both targeted and opportunistic malicious cyber activity. Activity against these networks is likely to increase as networks grow in size and complexity.
• Malicious cyber actors can steal or encrypt data, or gain insider knowledge for profit or competitive advantage. Some actors may attempt to degrade or disrupt services and these incidents can have cascading impacts.
• Designing robust cyber security measures for operational technology environments is vital to protect the safety, availability, integrity and confidentiality of essential services. Secure-by-design and secure‑by-default products should be a priority.

Actors target critical infrastructure for many reasons

Critical infrastructure assets and networks are attractive targets for malicious cyber activity as these assets need to hold sensitive information, maintain essential services, and often have high levels of connectivity with other organisations and critical infrastructure sectors.

A cyber incident can result in a range of impacts to critical services. For instance, the disruption of an electricity grid could cause a region to lose power. Without power, a hospital may lose access to patient records and struggle to function, internet services may be down and affect communications and payment systems, or water supply could be impacted.

Globally, a broad range of malicious cyber actors, including state actors, cybercriminals and issue‑motivated groups, have demonstrated the intent and the capability to target critical infrastructure. Malicious cyber actors may target critical infrastructure for a range of reasons. For example, they may:

• attempt to degrade or disrupt services, such as through denial-of-service (DoS) attacks, which can have a significant impact on service providers and their customers
• steal or encrypt data or gain insider knowledge for profit or competitive advantage
• preposition themselves on systems by installing malware, in anticipation of future disruptive or destructive cyber operations, potentially years in advance
• covertly seek sensitive information through cyber espionage to advance strategic aims.

Critical infrastructure can be targeted by the mass scanning of networks for both old and new vulnerabilities. In February 2023, an Italian energy and water provider was affected by ransomware. While there was no indication the water or energy supply was affected, it reportedly took 4 days to restore systems like information databases. Italy’s National Cybersecurity Agency publicly noted the ransomware attack targeted older and unpatched software, exploiting a 2-year-old vulnerability.

Critical infrastructure is a target globally

During 2022–23, critical infrastructure networks around the world continued to be targeted, causing impacts on network operators and those relying on critical services. In the latter half of 2022, the French health system reportedly sustained a number of cyber incidents. One hospital fell victim to a ransomware incident, resulting in the cancellation of some surgical operations and forcing patients to be transferred to other hospitals. The hospital’s computer systems had to be shut down to isolate the attack.

Russia’s war on Ukraine has continued to demonstrate that critical infrastructure is viewed as a target for disruptive and destructive cyber operations during times of conflict. Malicious cyber actors have targeted and disrupted hospitals, airports, railways, telecommunication providers, energy utilities, and financial institutions across Europe. Destructive malware was also used against critical infrastructure in Ukraine.

In September 2022 and May 2023, ASD and its international partners published advisories highlighting that state actors were targeting multiple US critical infrastructure sectors, and strongly encouraged Australian entities to review their networks for signs of malicious activity. More details about these advisories is in the state actor chapter .

Australian critical infrastructure is impacted

Australian critical infrastructure networks regularly experienced both targeted and opportunistic malicious cyber activity. During 2022–23, ASD responded to 143 incidents reported by entities who self-identified as critical infrastructure, an increase from the 95 incidents reported in 2021–22. The vast majority of these incidents were low-level malicious attacks or isolated compromises.

The main cyber security incident types affecting Australian critical infrastructure were:

• compromised account or credentials
• compromised asset, network or infrastructure

These incident types accounted for approximately 57 per cent of the incidents affecting critical infrastructure for 2022–23. Other more prominent incident types were data breaches followed by malware infection.

ASD encourages critical infrastructure entities to report anomalous activity early and not wait until malicious activity reaches the threshold for a mandatory report. Reporting helps piece together a picture of the cyber threat landscape, and informs ASD’s cyber security alerts and advisories for the benefit of all Australian entities.

Critical infrastructure networks have a broad attack surface

The interconnected nature of critical infrastructure networks, and the third parties in their ICT supply chain, increases the attack surface for many entities. This includes remote access and management solutions, which are increasingly present in critical infrastructure networks.

Operational technology (OT) and connected systems, including corporate networks, will likely be of enduring interest to malicious cyber actors. OT can be targeted to access a corporate network and vice versa, potentially allowing malicious cyber actors to move laterally through systems to reach their target. Even when OT is not directly targeted, attacks on connected corporate networks can disrupt the operation of critical infrastructure providers.

Systems where software or hardware are not up to date with the latest security mitigations are vulnerable to exploitation, particularly when these systems are exposed to the internet. ICT supply chain and managed service providers are another avenue malicious cyber actors can exploit.

Explainer 1: Operational technology

OT makes up those systems that detect or cause a direct change to the physical environment through the monitoring or control of devices, processes, and events. OT is predominantly used to describe industrial control systems (ICS), which include supervisory control and data acquisition (SCADA) systems and distributed control systems (DCS).

Australian critical infrastructure providers often operate over large geographical areas and require interconnection between dispersed OT environments. Separately, remote access to OT environments from corporate IT environments and the internet has become standard operating procedure. Remote access allows engineers and technicians to remotely manage and configure the OT environment. However, this interconnection or remote access requires an internet connection, which creates additional cyber security risks to OT environments.

In April 2023, irrigation systems in Israel were reportedly disrupted when the ICS supporting the automated water controllers were compromised. Israel’s National Cyber Organisation was able to warn many farmers to disconnect their remote control option for the irrigation systems, so the disruption was minimal. Being able to disconnect from remote control also highlights the value of a manual override mechanism in some instances.

Next-generation OT is expected to contain built-in remote access and security features, which could address some of the issues related to remote access and internet exposure. ASD continues to advise entities to prioritise secure-by-design and secure-by-default products in procurements, and take a risk-based approach to managing risks associated with new technologies or providers. Good cyber security practices will be particularly important during a transition to new technologies.

At cyber.gov.au, ASD has published a range of cyber security guides for OT and ICS, and also principles and approaches to secure-by-design and default.

In focus: food and grocery sector

The food and grocery sector covers a broad supply chain including processing, packaging, importing, and distributing food and groceries. Food and grocery manufacturing is Australia’s largest manufacturing sector, comprising over 16,000 businesses and representing around 32 per cent of all manufacturing jobs. Food and grocery organisations are an attractive target for malicious cyber actors as this sector’s provision of essential supplies has little tolerance for disruption.

The sector’s complex supply chains and growing online sales mean food and grocery organisations have a large attack surface. The sector is increasingly reliant on smart technologies, industrial control systems, and internet-based automation systems. Additionally, many entities in this sector hold sensitive data that may be of value to malicious cyber actors, such as personal information or intellectual property.

Like other manufacturing entities, food and grocery organisations have increasingly adopted just-in-time inventory and delivery chains in pursuit of greater efficiency and reduced waste. This means the food and grocery sector is also vulnerable if a supplier is affected by a cyber incident that disrupts services.

Large entities in this sector may be targeted based on the view that they can be extorted for large sums of money. Smaller entities may be perceived as having lower cyber security maturity, and may be used to access more lucrative targets in their supply chain. Malicious cyber actors may seek to remain undetected on systems to establish a secure foothold and then move to other systems within a business to exfiltrate data or maintain a presence for future malicious activity.

A cyberattack against entities in this sector could have significant impacts for both the victim organisation and its customers. For example, a ransomware attack that locks systems could halt production and delivery, rendering a business unable to fulfil its orders. The second order impacts of this could be costly – including lost revenue, or lost confidence from business partners and customers alike.

Early detection of malicious activity is vital for mitigating cyber threats. It can take time to discover a compromised network or system, so robust and regular monitoring is essential. Likewise, practised incident response plans and playbooks should form part of broader corporate and cyber plans to aid remediation and minimise the impact of a compromise. Entities in this sector should seek secure-by-design and secure‑by-default products wherever possible to boost their cyber security posture.

A comprehensive list of resources for critical infrastructure is available at cyber.gov.au, including guidance for cyber incident response and business continuity plans.

Case study 3: Global food distributor held to ransom

In February 2023, Dole – one of the world’s largest producers and distributors of fruit and vegetables – was a victim of a ransomware incident, resulting in a shut down of its systems throughout North America. Other reported impacts included some product shortages, a limited impact on operations, and theft of company data – including some employee information. While Dole acted swiftly to minimise the impacts of the incident, it still reported USD $10.5 million in direct costs, and faced reputational damage.

Explainer 2: Effective separation

Separating network segments can help to isolate critical network elements from the internet or other less sensitive parts of a network. This strategy can make it significantly more difficult for malicious cyber actors to access an organisation’s most sensitive data, and can aid cyber threat detection.

In 2022–23, ASD observed that effective separation through network segmentation and firewall policies prevented malware from impacting an Australian critical infrastructure provider. Additionally, through effective separation an Australian critical infrastructure provider prevented the deployment of malware from a contractor’s USB drive onto their OT environment.

Network separation is more than just a logical or physical design decision: it should also consider where system administration and management services are placed. Often, the corporate IT network is separated from the OT environment, because the corporate IT network is usually seen as having a higher risk of compromise due to its internet connectivity and services like email and web browsing.

However, if a malicious cyber actor compromises the corporate IT network and gains greater access privileges, then the corporate IT firewall may no longer provide the desired level of protection for the OT environment. This similarly applies if the Active Directory (AD) Domain for the OT environment is inside an AD Forest administered from the corporate IT network.

Critical infrastructure operators should regularly assess the risk of insufficient separation of system administrative and management role assignments. For example, in scenarios where the virtualisation of OT infrastructure or components is managed by privileged accounts from a corporate domain, if the corporate environment was to become compromised then the OT environment would potentially be impacted and those necessary privileged IT accounts may not be accessible.

Case study 4: Horizon Power working with ASD

Western Australian energy provider Horizon Power distributes electricity across the largest geographical catchment of any Australian energy provider – around 2.3 million square kilometres, or roughly an area 4 times bigger than France. It operates a diverse range of OT and ICT infrastructure to manage around 8,300 kilometres of transmission lines and deliver power to more than 45,000 customers.

In early 2023, Horizon Power partnered with ASD to conduct a range of activities to help examine and test its cyber security posture and controls. Horizon Power’s security team worked side-by-side with ASD’s experts to help improve threat detection, security event triage and response; practice forensic artefact collection; and enhance security communication across the enterprise. The activities have helped to improve both the speed and the quality with which Horizon Power can respond to and manage cyber incidents, including sharing cyber threat intelligence with ASD.

Horizon Power Senior Technology Manager Jeff Campbell said engaging ASD was easy, there were clear objectives, and the network assessments were excellent. ‘Long past are the days of holding cards to our chest. Sharing information is really important across multiple industries and sectors. To improve security, you need to find out what you don’t know.’

Mr Campbell said having ASD onsite helped to test many assumptions about the company’s network security, like its segmentation practices and vulnerability management. 'The engagement highlighted the importance of getting visibility over systems, and also helped to demonstrate that effective cyber security is vital to helping mitigate business risks.'

Learn more about the open, collaborative partnership between Horizon Power and the Australian Signals Directorate that enabled Horizon Power to bolster its cyber security controls.

Building cyber resilience in critical infrastructure

Malicious cyber activity against Australian critical infrastructure is likely to increase as networks grow in size and complexity. Critical infrastructure organisations can do many things to reduce the attack surface, secure systems, and protect sensitive data to help ensure Australia’s essential services remain resilient. Such as:

• Follow best practice cyber security, like ASD’s Essential Eight, or equivalent framework as required for a critical infrastructure risk-management program.
• Thoroughly understand networks, map them, and maintain an asset registry to help manage devices on all networks, including OT. Consider the security capabilities available on devices as part of routine architecture and asset review, and the most secure approach to hard-coded passwords.
• Scrutinise the organisation’s ICT supply chain vulnerabilities and risks.
• Prioritise secure-by-design or secure-by-default products. Consider the security controls of any new software, hardware, or OT before it is purchased, and understand vendor support for future patches and ongoing security costs. Build cyber security costs into budgets for the entire lifecycle of the product, including the product’s replacement.
• Understand what is necessary to keep critical services operating and protect these systems as a priority. Ensure OT and IT systems can be, or are, segmented to ensure the service is able to operate during a cyber incident.
• Treat a cyber incident as a ‘when’ not ‘if’ scenario in risk and business continuity planning, and regularly practice cyber incident response plans.
• Maintain open communication with ASD. ASD has a number of programs to support critical infrastructure, including cyber uplift activities and cyber threat intelligence sharing.
• Follow ASD’s cyber security publications tailored for critical infrastructure entities available at cyber.gov.au.

Explainer 3: The Trusted Information Sharing Network

The Department of Home Affairs’ Trusted Information Sharing Network (TISN) takes an all-hazards approach to help build security and resilience for organisations within the Australian critical infrastructure community. To rapidly and flexibly address current and future threats to Australia’s security, the TISN allows for all levels of government and industry to connect and collaborate.

Since launching the TISN platform in 2022, the network has been vital in amplifying key messages and information to members, facilitating sector group meetings and contributing to the weekly Community of Interest meetings to inform members of current data breaches, cyber threats, and technical advice available from ASD.

Explainer 4: Resilience in financial services

CPS 230 Operational Risk Management

Events of recent years have demonstrated the critical importance of financial institutions being able to manage and respond to operational risks, evident for example in the challenges of the COVID-19 pandemic, technology risks and natural disasters. Sound operational risk management is fundamental to financial safety and system stability.

To ensure that all APRA-regulated entities in Australia are well placed to manage operational risk and respond to business disruptions when they inevitably occur, on 17 July 2023, APRA released the new Prudential Standard CPS 230 Operational Risk Management (CPS 230).

CPS 230 encompasses operational risk controls and monitoring, business continuity planning and the management of third-party service providers. The aim of the standard is to:

• strengthen operational risk management with new requirements to address weaknesses that have been identified in existing practices of APRA-regulated entities. This includes requirements to maintain and test internal controls to ensure they are effective in managing key operational risks
• improve business continuity planning to ensure that APRA-regulated entities are ready to respond to severe business disruptions, and maintain critical operations such as payments, settlements, fund administration and claims processing. It is important that all APRA regulated entities are able to adapt processes and systems to continue to operate in the event of a disruption and set clear tolerances for the maximum level of disruption they are willing to accept for critical operations
• enhance third-party risk management by extending requirements to cover all material service providers that APRA-regulated entities rely upon for critical operations or that expose them to material operational risk, rather than just those that have been outsourced.

The new standard also aims to ensure that APRA-regulated entities are well positioned to meet the challenges of rapid change in the industry and in technology more generally.

CPS 234 Information Security

As part of APRA’s Cyber Security Strategy, all regulated entities are required to engage an independent auditor to perform an assessment against CPS 234, APRA’s Information Security Prudential Standard. This is the largest assessment of its kind conducted by APRA.

By the end of 2023, more than 300 banks, insurers and superannuation trustees will have completed their assessment. Early insights, from the assessments completed so far, have identified a number of common weaknesses across the industry, including:

• incomplete identification and classification for critical and sensitive information assets
• limited assessment of third-party information security capability
• inadequate definition and execution of control testing programs
• incident response plans not regularly reviewed or tested
• limited internal audit review of information security controls
• inconsistent reporting of material incidents and control weaknesses to APRA in a timely manner.

A summary of these findings, along with guidance to address gaps, have been shared in a recent APRA Insight Article – Cyber Security Stocktake Exposes Gaps. Entities are encouraged to review the common weaknesses identified and incorporate relevant strategies and plans to address shortfalls in their own cyber security controls, governance policies and practices. APRA will continue to work with entities that do not sufficiently meet CPS 234 requirements, to lift the benchmark for cyber resilience across the financial services industry.

Chapter 3: State actors

• State cyber actors will likely continue to target government and critical infrastructure, as well as connected systems and their supply chains as part of ongoing cyber espionage and information‑gathering campaigns. They do not just want state secrets; businesses also hold valuable and sensitive information.
• Some state actors are willing to use cyber capabilities to destabilise and disrupt systems and infrastructure. They may preposition on networks of strategic value for future malicious activities.
• Government and industry partnerships are vital in boosting national cyber security and resilience against cyberattacks by state actors.

Strategic context

The global and regional strategic environment continues to deteriorate, which is reflected in the observable activities of some state actors in cyberspace. In this context, these actors are increasingly using cyber operations as the preferred vector to build their geopolitical competitive edge, whether it is to support their economies or to underpin operations that challenge the sovereignty of others. In the Australian Security Intelligence Organisation’s Annual Report 2021–22, espionage and foreign interference was noted to have supplanted terrorism as Australia’s principal security concern.

Some states are willing to use cyber capabilities to destabilise or disrupt economic, political and social systems. Some also target critical infrastructure or networks of strategic value with the aim of coercion or prepositioning on a network for future disruptive activity.

State actors have an enduring interest in obtaining information to develop a detailed understanding of Australians and exploit this for their advantage. While government information is an attractive target for state actors seeking strategic insights into Australia’s national policy and decisions, many Australian businesses also hold sensitive and valuable data such as proprietary information, research, and personal information. Unlike cybercriminals who may post stolen data in public forums, state actors usually try to keep their activities covert – seeking to remain unnoticed, both when they are on an entity’s network and after a compromise.

State actors use various tools and techniques

In some cases, state actors may develop bespoke tools and techniques to fulfil their operational aims. In May 2023, ASD released a joint cyber security advisory with its international partners on the Snake implant – a cyber espionage tool designed and used by Russia’s Federal Security Service (FSB) for long-term intelligence collection on high-priority targets around the globe. Shortly after, Australia co-badged another joint cyber security advisory with international partners that outlined malicious cyber activity associated with a People’s Republic of China (PRC) state-sponsored cyber actor.

Case study 5: Advisory – People’s Republic of China state-sponsored cyber activity

[Go to advisory]

In May 2023, ASD joined international partners in highlighting a recently discovered cluster of activity associated with a PRC state-sponsored cyber actor, also known as Volt Typhoon. The campaign involved ‘living-off-the-land’ techniques – using built-in operating tools to help blend in with normal system and network activities. Private sector partners identified that this activity affected networks across US critical infrastructure sectors. However, the same techniques could be applied against critical infrastructure sectors worldwide, including in Australia.

ASD published the People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection advisory on cyber.gov.au and hosted numerous events to brief its Network Partners. For help to implement the advisory – call 1300 CYBER1 ( 1300 292 371 ).

Even when state actors have access to more advanced capabilities, they can use common tools and techniques to avoid the discovery of their best capabilities. For example, state actors continue to use relatively well-known tactics, such as exploiting unpatched or misconfigured systems and spear phishing.

The threat of state actor cyber operations is very real

State actors will likely continue to target government and critical infrastructure, as well as connected systems and their supply chains, as part of ongoing cyber espionage and information-gathering campaigns. Significant disruptive and destructive activities could occur if there were a major deterioration in Australia’s geopolitical environment. It is clear that preventative cyber security measures – such as implementing cyber security essentials, information-sharing and national cyber cooperation – are by far the best ways to help secure Australian networks.

In focus: Russia’s war on Ukraine

Cyber operations have been used alongside more conventional military activities during Russia’s war on Ukraine. Both Russia and Ukraine have faced many cyberattacks that impacted their societies, with extensive targeting of government and critical infrastructure networks.

Cyberattacks that began before the invasion of Ukraine have continued into 2023. Between January 2022 and the first week of February 2023, the Computer Emergency Response Team-Europe (CERT-EU) identified and analysed 806 cyberattacks associated with Russia’s war on Ukraine.

There has been extensive cyber targeting of Ukrainian networks across many sectors, including finance, telecommunications, energy, media, military and government. Ukraine has faced ransomware, denial‑of‑service (DoS) attacks, and mass phishing campaigns against critical infrastructure, government departments, officials and private citizens.

Russia has also been subject to cyber operations. Russian authorities have reported some of its federal agencies’ websites, including its energy ministry, were compromised by unknown attackers in a supply chain attack. Cyberattacks against Russia have tended to target entities related to the government, military, banking, logistics, transport and energy sectors.

Cyberattacks in Europe associated with Russia’s war on Ukraine

Figure 3 : Countries impacted by cyberattacks associated with Russia’s war on Ukraine

Cyber operations have enabled a borderless conflict

Cyber operations associated with Russia’s invasion have affected entities in multiple countries during the first year of the conflict, including the European Parliament, European governments, the Israeli Government, and hospitals in the Netherlands, Germany, Spain, the US, and the UK. Many of these countries have linked the attacks to pro-Russian groups. For example, pro-Russian hacktivists, KillNet, have claimed a number of attacks such as the February 2023 DoS attack on numerous German websites, including those for German airports, public administration bodies, financial sector organisations, and other private companies. Belarus also reported its railway network was disrupted by a cyberattack, allegedly as retaliation for its use in transporting Russian troops. In some cases, Australia–based operations of European organisations have been impacted.

Many cyber actors are involved in the conflict in offence and defence

The mix of state and non-state cyber actors participating in Russia’s war on Ukraine has added to an already complex cyberspace domain. While state actors were on the ‘cyber front’, particularly during the earlier stages of the conflict, there was significant activity by hacktivists from around the globe as the conflict progressed. Regardless of whether a malicious cyber actor was a state, state-sponsored, or a non-state actor acting of their own volition, the scale and frequency of malicious cyber activity during the conflict has challenged cyber defenders on all sides. For example, at least 8 variants of destructive malware were identified in the first 6 weeks of the conflict, including wiper malware designed to erase data or prevent computers from booting.

Both state and non-state cyber actors have been on the offensive and defensive. Ukraine’s networks have been resilient and have largely withstood sustained cyberattacks. Ukraine has said this resilience is due to robust defences developed following previous cyberattacks, as well as partnerships with private sector IT companies. For example, with the support of private companies, Ukrainian government data was migrated to cloud infrastructure, which assured continuity of government services. Private companies also rapidly released threat intelligence, like indicators of compromise, to assist cyber defenders to repel network attacks.

Threat intelligence that might impact Australian entities is obtained by ASD through international partners and shared through cyber.gov.au and ASD’s Cyber Security Partnership Program.

Cyber operations can cause disruption and destruction in conflict

While the conflict remains ongoing, there are many lessons Australia can learn from Russia’s war on Ukraine. The world is witnessing the destructive impact of cyber operations during conflict, or in the pursuit of a state’s national interests, and how a broad range of critical infrastructure can be disrupted as a result of malicious cyber activity. It also demonstrates the impact non-state participants can have in modern conflict. The conflict has exemplified how government and industry partnerships are critical to boosting national cyber security and resilience.

Case study 6: The CTIS community at work – KillNet

The Cyber Threat Intelligence Sharing (CTIS) platform, operated by ASD, was developed with industry, for Australian Government and industry partners to build a comprehensive national threat picture and empower entities to defend their networks. CTIS allows participating entities to share indicators of compromise (IOCs) bilaterally at machine speed. Participating entities can use these IOCs to identify and block activity on their own networks, and share IOCs observed on their own networks with other CTIS partners.

The number of partners using CTIS increased seven-fold over 2022–23:

• in July 2022 there were 32 CTIS partners (18 consuming, 14 contributing)
• in June 2023 there were 252 CTIS partners (165 consuming, 87 contributing)
• by the end of FY 2022–23, CTIS shared 50,436 pieces of cyber threat intelligence
• as of 2023, ASD is progressing a further 313 candidate organisations for on-boarding.

In March 2023, a CTIS partner shared almost 1,000 IP addresses relating to a distributed denial-of-service (DDoS) attack on an Australian organisation. The partner linked the DDoS attack to the malicious cyber actor KillNet, a well-known pro-Russian hacktivist group. Since Russia’s war on Ukraine began, KillNet’s focus had been primarily Europe; however, recent trends suggest a shift to countries abroad, including Australia and its critical infrastructure.

CTIS partner contributions help participants defend their networks, and inform ASD’s understanding of threat actors, their motives and their tactics, techniques, and procedures. This information also helps ASD to identify trends within and across sectors.

For more information on CTIS, visit cyber.gov.au and become a Network Partner. Existing Network Partners can register their interest in accessing CTIS by either clicking on the ‘Register your interest’ button via the ASD Partnership Portal, or by contacting [email protected] .

Chapter 4: Cybercrime

• Profit-driven cybercriminals continually seek new ways to maximise payment and minimise their risk, including by changing their tactics and techniques to mask their actions and extract payment from victims.
• Ransomware remains the most destructive cybercrime threat to Australians, but is not the only cybercrime. Business email compromise (BEC), data theft, and denial-of-service (DoS) continue to impose significant costs on all Australians.
• Building a national culture of cyber literacy, practicing good cyber security hygiene, and remaining vigilant to cybercriminal activity – both at work and at home – will help make it harder for cybercriminals to do business.

Cybercrime is big business and causes harm

Cybercrime is a multibillion-dollar industry that threatens the wellbeing and security of every Australian. Cybercrime covers a range of illegal activities such as data theft or manipulation, extortion, and disruption or destruction of computer-dependant services. In 2022–23, cybercrime impacted millions of Australians, including individuals, businesses and governments. These crimes have caused harm and continue to impose significant costs on all Australians.

The Australian Institute of Criminology (AIC) found, in its Cybercrime in Australia 2023 report, that individual victims and small-to-medium businesses experience a range of harms from cybercrime that extend beyond financial costs, such as impacts to personal health and legal issues. Cybercrime remains significantly underreported in Australia. The AIC’s report revealed that two-thirds of survey respondents had been victims of cybercrime in their lifetimes.

ASD needs community assistance to understand the cyber threat landscape. Australians are encouraged to report cyber security incidents and cybercrime to ReportCyber . ReportCyber is the Australian Government’s online cybercrime reporting tool coordinated by ASD and developed as a national initiative with state and territory police. ReportCyber may link Australians to other Australian Government entities for further support.

Cybercrime in 2022–23

The number of extortion-related cyber security incidents ASD responded to increased by around 8 per cent compared to last financial year.

Over 90 per cent of these incidents involved ransomware or other forms of restriction to systems, files or accounts.

ASD responded to 79 cyber security incidents involving DoS and DDoS , which is more than double the 29 incidents reported to ASD last financial year.

Cybercrime types

Cybercrime reports by state and territory

Australia’s more populous states continue to report more cybercrime. Queensland and Victoria report disproportionately higher rates of cybercrime relative to their populations. However, the highest average reported losses were by victims in New South Wales (around $32,000 per cybercrime report where a financial loss occurred) and the Australian Capital Territory (around $29,000).

Figure 4: Breakdown of cybercrime reports by jurisdiction for FY 2022–23 Note: Approximately one per cent of reports come from anonymous reporters and other Australian territories. Data has been extracted from live datasets of cybercrime and cyber security reports reported to ASD. As such, the statistics and conclusions in this report are based on point-in-time analysis and assessment.

How criminals monetise access

Profit-driven cybercriminals continually seek new ways to maximise payment and minimise their risk, including by changing their tactics and techniques to mask their actions and extract payment from victims. Their targeting is largely opportunistic but can also be aimed at specific entities or individuals.

The professionalisation of the cybercrime industry means cybercriminals have been able to increase the scale and profitability of their activities. For example, initial access brokers sell their services and accesses to other malicious cyber actors who then use techniques, such as ransomware or data-theft extortion, to target victims. The accessibility of criminal marketplaces has also lowered the bar for entry into cybercrime, which has made cybercrime more accessible to a wide range of actors.

To gain initial access, cybercriminals may send multiple malicious links to a broad list of people (known as a phishing campaign), or scan for unpatched and misconfigured systems. Once they compromise a network, they may seek to move laterally through the network to gain access to higher-value systems, information or targets.

Cybercriminals may draw on a number of techniques to extract payment from victims, including employing multiple techniques at once – known as double or multiple extortion. While ransomware is a well-known technique, cybercriminals can monetise access to compromised data or systems in many different ways. They may scam a business out of money or goods, extort victims in return for decrypting data or non‑publication of data, on-sell compromised data or systems access for profit, or exploit compromised data or systems for future use.

Social engineering: how criminals get a foothold

Social engineering is a way in which cybercriminals can gain unauthorised access to systems or data by manipulating a person. They may do this by creating a sense of urgency or desire to help, or by impersonating a trusted source to convince a victim to click on a malicious link or file, or reveal sensitive information through other means – such as over the phone.

Phishing is one of the most common and effective techniques used by cybercriminals to gain unauthorised access to a computer system or network, and this activity may be indiscriminate or targeted. Once a victim engages with the malicious link or file, they may be prompted to provide personal details, or malware may run on their device to covertly retrieve this information. Cybercriminals may then use this information to steal money or goods, or leverage this information to access other accounts and systems of higher value.

Australians are becoming more aware of techniques dependent on social engineering, like phishing, but more can be done to build resilience:

• think twice before clicking on links from unsolicited correspondence
• verify the legitimacy of suspicious messages with the source via their official website or verified contact information, particularly if it is a request to transfer money or supply sensitive information. Visit the entity’s website directly, rather than via links in emails, SMS or other messaging services
• report unusual activity as quickly as possible to ReportCyber and Scamwatch
• educate staff on corporate-focused social engineering tactics and how to identify risk.

Explainer 5: Common cybercriminal techniques

Phishing is an attempt to trick recipients into clicking on malicious links or attachments to harvest sensitive information, like login details or bank account details, or to facilitate other malicious activity. Spear phishing is more targeted and tailored: cybercriminals may research victims using social media and the internet to craft convincing messages designed to lure specific victims.

Ransomware is a type of extortion that uses malware for data or system encryption. Cybercriminals encrypt data or a system and request payment in return for decryption keys. Ransomware-as-a-Service (RaaS) is a business model between ransomware operators and ransomware buyers known as ‘affiliates’. Affiliates pay a fee to RaaS operators to use their ransomware, which can enable affiliates with little technical knowledge to deploy ransomware attacks.

Data-theft extortion does not require data encryption, but cybercriminals will use extortion tactics such as threatening to expose sensitive data to extract payment. The added threat of reputational damage is intended to pressure a victim into complying with the malicious cyber actor’s demands.

Data theft and on-sale is when data is extracted for use by a cybercriminal for the purpose of on-selling the data (such as personal information, logins or passwords) for further criminal activity, including fraud and financial theft. Some malware known as an ‘infostealer’ can do this job for the cybercriminal.

Business email compromise (BEC) is a form of email fraud. Cybercriminals target organisations and try to scam them out of money or goods by attempting to trick employees into revealing important business information, often by impersonating trusted senders. BEC can also involve a cybercriminal gaining access to a business email address and then sending out spear phishing emails to clients and customers for information or payment.

Denial-of-service (DoS) is designed to disrupt or degrade online services, such as a website. Cybercriminals may direct a large volume of unwanted traffic to consume the victim network’s bandwidth, which limits or prevents legitimate users from accessing the website.

Ransomware is a destructive cybercrime

Ransomware remains the most destructive cybercrime threat in 2022–23 to Australian entities. ASD recorded 118 ransomware incidents – around 10 per cent of all cyber security incidents.

A quarter of the ransomware reports also involved confirmed data exfiltration, also known as ‘double extortion’, where the actor extorts the victim for both data decryption and the non-publication of data. Other ransomware actors claimed to have exfiltrated data, but it is difficult to validate these claims until data exfiltration is confirmed or the legitimacy of leaked data is confirmed.

Ransomware is deliberatively disruptive, and places pressure on victims by encrypting and denying access to files. A ransom, usually in the form of cryptocurrency, is then demanded to restore access. This can inhibit entities, particularly those that rely on computer systems to operate and undertake core business functions.

Customers may also be impacted if they rely on the goods or services from that entity, or if their data is impacted. For example, in January 2023, cybercriminals reportedly compromised the postal service in the UK, encrypting files and disrupting international shipments for weeks. In other instances, ransomware incidents have had cascading impacts, sparking panic buying, fuel shortages, and medical procedure cancellations.

ASD advises against paying ransoms. Payment following a cybercrime incident does not guarantee that the cybercriminals have not already exfiltrated data for on-sale and future extortion.

ASD’s incident management capabilities provide technical incident response advice and assistance to Australian organisations. Further information can be found in the How the ASD's ACSC Can Help During a Cyber Security Incident guide.

Case study 7: Ransomware in Australia

In late 2022, an Australian education institution was impacted by the Royal ransomware, which is likely associated with Russian-speaking cybercrime actors. Royal ransomware restricts access to corporate files and systems through encryption. Notably, it uses a technique called ‘callback phishing’, which tricks a victim into returning a phone call or opening an email attachment that persuades them to install malicious remote access software.

When the institution detected the ransomware, it shut down some of its IT systems to stop the spread, which resulted in limited service disruption. An investigation revealed that a limited amount of personal information of both students and staff was compromised. The institution notified affected individuals and reminded them to remain vigilant for suspicious emails or communication. The institution also advised all students and staff to reset their passwords and introduced an additional verification process for remote users.

An ICT manager from the institution said downtime from the incident was minimal due to an effective  business continuity plan and access to regular backups, which were unaffected by encryption. After the incident, the institution began moving toward more secure data storage methods.

The ICT manager said the incident highlighted how ubiquitous data is in an enterprise environment. ‘There were no crown jewels affected, so to speak. Important data was spread across the network. This incident taught us some lessons in relation to account management, and the regular review and archival of data’.

In January 2023, ASD published to cyber.gov.au the Royal Ransomware Profile , which describes its tactics, techniques and procedures and outlines mitigations. The ransomware profile was informed by cyber threat intelligence that the education institution shared with ASD.

Sectors impacted by ransomware-related cyber security incidents

The professional, scientific and technical services sector reported ransomware-related cyber security incidents most frequently to ReportCyber in 2022–23, followed by the retail trade sector, then the manufacturing sector. These 3 sectors accounted for over 40 per cent of reported ransomware-related cyber security incidents.

Table 5: Top 5 sectors reporting ransomware-related incidents in FY 2022–23 (ReportCyber data)

Entities should consider how a ransomware incident could impact their business and their customers. To help prevent a ransomware attack, it is important to secure devices by turning on multi-factor authentication (MFA), implementing access controls, performing and testing frequent backups, regularly updating devices, and disabling Microsoft Office macros. It is also equally important to practice incident response plans to minimise the impact in the event of a successful ransomware incident.

Business email compromise is lucrative

BEC is an effective and lucrative technique that exploits trust in business processes and relationships for financial gain. Cybercriminals can compromise the genuine email account of a trusted sender, or impersonate a trusted sender, to solicit sensitive information, money or goods from businesses partners, customers or employees.

For example, a cybercriminal may gain access to the email account of a business and send an invoice with new bank account details to a customer of that business. The customer pays the invoice using the fraudulent bank account details provided by the cybercriminal, which is often thousands of dollars. A compromised business may only detect BEC once a customer has paid cybercriminals.

In 2022–23, the total self-reported BEC losses to ReportCyber was almost $80 million. There were over 2,000 reports made to law enforcement through ReportCyber of BEC that led to a financial loss. On average, the financial loss from each BEC incident was over $39,000.

Before replying to requests seeking money or personal information, look out for changes such as a new point-of-contact, email address or bank details. Simple things like calling an existing contact or the trusted sender to verify a request for money or change of payment details can help to prevent BEC.

Explainer 6: Business email compromise advice

Organisations should implement clear policies and procedures for workers to verify and validate requests for payment and sensitive information. Additionally:

• Register additional domain names to prevent typo-squatting – cybercriminals may create misleading domain names based on common typographic errors of a website, hoping its customers do not notice. Further information on Domain Name System Security for Domain Owners is available at cyber.gov.au.
• Set up email authentication protocols business domains – this helps prevent email spoofing attacks so that cybercriminals cannot wear a ‘digital mask’ pretending to be legitimate.

ASD has published the Preventing Business Email Compromise guide to help Australian organisations understand and prevent BEC.

Case study 8: Scams in Australia

In April 2023, the Australian Competition and Consumer Commission (ACCC) released its Targeting Scams report . The report, which compiles data reported to the ACCC’s Scamwatch, ReportCyber, the Australian Financial Crimes Exchange, IDCARE and other government agencies, provides insight into the scams that impacted Australians in 2022. The report also outlines some of the activities by government, law enforcement, the private sector and community to disrupt and prevent scams.

The Targeting Scams report revealed Australians lost over $3 billion to scams in 2022. This is an 80 per cent increase on total losses recorded in 2021.

Investment scams were the highest loss category ($1.5 billion), followed by remote access scams ($229 million) and payment redirection scams ($224 million).

The most reported contact method used by scammers was text message; however, scam phone calls accounted for the highest reported losses. The second highest reported losses were from social media scams.

Older Australians lost more money to scams than other age groups with those aged 65 and over losing $120.7 million, an increase of 47.4 per cent from 2021. First Nations Australians, Australians with disability, and Australians from culturally and linguistically diverse communities each experienced increased losses to scams when compared with data from 2021.

On 1 July 2023, the Government launched the National Anti-Scam Centre. The Anti-Scam Centre will expand on the work of the ACCC’s Scamwatch service and bring together experts from government agencies, the private sector, law enforcement, and consumer groups to make Australia a harder target for scammers.

Hacktivists are using cyberattacks to further their causes

Hacktivism is used to describe a person or group who uses malicious cyber activity to further social or political causes, rather than for financial gain.

These malicious cyber actors, which include issue-motivated groups, are typically less capable, less organised, and less resourced than other types of malicious cyber actors. That said, even rudimentary disruptive activity – such as website defacement, hijacking of official social media accounts, leaking information, or DoS – can cause significant harm, reputational damage, and operational impacts to targeted entities.

Like cybercriminals, hacktivists may leverage malicious tools and services online to gain new capabilities and improve their ability to degrade or disrupt services for their cause.

Case study 9: Australian critical infrastructure targeted by issue-motivated DDoS

In March 2023, ASD became aware of reports of issue-motivated groups (hacktivists) targeting Australian organisations. Open source reporting linked the targeting of over 70 organisations to religiously motivated hacktivists.

The malicious activity commenced on 18 March with the defacement of, and/or DDoS against, the websites and other internet-facing services of small-to-medium businesses. This progressed to DDoS activity targeting the websites of Australian critical infrastructure entities, with multiple hacktivist groups announcing support for the campaign and publishing ‘target lists’ across a variety of platforms.

ASD received several incident reports from organisations experiencing hacktivist activity, including critical infrastructure providers. However, there was no impact on critical infrastructure operations, as only public-facing websites were affected. ASD provided advice and support to organisations, including by identifying IP addresses related to the attacks. ASD also shared indicators of compromise with its Network Partners.

In addition to ASD support, critical infrastructure providers worked closely with commercial incident-response providers and their in-house incident-response teams. One critical infrastructure provider identified through open source research that a second DDoS attack was being planned against their servers.

To prevent this attack, administrators enabled geo-blocking – where traffic from specific geolocations known to be used by the malicious cyber actor were blocked – to limit malicious traffic. This simple tactic helped the organisation avoid a second attack. As a result, the organisation did not suffer from any additional downtime.

ASD urges organisations to report all incidents – even those with minimal impact on operations – to enhance national situational awareness, especially of coordinated malicious activity. Your report to ASD could help prevent or defend against an attack on other Australian networks.

Denial-of-service operations are designed to disrupt

DoS attacks disrupt or degrade online services such as websites and email, and are another tactic used by cybercriminals and hacktivists. This technique causes access or service disruption to the victim, sometimes to pressure them into payment or to highlight a cause.

In these attacks, an online service is overwhelmed by so many illegitimate requests that it loses capacity to serve real users. DoS can also be achieved by hijacking an online service to redirect legitimate users to other services controlled by malicious cyber actors. In some instances, DDoS attacks can use huge numbers of ‘zombie’ computers or bots (hijacked by malware), to direct large volumes of unwanted network traffic to a web service.

ASD recorded 79 DoS and DDoS cyber security incidents in 2022–23, with service availability partly or wholly denied for the victim in 62 of those incidents. The remainder of the incidents had no impact on the victim. Entities who maintained situational awareness of DoS threats and proactively implemented mitigations were reportedly less impacted by subsequent DoS.

Although entities cannot avoid being targeted, they can implement measures to prepare for and reduce the impact of a DoS attack. This includes using DDoS protection services and exercising incident response and business continuity plans.

Defence against cybercrime

Both individuals and organisations can take simple steps to help build their cyber security. Many of these steps can often prevent initial access by cybercriminals.

• enable multi-factor authentication (MFA) for online services when available
• use long unique passphrases for every account if MFA is not available, particularly for services like email and banking (password managers can assist with such activities)
• sign up for ASD’s free Alert Service
• review the cyber security posture of remote workers including their use of communication, collaboration and business productivity software
• implement relevant guidance from ASD’s Essential Eight Maturity Model , Strategies to Mitigate Cyber Security Incidents and Information Security Manual

ASD has published a range of guides at cyber.gov.au to support Australians and Australian organisations in building their cyber resilience, including how to defend against ransomware attacks, and how to detect socially engineered messages, phishing emails and texts.

Chapter 5: Cyber enabled data breaches

• During FY 2022–23, ASD received an increase in data breach reports as millions of Australians had their information compromised through significant data breaches.
• Malicious cyber actors stole data by using valid account credentials or by exploiting internet-facing applications.
• Sensitive data should be deleted or de-identified when it is no longer needed or required. Organisational policies and processes should consider how to protect gathered and generated data.

Data ubiquity

Data is valuable to malicious cyber actors as data and data flows underpin almost every modern technology and digital service. During 2022–23, millions of Australians had their private information compromised through significant data breaches, and some Australians were exposed to multiple breaches.

A data breach occurs when information is shared with, or is accessed by, an unauthorised person or third party. Isolation and remediation of the breach could cost millions of dollars. The complete recovery cost is hard to quantify, but could include losses due to productivity, legal action and reputational damage. An entity’s customers or staff could experience harm from a data breach if their private information is used by criminals for cyber or other fraud or scams, including identity theft. Protecting data, particularly sensitive personal information, is vital for the safety of the community, the prosperity of business, and the nation’s security.

Explainer 7: Vital data

Organisations should consider what data is vital to their operations, and individuals should consider what data might affect their privacy.

Data can take many forms such as personal information. Personal information includes a broad range of information, or an opinion, that could identify an individual. It can encompass things such as an individual’s name, date of birth, drivers licence or passport details, phone number, home address, health records, credit information, mobile device location history, and voiceprint and facial recognition details.

Other forms of data could include sensitive financial information, corporate emails, intellectual property and research, or strategic business plans. Information associated with network telemetry and endpoint security information, or machine learning models, also generate potentially useful information which can be exploited by malicious cyber actors.

Data breach incidents in Australia

During 2022–23, many data breaches reported to ASD involved cybercriminals stealing customer personal information from organisations to support extortion activities. Organisations should be aware that a data breach could be a precursor to the destruction or encryption of data.

Of the cyber security incidents recorded by ASD during 2022–23, 150 were data breaches, making up around 13 per cent of all incidents. Compared to 2021–22, this is up from 81 data breaches or 7 per cent of all incidents. Data breaches were the third most common incident type in 2022–23, behind compromised infrastructure (15.2 per cent) and compromised credentials (18.8 per cent).

Phishing, a tactic whereby a user is induced to open a malicious email attachment or to visit a compromised website, was commonly used to steal credentials. Malicious cyber actors also obtained credentials from unrelated cyberattacks and breaches. ASD’s incident data showed an extensive network compromise almost always occurred when a malicious cyber actor successfully accessed privileged accounts.

In 2022–23, ASD responded to a number of data breaches that involved common characteristics and intrusion chains. Broadly, these incidents demonstrated either:

• opportunistic intrusions involving a malicious actor exploiting a single internet-facing application or service which contained data. Actors typically used a ‘smash and grab’ technique to steal data directly from this single initial access vector
• complex intrusions involving a malicious actor demonstrating a wider variety of techniques after initial access as they escalated privileges, and moved laterally seeking data to exploit. These intrusions resulted in more extensive network compromise. Generally, incidents where malicious actors successfully compromised privileged accounts also resulted in more complex intrusions and extensive incidents.

Diving deeper into data breaches

ASD conducted a detailed analysis of data breach incidents between 1 November 2021 and 30 October 2022. Analysis revealed the average amount of data reported to have been exfiltrated during a breach was around 120 gigabytes, with the highest reported amount being around 870 gigabytes. Table 6 outlines the top information types exposed during a breach.

Table 6: Types of information stolen in data breaches Note: some incidents included the breach of multiple types of information.

Different types of information may carry different risks. For example, health information is likely to be more sensitive than contact information and will require greater protection. Table 6 indicates contact information was breached most frequently, likely because this type of data is widely collected and has increased exposure.

During the same analysis period, 41 per cent of data breaches involved malicious cyber actors exploiting valid accounts and credentials to access cloud services, local systems, or entire networks. Malicious cyber actors commonly used brute-force attacks to take advantage of simple and re-used passwords to access accounts, or used phishing to obtain credentials.

Around 34 per cent of data breaches involved exploitation of internet-facing applications. Common vulnerabilities and exposures (CVEs) were often exploited, and so was human misconfiguration of devices like unsecured application programming interfaces, or common bugs and flaws in software; for example, insecure direct object references.

To help Australian organisations, the ASD has published the  Preventing Web Application Access Control Abuse advisory.

Figure 5 : Anatomy of a data breach

To steal data from an organisation, malicious cyber actors will commonly exploit online services and internet-facing devices, or penetrate a network’s perimeter using stolen or easily guessed credentials. Once inside a network, malicious actors will often attempt to escalate their privileges, move laterally across a network to find data to steal and/or other systems to exploit, and then attempt to exfiltrate data back through the network perimeter.

Stolen data for nefarious use

Different malicious cyber actors have differing motivations for stealing data. For example, cybercriminals may use stolen data, particularly personal information, as a basis for identity theft or to conduct phishing campaigns for financial gain. State actors are also interested in personal information, among other data types, although this is more likely for espionage purposes rather than financial gain. Irrespective of motivation, the impacts of data breaches on victims are actor agnostic – Australians can be exposed to harm and organisations can experience losses.

Data stolen by cybercriminals typically ends up on the dark web marketplaces where it can be shared, bought, and sold by other malicious cyber actors. For example, stolen credentials may end up with initial access brokers who specialise in dealing stolen usernames and passwords. Malicious cyber actors can also piece together seemingly innocuous information like an email address, a date of birth, or a phone number to target someone for spear phishing, fraud, or to leverage that person to gain other privileged accesses and information.

Once exposed, some data can be used in perpetuity for future crime, particularly in cases of identity theft, blackmail, or extortion. A victim’s real name and home address can be difficult to change, unlike stolen credentials which are easily updated.

ASD has also received reports of cyber security incidents in which threat actors claimed to have exfiltrated data; however, subsequent investigations have not identified evidence of exfiltration. While a threat actor’s assertion of data exfiltration may be an attempt to elevate urgency or pressure affected entities, it remains important to thoroughly investigate evidence to support or counter the claim.

Case study 10: Operation GUARDIAN

On 28 September 2022, the Australian Federal Police’s Joint Policing Cybercrime Coordination Centre (JPC3) commenced Operation GUARDIAN to coordinate efforts to protect those at higher risk of financial fraud and identity theft as a result of the Optus data breach.

Since the Optus incident, Operation GUARDIAN has expanded to include the Medibank, MyDeal, Latitude, and the Go-Anywhere data breaches. Some breaches have resulted in the exposure of personal information and sensitive data of Australians.

The purpose of Operation GUARDIAN is to monitor, disrupt and prosecute any person misusing personal information exposed as a result of data breaches. It aims to deter criminals from using data for malicious purposes and to educate the public.

Operation GUARDIAN works with the public and private sectors to search the internet and known criminal online sites to identify exposed personal information and those who are attempting to buy or sell it.

Case study 11: Awareness and impact of data breaches in the Australian community

According to the Office of the Australian Information Commissioner’s Australian Community Attitudes to Privacy Survey (ACAPS) 2023 , three-quarters (74 per cent) of Australians believe that data breaches are one of the biggest privacy risks they face today, and a quarter (27 per cent) said it is the single biggest risk to privacy in 2023.

Almost half (47 per cent) of Australians said they had been told by an organisation that their information was involved in a data breach in the prior year, and a similar proportion (51 per cent) know someone who was affected by a breach.

Three-quarters (76 per cent) of those whose data was involved in a breach said they experienced harm as a result. More than half (52 per cent) reported an increase in scams or spam texts or emails. There were 3 in 10 (29 per cent) who said they had to replace key identity documents, such as drivers licences or passports. Around 1 in 10 experienced significant issues such as emotional or psychological harm (12 per cent), financial or credit fraud (11 per cent) or identity theft (10 per cent).

Nearly half (47 per cent) of Australians said they would close their account or stop using a product or service provided by an organisation that experienced a data breach. However, most Australians are willing to remain with a breached organisation provided that organisation promptly takes action, such as quickly putting steps in place to prevent customers experiencing further harm from the breach (62 per cent) and making improvements to their security practices (61 per cent). Only 12 per cent of Australians said there is nothing an organisation could do that would influence them to stay after a data breach.

There are a range of ways organisations can protect personal information. A quarter (26 per cent) of Australians believe the most important step is for organisations to collect only the information necessary to provide the product or service. Australians view the second most important thing organisations can do is take proactive steps to protect the information they hold (24 per cent).

The OAIC commissioned Lonergan Research to undertake ACAPS 2023. The survey was conducted in March 2023 with a nationally representative sample of 1,916 unique respondents aged 18 and older. To read the full report visit oaic.gov.au/acaps .

Mitigating data breaches

Implementing ASD’s Essential Eight, and the Open Web Application Security Project (OWASP) Top Ten Proactive Controls will help protect data by minimising the risks to systems and networks, online services and internet-facing devices. At least fortnightly, organisations should use an automated method to scan for security vulnerabilities and apply timely patches or mitigations to minimise risks. Other effective controls to help mitigate data breaches include:

• deploy multi-factor authentication (MFA) to mitigate stolen credential abuse
• enforce strong passphrase policy to secure accounts
• block internet-facing services that are not authorised to be internet-facing
• immediately decommission unnecessary systems and services
• configure server applications to run as a separate account with the minimum privileges to mitigate account abuse
• mandate user training to recognise phishing or social engineering attempts.

Encryption can further protect data that is stored or in transit between systems. For example, sensitive data about former customers that must be legally retained should be encrypted and stored offline, inaccessible to the internet. Data communicated between database servers and web servers, especially over the internet, are susceptible to compromise and should be encrypted. Further guidance about how organisations can protect data is contained within ASD’s Information Security Manual .

The most cyber resilient organisations have a well-thought-out and exercised cyber incident response plan that includes a data breach response plan or playbook. A robust plan will help organisations respond to a data breach, rapidly notify relevant organisations and individuals to minimise the risk of harm, restore business operations, comply with relevant obligations, and reduce the costs and potential reputational damage that may result from a breach.

Organisations should include a strategy for communicating with customers in their cyber incident response plan, and consider how to protect customers from, and assist with, the consequences of a breach. For example, organisations can inform their customers whether or not hyperlinks will be used in their communications after a breach – or at all – to help them avoid falling prey to phishing attempts.

ASD has published guidance on cyber.gov.au, like the Guidelines for Database Systems to help organisations enhance database security.

Chapter 6: Cyber resilience

• Cyber resilience is helping to ensure an entity is resistant to cyber threats. For enterprise, this includes organisation-wide cyber risk management and consideration of third-party risks, such as vendors, service providers, and new technologies.
• Artificial intelligence (AI) has great benefits to organisations but also poses security challenges; a risk-based approach to using AI within ICT environments as per other services is recommended.
• Invest in prevention, response and recovery to reduce the impact of a compromise and build the resilience of Australian systems.
• Practice good cyber hygiene at work and at home. Enable multi-factor authentication (MFA), use unique passphrases, enable automatic updates, regularly back up important data, and report suspicious cyber activity.
• Cooperation on a national scale is one of Australia’s greatest advantages against malicious cyber activities. Keep up to date at cyber.gov.au, and engage with ASD’s Cyber Security Partnership Program to help build the nation’s collective cyber resilience.

Digital supply chains increase the attack surface

Most entities have some component of their ICT outsourced to a third party, such as hardware supply, web and data hosting, and software-as-a-service or other enterprise resource planning tools.

According to the Australian Bureau of Statistics’ Characteristics of Australian Business data, during 2021–22, around 85 per cent of Australian businesses used ICT, and 59 per cent used cloud technology. These measures have been trending up year-on-year.

During 2022–23, ASD published a number of alerts warning Australians about vulnerabilities relating to products commonly found in ICT supply chains, like Citrix Gateway and Application Delivery Controller devices. During March 2023, ASD published an alert describing a supply chain compromise affecting multiple versions of the 3CX DesktopApp – a popular voice-over-IP application.

While an entity can outsource ICT functions to access specialist skills, increase efficiency, and lower costs, it must still manage and be accountable for cyber security risk. ICT supply chain expansion can increase the attack surface, particularly as there may be varying levels of cyber security maturity among both customers and suppliers.

A malicious cyber actor can compromise numerous victims at scale by targeting a single upstream or third‑party supplier. An ICT supply chain attack comprises 2 attacks: an initial attack on a supplier, and a subsequent attack on its customers. For example, a managed service provider (MSP) might have privileged network access to hundreds of customers or hold huge amounts of sensitive data. After compromising an MSP, a malicious cyber actor could then exploit the MSP’s privileged network accesses, or steal sensitive data to extort its customers directly. This highlights that, while an entity might have leading-edge cyber defences, its security posture will only be as strong as its weakest link, which may be in its ICT supply chain.

To conduct an ICT supply chain attack, malicious cyber actors will commonly abuse misconfigurations in devices and the trust between supplier services and customer networks, conduct phishing attacks, and exploit common vulnerabilities and exposures (CVEs). Figure 6 outlines some of the common adversary goals and techniques associated with ICT supply chain attacks.

Defeating ICT supply chain threats requires effort from both customers and suppliers. The most effective measures combine both business and technical controls conducted at the earliest stage of ICT procurement or development. While a downstream customer may have no influence over their supplier’s security posture, they can improve their own cyber security to help mitigate risks. Suppliers should prioritise the secure-by-design and secure-by-default principles to improve their own product security and therefore their customers’ security.

Customers should clearly state cyber security expectations upfront as part of any contract, such as requiring that a supplier meet particular cyber security standards. Entities should appraise their suppliers of their risk tolerances, and might want to ask how the supplier will demonstrate good security practices, justify their product’s accesses and privileges, and guarantee genuine product delivery. Entities should also consider whether their supplier may be subject to foreign control or interference.

Figure 6 : ICT supply chain threats

Australian organisations face many cyber threats, including from the ICT supply chain. Malicious cyber actors who target upstream suppliers, such as by compromising a cloud host, may be able to impact downstream customers by exploiting the trust between that supplier and its customers. An attacker could then conduct data theft and extortion activities, or other attacks like denial-of-service. An organisation’s cyber security posture is only as strong as its weakest link, which could be an entity in its ICT supply chain.

Mitigating ICT supply chain threats

Organisations can boost their ICT supply chain defences in many ways, including by implementing ASD’s Essential Eight. The most effective technical controls to mitigate risks combine both mitigation and detection techniques, and are supported by a positive organisation-wide cyber secure culture. Some controls for both customers and suppliers include:

• deploy MFA to mitigate stolen credential abuse
• regularly scan for vulnerabilities and update software to minimise risks from vulnerabilities
• segment networks and enforce account management to isolate critical systems
• correctly configure software to minimise security risks
• use network and endpoint detection systems to identify malicious traffic and files
• monitor logon and network logs to detect unusual activity

To help Australian organisations, ASD has published guidance, available at cyber.gov.au such as Identifying Cyber Supply Chain Risks , Cyber Supply Chain Risk Management , Guidelines for Procurement and Outsourcing , and Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and Default .

Secure-by-design and secure-by-default products

Secure-by-design products are those where the security of the customer is a core business goal, not just a technical feature, and start with that goal in mind before development. Secure-by-default products require little to no configuration changes out of the box to ensure security features are enabled.

Together, these approaches move much of the burden of staying secure to the manufacturers, which reduces the chances that customers will fall victim to security incidents resulting from misconfigurations, insufficiently fast patching, or many other common issues at the user end.

Entities are encouraged to prioritise secure-by-design and secure-by-default products in procurement processes, and collaborate with industry peers and manufacturers to help improve upcoming security initiatives in products. Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and Default , offers further advice to software manufacturers and customers.

Artificial intelligence cyber security challenges

In early 2023, AI tools were among the fastest growing consumer applications globally. Broadly, AI is a collection of methods and tools that enable machines to perform tasks that would ordinarily require human intelligence. AI tools are increasingly being used to augment human activities like sorting large data sets, automating routine tasks, and assisting visual design work.

Machine learning (ML) is a sub-discipline of AI encompassing models that use feedback mechanisms to update model behaviour. ML models are typically used to make classifications and predictions, and to uncover patterns or insights in large data sets that may be impossible for a human to spot.

Over the last 3 years, the practical applications for AI have expanded, the costs have come down, and AI tools are more accessible than ever. Australians already interact frequently with AI, as AI drives internet searching, shopping recommendations, satellite navigation, and can aid complex activities like logistics management, medical diagnosis, and cyber security. AI tools can be used to provide human-like customer responses for help desks or call centres, and can help predict upcoming maintenance for industrial equipment.

While AI has benefited the economy and society, it has also created new challenges and data security risks. As AI becomes increasingly integrated into business environments and ICT infrastructures, additional and potentially unforeseen risks could be introduced. And, like any tool, AI can be misused either inadvertently or deliberately.

In 2022, a medical research collaboration for a pharmaceutical company trained an AI model using ML techniques to catalogue thousands of molecules for therapeutic use while discarding toxic molecules. While the researchers were able to catalogue many beneficial molecules, the researchers also wanted to know how AI could be misused. So they changed the AI model to find toxic rather than safe molecules. Using open source data, their AI model generated over 40,000 potentially lethal molecules in less than 6 hours.

Security researchers have also shown how data sets used for ML can be attacked and ‘poisoned’ with anomalous data to produce misleading outputs. In 2016, Microsoft abruptly ended testing of a chatbot after a subset of its users deliberately provided data containing misinformation and abusive material, resulting in offensive text being produced by the chatbot.

Malicious cyber actors could also use AI tools to augment their activities. For example, a cybercriminal may be able to produce low effort, high quality material for phishing attacks. AI could also be used to create fraudulent deepfake content like voice and video clips, or to create malware. Security researchers have demonstrated with existing technologies that malicious actors could use AI to help orchestrate cyber intrusions.

AI tools may also challenge the protection of sensitive information. For example, AI tools that produce or summarise text may not guarantee data privacy if it is fed sensitive or proprietary information. Additionally, using sensitive information for AI models and ML may contravene privacy laws, policies, or rules in some instances.

As online adversaries can use AI tools, so too can system defenders. AI can sort through large volumes of logs or telemetry data to look for malicious behaviour, identify malware, detect and block exploitation attempts, or derive intelligence insights. AI can also help triage information and automate security tasks, so humans can focus on other problems.

Entities wanting to adopt AI tools should treat them with the same care as any other ICT service, use a risk-based approach to procurement, and consider:

• if the AI tool is secure-by-design and secure-by-default, including its ICT supply chain
• if there are inaccuracies in the AI tool’s model or bias in its algorithms
• how the AI tool will be protected from misuse and interference (including foreign)
• how the AI tool will affect the entity’s privacy and data protection obligations
• how the AI tool will support, rather than outsource, human decision-making
• who is accountable for oversight or if something goes wrong with the AI tool.

Explainer 8: Ethical AI at ASD

In early 2023, ASD published the Ethical AI in ASD statement, which outlines ASD’s framework of ethical principles governing AI usage. This includes:

• lawful and appropriate use of AI consistent with the legislation, policies, processes and frameworks that govern ASD’s functions and protect the privacy of Australian citizens
• enabling human decision-making, allowing our workforce and customers to make informed decisions based on AI system outputs, and to maintain trust in AI systems
• reliable and secure AI, ensuring that technologies continue to meet their intended purpose and remain protected from external interference
• accurate and fair AI mitigating against unintended bias
• accountable, transparent and explainable AI allowing human oversight and control, with clear accountabilities enacted for all stages of the AI development lifecycle, facilitating appropriate and proportionate operations.

Ensuring remote work cyber security

Many organisations rapidly adopted new remote work solutions to support business continuity as a result of the COVID-19 pandemic. The number of Australian companies advertising remote work post-pandemic continues to grow, and it is clear that remote work will be an ongoing feature of many organisations and an expectation of many employees.

Some hastily implemented remote working solutions may not have fully considered cyber security implications. For example, bring-your-own-device policies are popular with organisations, but could introduce additional information management risks to corporate networks if not appropriately managed.

During 2022–23, ASD recorded extensive corporate network breaches that stemmed from employees conducting work from compromised personal devices. In 2022, US company LastPass suffered a data breach due to credentials being stolen via keylogger malware installed on the home computer of one of its employees.

Remote work often relies on employees using their own devices like home computers and internet routers, which usually have limited security features and less secure default settings when compared to enterprise products used in corporate environments. Internal corporate networks could be exposed to the internet directly via a remote employee’s home router, if that home router is misconfigured. Adding to the risks, employees may not regularly update their personal devices or use anti malware software, may access dubious websites or use illegal software, or may have failed to change the default credentials of their devices.

Malicious cyber actors are known to compromise common small-home-office products and internet-of-things devices to steal sensitive information, target corporate networks, or to enslave them into botnets for distributed-denial-of-service (DDoS) attacks.

Organisations should consider how cyber security mitigations for remote solutions are implemented, maintained, and audited. Organisations should also verify that policies are in place to ensure staff know how to securely use systems, and to ensure compliance with legal obligations like the protection of sensitive data.

ASD has published a number of guides at cyber.gov.au including G uidelines for Enterprise Mobility , Remote Working and Secure Mobilit y and Risk Management of Enterprise Mobility (including Bring Your Own Device) .

Explainer 9: Working from home and cybercrime

The Australian Institute of Criminology’s Cybercrime in Australia 2023 report examined whether working from home was a risk factor for cybercrime victimisation. Small-to-medium business owners who transitioned to working from home due to public health measures associated with the COVID-19 pandemic were 1.4 times as likely to be a victim of identity crime and misuse, 1.2 times as likely to be a victim of malware attacks and 1.3 times as likely to be a victim of fraud and scams.

There are various reasons that moving to remote working may have increased the likelihood of cybercrime victims. For a business working remotely, home internet connections may be less secure, devices may no longer be protected by corporate security controls or routine maintenance, and there may be a tendency to store or share sensitive work information on unsecure personal devices.

Cyber security through partnerships

The speed with which cyber threats spread and evolve means that no single entity can effectively defend against all threats in isolation. Cooperation on a national scale is one of Australia’s greatest advantages against malicious cyber activity.

It is vital cyber security incidents are reported to ASD to help build a national cyber threat intelligence picture, which better supports Australian organisations and individuals through informed guidance and mitigation advice. There are many other ways in which Australian organisations can engage with ASD.

ASD’s Cyber Security Partnership Program enables Australian entities to engage with ASD and fellow partners, drawing on collective understanding, experience, skills and capability to lift cyber resilience across the Australian economy. ASD’s Cyber Security Partnership Program is delivered through ASD’s state offices located around Australia.

An ASD Network Partnership is available to organisations with responsibility for the security of a network or networks (either their own or on behalf of customers) as well as academic, research and not-for-profit institutions with an active interest and expertise in cyber security. An ASD Business Partnership is available to those with a valid Australian Business Number. Individuals and families can sign up to the ASD Home Partner Program.

By strengthening our ties with agencies like ASD and broader cyber security partners within the transport and logistics sector, the Toll Group is proud to contribute to building resilient supply chain capability in Australia and around the world. ASD’s partnership, training, and participation in industry forums have been of tremendous value in promoting strong cyber security practices and cooperation across government and critical services, which our teams continue to benefit from. – Toll Group

The National Exercise Program (NEP) helps critical infrastructure and government organisations validate and strengthen Australia’s nationwide cyber security arrangements. The program uses exercises and other readiness activities that target strategic decision-making, operational and technical capabilities, strategic engagement and communications.

The Critical Infrastructure Uplift Program (CI-UP) assists Australian critical infrastructure organisations to improve their resilience against cyberattacks, with a focus on critical infrastructure assets and operational technology environments. As an intelligence-driven program, CI-UP focuses on improving the cyber security of critical infrastructure in a range of areas, including:

• enhancing visibility of malicious cyber activity and awareness of vulnerabilities
• enhancing the ability to contain and respond to an incident
• furthering culture and cyber maturity.

The Cyber Threat Intelligence Sharing Platform (CTIS) shares indicators-of-compromise in real‑time, within a growing community of Australian government and industry partners. CTIS also supports community partners to share their threat intelligence. Co-designed with industry, CTIS alerts security operations centre analysts to threats targeting Australian organisations.

AARNet has been engaged with the CTIS project from its inception and has seen firsthand the value of industry and government partnerships for threat intelligence sharing. By sharing information, the breadth and depth of our visibility of unwanted cyber attention is much greater. – AARnet

The Australian Protective Domain Name System (AUPDNS) is an opt-in security service available to all federal, state and territory government entities to protect infrastructure from known malicious activity. Information from AUPDNS directly assists ASD’s mission to build a national cyber threat picture, which in turn is shared with ASD partners, including individuals, businesses, academia, not-for-profits, and government entities.

The Cyber Hygiene Improvement Programs (CHIPs) track and monitor the cyber security posture of the internet-facing assets of entities at all levels of government. CHIPs also conducts High-priority Operational Tasking (HOT) CHIPs scans when potential cyber threats emerge, such as newly disclosed vulnerabilities. CHIPs builds visibility of security vulnerabilities across governments and provides notifications to system owners.

Figure 7: ASD’s program highlights

Through ASD’s Cyber Security Partnership Program, Australian organisations can draw on the collective understanding, experience and capability of the community to lift Australia’s cyber resilience. ASD Network Partners bring their insights and technical expertise to the community to collaborate on shared threats and opportunities.

Explainer 10: Incident response to stay ahead of adversaries

There is an actor behind every cyber security incident, and each actor will have different intent and capability. For example, state actors are usually focused on long-term goals in opposition to Australia’s national interests, whereas cybercriminals are generally focused on short-term financial gain. Additionally, the techniques different actors use will vary due to their risk appetites for being detected. For example, cybercriminal actions are often ‘loud and public’, as opposed to state actors whose intent is to usually remain undetected for long periods.

Customising the incident response method ensures the best outcome for impacted organisations. For example, during a cyber security incident, ASD can provide immediate incident response advice and assistance to support impacted Australian organisations. ASD can also work closely with commercial incident response partners in support of an incident.

If the incident is likely the result of a state actor, ASD may offer a more detailed approach such as a comprehensive digital forensic technical investigation to ensure comprehensive remediation.

Public communications on an incident may also differ. An immediate public statement may be required in some incidents. However, there is a need to balance public statements with remediation efforts – particularly when a state actor may be involved. If a state actor is responsible, a public statement could cause the actor to ‘lay low’, impacting a defender’s ability to detect the actor – including tradecraft or accesses that may help them to remain on an organisation’s network.

ASD’s tailored approach to incident response is consistent with industry best-practice, and highlights the importance of public–private partnerships to stay ahead of Australia’s cyber adversaries.

ASD’s ACSC Incident Response

ASD’s incident management capabilities provide tailored incident response advice and guidance to Australians impacted by a cyber security incident. ASD is not a law enforcement agency or regulator; however we work closely with these agencies if needed.

Report a cybercrime or cyber security incident

Report at cyber.gov.au/report or call the 24/7 Australian Cyber Security Hotline on 1300 CYBER1 ( 1300 292 371 ).

Cybercrime reports are automatically referred directly to the relevant state or territory law enforcement agency.

Cyber security incidents

All cyber security incidents should be reported to ReportCyber. An incident does not have to be a confirmed compromise to be reported and could include:

• denial-of-service (DoS)
• scanning and reconnaissance
• unauthorised access to network or device
• data exposure, theft or leak
• malicious code/malware
• phishing/spear phishing
• any other irregular cyber activity that causes concern.

For ASD to help you effectively, we may request:

• indicators of compromise
• memory dumps
• disk information
• network traffic captures.

How ASD can help

ASD will provide you with immediate advice and assistance such as:

• tailored information on how to contain and remediate an incident
• advisory products to assist you with your incident response
• linking you with other Australian Government entities that may further support your response such as the Australian Federal Police, or Department of Home Affairs through the National Cyber Security Coordinator and the Cyber Security Response Coordination Unit
• we may also link you to other government partners like IDCare, ScamWatch, or the e-Safety Commissioner.

How your reporting matters

ASD uses information from your report to build our understanding of the cyber threat environment. This understanding assists with the development of new and updated advice, capabilities, techniques and products to better prevent and respond to evolving cyber threats. Some of these products include:

• advisories published on ASD’s Partnership Portal
• alerts published on cyber.gov.au
• quarterly Trends and Insights reports
• the ASD's Cyber Threat Report.

Your confidentiality is paramount

ASD does not share any information provided by you without your express consent. Only information about the incident is captured when you report.

Figure 8: ASD’s support to Australians

During 2022–23, ASD monitored cyber threats across the globe 24 hours a day, 365 days a year, to alert Australians to cyber threats, provide advice, and assist with incident response. ASD’s ACSC is a hub for private and public sector collaboration and information-sharing on cyber security, to prevent and combat threats and minimise harm to Australians.

ASD’s advice and assistance is for the whole economy, including critical infrastructure and systems of national significance, federal, state and local governments, small and medium businesses, academia, not-for-profit organisations and the Australian community.

Cyber resilience for all Australians

The average Australian household has well over a dozen internet-connected devices and this number is growing. The explosion of remote and hybrid work has also seen corporate networks extend into Australian homes. While growing digitisation and virtualisation of services may have improved consumer convenience and boosted business productivity over the last 3 years, it has also increased the cyber risks for Australians.

Every Australian should practice basic cyber security hygiene to help protect themselves from online threats. The most effective cyber defences are also some of the easiest to use and fastest to setup. The top things Australians can do are:

At cyber.gov.au, ASD has published a range of simple how-to guides for all Australians, including children and seniors, that explain how individuals and families can improve their home cyber security.

Australians are encouraged to report cyber security incidents and cybercrime to ReportCyber , or by calling the Australian Cyber Security Hotline on 1300 CYBER1 ( 1300 292 371 ). The hotline is available 24 hours a day, 7 days a week.

Act Now, Stay Secure

ASD provides tailored cyber security guidance to protect Australia against evolving cyber threats. The Act Now, Stay Secure cyber security awareness-raising campaign identified key cyber threats to individuals and small-to-medium businesses, and highlighted ASD advice and tools to help improve the audience’s cyber security posture. Over 2022–23, the campaign:

• reached a potential audience of more than 490,000 Australians and achieved over 11,500 engagements, such as likes, shares, and comments through social media
• was amplified by 170 stakeholders across government, industry, non-profit sectors, and peak body associations, who shared campaign content to their channels
• attracted over 30,000 visitors to the cyber.gov.au website, resulting in nearly 73,000 page views of campaign content and cyber security guidance
• bolstered content delivered at 15 tailored events by ASD state offices.

Monthly cyber security themes were developed to promote planned or new ASD guidance, tools and products to enhance the cyber posture of Australian individuals and small-to-medium businesses. The themes for 2022–23 were:

REDSPICE is the most significant single investment in ASD’s history and will equip ASD to ensure that Australia is best prepared to respond to the strategic environment. Commencing on 1 July 2022, ASD scaled existing services and introduced new intelligence and cyber capabilities to enhance Australia’s cyber defences.

To help achieve this, in FY 2022–23, ASD opened new facilities in Brisbane and Melbourne, and received over 26,000 job applications across Canberra, Melbourne, Brisbane and Perth. ASD also:

• undertook innovative first-of-type ‘cyber hunt’ activities on the most critical government and critical infrastructure networks
• engaged over 175 new customers onto the Cyber Threat Intelligence Sharing platform to improve machine-speed cyber threat intelligence sharing across government and industry
• deployed over 25,000 new host-based sensors to customer networks to build increased visibility of emerging threats to Australia’s most critical systems
• established a secure design and architecture team to provide advice to major government information and communications technology projects
• expanded ASD’s national incident response footprint and 24/7 defence operations capability, including additional upgrades for the Australian Cyber Security Hotline (1300 CYBER 1) and ReportCyber, and a new incident response team in Melbourne
• improved the resilience of critical infrastructure through a number of uplift activities to increase cyber security maturity across Australian industry.

About the contributors

ASD manages or uses a number of unique datasets to produce tailored advice and assistance for Australian organisations and individuals. Not all cybercrimes lead to cyber security incidents, and the statistics in this report are from 2 distinct datasets: cybercrimes reported to law enforcement through ReportCyber, and cyber security incidents responded to by ASD. Data has been extracted from live datasets of cybercrime and cyber security reports reported to ASD. As such, the statistics and conclusions in this report are based on point-in-time analysis and assessment.

Cybercrime and cyber security incidents reported to ASD may not reflect all cyber threats and trends in Australia’s cyber security environment.

ASD encourages the reporting of cyber security incidents and cybercrimes to inform ASD advice and assistance to vulnerable entities, and enhance situational awareness of the national cyber threat environment.

Defining cybercrimes

In Australia, the term ‘cybercrime’ is used to describe both:

• Cyber dependent crimes, such as computer intrusions and DoS attacks, directed at computers or other ICTs.
• Cyber enabled crimes, such as online fraud, identity theft and the distribution of child exploitation material, which can increase in their scale and/or reach through the use of computers or other forms of ICTs.

The ASD glossary provides definitions for terms used in this report and other ASD publications and can be viewed at: https://www.cyber.gov.au/learn-basics/view-resources/glossary .

Thanks for your feedback!