As long as the cybercriminals’ business model works, companies are vulnerable to attack