ExtraHop, a leading provider of cloud-native network detection and response (NDR) solutions, recently unveiled their third annual Global Cyber Confidence Index. Generally speaking, the report found that most organizations are struggling to manage and mitigate cyber risks, even as they face a growing number of ransomware attacks and incident-related downtime. Some key findings from the research includes:
- 88 percent of IT and cybersecurity decision makers said they are confident in their organizations’ ability to manage cyber risk.
- 22 percent of respondents deemed ransomware the biggest risk to their organization.
- About half say they are still running at least one insecure network protocol that threat actors are known to exploit in ransomware attacks.
- 58 percent said they experienced six or more ransomware incidents in 2023 (up 32 percent year-over-year).
- 91 percent of those who experienced a ransomware attack paid up, compared to 83 percent in 2023 and 72 percent in 2022. On average, the research found ransomware payments alone cost nearly $2.5 million per organization in the last year.
- Respondents said they averaged 56 hours of downtime following a security incident.
- The cited barriers restricting effective cyber risk management included immature risk management processes (21 percent), the inability to catch up in a fast-paced industry (18 percent), a lack of alignment between the cybersecurity organization and the business (16 percent), outdated technology (15 percent), insufficient personnel resources (14 percent), and insufficient budgets (13 percent).
- 38 percent feel using AI and machine learning to help manage and mitigate cyber risk is a top priority for their organization.
ExtraHop also provided Manufacturing.net with some manufacturing-specific data:
- 58 percent of respondents in this sector experienced more than six ransomware incidents in the last year, and 40 percent experienced 10 or more. Of these repeat victims, 91 percent paid the ransom at least once, with 55 percent paying about half the time. Additionally, while 28 percent said they never paid in 2022, that number shrank to 17 percent last year. Furthermore, 63 percent said they paid between $500K – $1M in ransom in 2023.
- 32 percent of manufacturers believe Immature cyber risk management processes are the biggest barrier to effectively managing cyber risk.
- 42 percent are seeking a 10 percent increase in cyber budgets.
- 17 percent say more than half of cyber incidents are linked to poor cyber hygiene.
I was also able to sit down with Jamie Moles, senior technical manager at ExtraHop to get some additional insight.
Jeff Reinke, editorial director: Respondents cited that they are “falling behind when it comes to identifying and remediating threats.” Why do you think this is still the case?
Jamie Moles, ExtraHop: Our research shows a majority of respondents are confident in their organization’s ability to manage cyber risk, yet they continue to be plagued by ransomware, and admit many cybersecurity incidents are related to poor cyber hygiene practices. This overconfidence and limited ability to build business resilience indicate many organizations are falling behind in both detecting and mitigating threats. And with calls for an increased budget, it’s clear respondents want to make investments to limit exposure to threats.
JR: When “half say they are still running at least one insecure network protocol that threat actors are known to exploit in ransomware attacks” – does this stem from not knowing how to fix the vulnerability? A lack of tools? Something else?
JM: A lack of visibility into their organization’s network and infrastructure can limit the ability to identify insecure network protocols. The security industry is also impacted by burnout as security teams manage multiple solution dashboards while protecting critical data and infrastructure. Removing insecure network protocols, which is typically the work of network and server teams, simply may not be a top priority for either side of an organization’s IT team, compared to other more critical tasks that need more attention.
JR: The continued increase in the number of companies paying the ransom is alarming. Does this stem from simply wanting to get up and running again? Double-extortion tactics? Not having a response plan in place? A combination of these, or something else?
JM: The uptick in ransomware payments is from a multitude of factors. Some companies might not be paying to decrypt their files so much as to prevent stolen data from being released to the public, while others can see it as the more reasonable economic decision as opposed to the staggering, unrealized costs of post-incident recovery. Once ransomware takes hold of an organization’s data, there is no turning back, and the fact that more than 9 in 10 are paying the ransom signals the need for improved detection capabilities to mitigate these types of cyber risks.
JR: Which of the cited “barriers holding them back from effectively managing cyber risk” do you feel is the most troublesome? The easiest to rectify?
JM: Lack of alignment between the business and cybersecurity is a red flag because it indicates non-security-focused business leaders are not on the same page as their counterparts. Building business resilience requires great cyber hygiene and cooperation across an organization, and without it, businesses will continue to fall victim to ransomware and other cyber incidents. However, as our research shows, nearly 3 in 5 executives are involved in cyber risk governance, and more organizations are on the right path to rectify this barrier.
