One in five organisations faced bankruptcy after a cyberattack. What defines mature cyber defence readiness?

We all know that cybersecurity is a key element of business risk. But exactly how critical is it? Global insurer Hiscox has released a Cyber Readiness Report, claiming that in fact, many organisations come close to bankruptcy following a security breach. While spending is increasing, there are fewer companies globally that can be called cyber defence "experts" than ever before. Knowing how to invest in cybersecurity is more important than ever. The report says that the way experts avoid bankruptcy largely comes down to the basics of best practice and a willingness to learn from past incidents.

▌Existential Threat

The report was compiled from interviews with 5,000 businesses across eight countries, including the US, the UK, and Belgium. Some of the conclusions are not surprising to us, such as:

Seven out of eight countries list cyber attacks as the number one threat to their business;
Half (48%) of respondents reported a cyber attack in the past 12 months, up from 43% last year;
One in five (19%) respondents reported a ransomware attack, with two-thirds of victims paying the attackers.

These findings may seem familiar to us, however, there is a huge perception gap between those who have been attacked and those who have not. More than half (55%) of cyber attack victims see cybersecurity as a high-risk area, but for those who have not experienced a threat, only 36% share this perception. Similarly, 41% of those attacked said their risk exposure had increased, compared to less than a quarter (23%) for the other group.

Another interesting phenomenon is that cybercriminals seem to be increasingly targeting small companies. Companies with revenues between $100,000 and $500,000 are likely to suffer as many attacks as those with annual revenues between $1 million and $9 million.

▌Cost Accounting

This is important because one in five response companies hit by an attack said their solvency had been challenged, a 24% increase from last year. Although not detailed in the report, the cost of a breach may include:

Operational disruption
Legal fees
IT overtime and third-party forensic costs
Regulatory fines
Customer churn
Lost production and sales
Long-term reputational damage

This perhaps explains part of the reason for the increase in security spending. The report says respondents' average cybersecurity spend grew 60% over the past year to $5.3 million, and has grown 250% since 2019.

▌How Do Attackers Compromise Organisations?

To better understand how organisations can avoid bankruptcy, we first need to understand how attackers cause so much damage. According to the report, the primary attack vectors are:

Cloud servers (41%)
Business email (40%)
Corporate servers (37%)
Remote access servers (31%)
Employees' mobile devices (29%)
DDoS (26%)

This tallies with the findings of other reports and shows that remote working, pandemic-related cloud infrastructure investments, and remote working security challenges are some of the biggest risks facing organisations today. Combined with human error, these risks create a massive attack surface for attackers.

▌How Should Organisations Respond?

Worryingly, Hiscox's estimated cyber readiness score fell 2.6% year-on-year, leading to a sharp drop in the number of companies classified as "experts", from 20% to 4.5%. The proportion classified as novices also fell significantly, with the majority falling into "intermediate". According to the report, cyber defence preparedness is important because the median cost of an attack as a percentage of revenue is two and a half times higher for companies rated as "cyber novices". So what does mature cyber defence preparation look like? It doesn't actually depend entirely on the amount of money invested. Key recommended best practices include:

Formalising cybersecurity within the organisation
Ensuring senior management has a clear understanding of and involvement in cybersecurity
Following best practice standards, such as the NIST framework
Spreading investment across NIST's five key functions – Identify, Protect, Detect, Respond, and Recover
Focusing on incident response plans and attack simulations
Regularly assessing corporate data and technical infrastructure
Providing effective cybersecurity awareness training
Ensuring business vendors and partners adhere to security requirements
Adopting easily accessible measures, such as patching, penetration testing, and regular backups

These steps will help minimise the likelihood of a cyber attack bankrupting an organisation. The services provided by Securitycues to enterprises help organisations evaluate shortcomings in their own security defence products and systems by continuously simulating real cyber attacks, timely alerting to the impact of security drift caused by frequent changes in the IT environment, and enabling organisations to respond quickly. Through the verification results of continuous attack simulation, enterprises can optimise security defence measures and configurations in a targeted manner. The Securitycues Security Metric Validation Platform provides corresponding perspective interfaces for different roles within the organisation, ensuring that personnel at all levels can understand and communicate the current state of security efforts.