Why is trust in legacy vendors on shaky ground?

A Vanson Bourne survey report highlights ransomware payout demands and extortion fees are massively increasing, while trust in legacy IT vendors has dipped and organizations are in fact getting slower at detecting cybersecurity incidents.

“The survey presents an alarming picture of the modern threat landscape, demonstrating that adversaries continue to exploit organizations around the world and circumvent outdated technologies. Today’s threat environment is costing businesses around the world millions of dollars and causing additional fallout,” said Michael Sentonas, CTO at CrowdStrike.

“The evolving remote workplace is surely accentuating challenges for businesses as legacy software like Microsoft struggles to keep up in today’s accelerated digital world.”

“This presents a clear clarion call that businesses need to change the way they operate and evaluate more stringently the suppliers they work with,” added Sentonas. “The threat landscape continues to evolve at a frightening pace and it’s obvious that modern organizations need a cloud-native, holistic end-to-end platform approach to tackle and remediate threats in a swift manner.”

Customers losing trust in legacy vendors

Recent attacks such as Sunburst and Kaseya have once again brought supply chain attacks to the forefront as evidenced by 63% of respondents admitting their organization is losing trust in legacy vendors, like Microsoft, due to frequent security incidents against these previously trusted technology suppliers.

The issue is so widespread that 77% respondents have suffered a supply chain attack. It’s clear that swift action and newer technologies will be required by businesses looking to increase their cyber resiliency.

• 45% of respondents had experienced at least one supply chain attack in the past 12 months.
• 64% of respondents cannot claim that all their software suppliers have been vetted in the last twelve months.
• 84% of respondents are fearful of supply chain attacks becoming one of the biggest cybersecurity threats in the next three years.

Ransomware remains a persistent and highly pervasive threat

Survey data indicates that ransomware attacks are continuing to prove effective, with average ransomware payments increasing 62.7% in 2021 (from $1.1 million in 2020 to $1.79 million in 2021). Not only that, organizations are almost universally getting hit with “double extortion,” when threat actors not only demand a ransom to decrypt data, they additionally threaten to leak or sell the data unless the victims pays more money.

Survey data shows that 96% of organizations that paid a ransom were forced to pay additional extortion fees, costing businesses on average $792,493. Additional notable findings include the following:

• 66% of respondents’ organizations suffered at least one ransomware attack in the past 12 months.
• 57% of businesses did not have a comprehensive ransomware defense strategy in place.
• The average ransomware payment was $1.34 million in EMEA and $2.35 million in APAC and $1.55 million in the US.
• The average ransom payment increased by 63% in 2021 to $1.79 million, compared to $1.10 million in 2020. The average ransom demand from attackers is $6 million. While attackers aren’t getting quite the amounts they are seeking, they are still earning massive payouts. This is attributed to companies understanding both the threat and their exposure, and their ability to negotiate with attackers.

Organizations facing challenges in detecting security incidents

Organizations are encouraged to strive to meet the 1-10-60 rule, where security teams demonstrate the ability to detect threats within the first minute of an intrusion, investigate and understand the threat within 10 minutes, and contain and eradicate the threat within 60 minutes. In today’s remote-first digital world, organizations continue to face massive challenges in detecting security incidents, as evidenced by eye-opening survey data.

• On average, respondents estimated it would take 146 hours to detect a cybersecurity incident, from 117 hours in 2020.
• Once detected, it takes organizations 11 hours to triage, investigate and understand a security incident and 16 hours to contain and remediate one.
• 69% of respondents said that their organization suffered an incident because of staff working remotely.