Reasons Why Companies Don't Make Cybersecurity Improvements Until After an Attack

According to the Cisco Annual Cybersecurity Report 90% of companies that experienced an attack took steps to improve it after an attack had occurred. While better late than never applies here, it is certainly in an organization’s best interest to prevent it in the first place.

That’s because attacks are evolving and increasing in volume. Forty four percent of the managers asked in the study said they receive over 5,000 alerts in a given day. Unfortunately, they don’t have time to look into all of them. Only 56% are investigated and fewer than 50% are actually remediated.

Malvertising campaigns have started employing middlemen (brokers) to constantly change up the servers used to mask their activity. Botnets that send spam messages are on the rise and according to a report by Malwarebytes, botnets made big strides in 2016. Kaspersky Labs deemed these the biggest threat to the Internet, beating out viruses, worms, and other types of malware. The Cisco report found that two-thirds of the email received was spam. Of that, 8-10% was classified as malicious. That’s a lot of opportunity for phishing and spear-phishing to succeed.

The companies in the report that took steps to prevent future successful attacks all had three things in common, suggesting these should be priorities for all companies. 

• Separate IT and security functions.
• Add additional security awareness and training for employees.
• Implement risk mitigation techniques.

Of course, there are barriers to getting these done. Often, until something happens, it’s difficult to justify what steps should be taken and the reasons for not taking these steps beforehand may sound quite familiar: 35% said it was due to budget constraints; product compatibility and lack of sufficient certifications accounted for 28% each; and a lack of trained talent was the response from 25% of those surveyed.  In addition, many cited the sheer complexity of security environments these days. Sixty five percent of the companies said they use between 6 and 50 products.

However, there are ramifications for not trying to get ahead of attackers. Of the organizations in the Cisco report, 22% lost customers, 23% lost business opportunities, and 29% lost revenue due to the cybersecurity incident. Perhaps those figures are enough to get the measures into the next budget.