Research commissioned by Cohesity shows that business process and data recovery difficulties are forcing the majority of impacted companies to pay ransoms and break their ‘do not pay’ policies.
The research, polled from over 900 IT and security decision-makers, shows that companies firmly operate in a ‘when’, not ‘if’, reality of cyber attacks. In fact, most companies have paid a ransom in the last two years and 79% of respondents said that their company had been the ‘victim of a ransomware attack’ just in the months between June and December 2023.
The cyber threat landscape is expected to get even worse in 2024, with 96% of respondents saying the threat of cyber attacks to their industry will increase this year and over 7 in 10 (71%) predicting it will increase by more than 50%.
Organizations’ attack surfaces are informed by the size and scope of their data environments. However, 78% of respondents said their data security risk has now increased faster than the growth in the data they manage. Respondents also believe that organizations’ cyber resilience and data security strategies are not keeping up with the current threat landscape, with just 21% having full confidence in their company’s cyber resilience strategy and its ability to ‘address today’s escalating cyber challenges and threats’.
Slow data recovery and lack of cyber resilience results in ransom payments
Cyber resilience is the technology backbone for business continuity. It defines companies’ ability to recover their data and restore business processes when they suffer a cyber attack or adverse IT event. However, according to respondents, every company has cyber resilience and business continuity challenges:
- All respondents said they need over 24 hours to recover data and restore business processes.
- Just 7% said their company could recover data and restore business processes within 1-3 days.
- 35% said they could recover and restore in 4 to 6 days, while 34% need 1-2 weeks.
- Alarmingly, almost 1 in 4 (23%) need over 3 weeks to recover data and restore business processes.
Further demonstrating cyber resilience gaps, just 12% said their company had stress-tested their data security, data management, and data recovery processes or solutions in the six months prior to being surveyed, and 46% had not tested their processes or solutions in over 12 months.
Unsurprisingly, 94% of respondents said their company would pay a ransom to recover data and restore business processes, while 5% said ‘maybe, depending on the ransom amount.’ More than 2 in 3 (67%) said their company would be willing to pay over $3 million to recover data and restore business processes, with 35% of respondents saying their company would be willing to pay over $5 million. The research also showed the importance of being able to respond and recover, as 9 in 10 said their organization had paid a ransom in the prior two years, despite 84% saying their company had a ‘do not pay’ policy.
Organizations can’t control the increasing volume, frequency, or sophistication of cyber attacks such as ransomware. What they can control is their cyber resilience, which is the ability to rapidly respond and recover from cyber attacks or IT failures by adopting modern data security capabilities.
Brian Spanswick, chief information security officer and head of IT, Cohesity
Executive management does not fully understand the potential scope of successful cyber attacks
Respondents identified executive awareness and responsibility for data security as two areas for companies to improve, with just 35% saying their senior and executive management fully understands the ‘serious risks and daily challenges of protecting, securing, managing, backing up, and recovering data.’ Four in five said executive management (C-Level) and boards should share the responsibility for their company’s data security strategy, while 67% said their company’s CIO and CISO, in particular, could be better aligned.
Prioritizing their biggest concerns about a successful data breach or cyber attack, respondents selected brand and reputational damage (34%), a drop in share price / investment / profitability (31%), a direct hit to revenue (30%), and a loss of stakeholder trust (30%). When asked who is most impacted by a data breach or cyber attack, respondents said existing customers (29%), the security team (29%), the IT team (28%), employees (28%), and their third-party partners (27%) were most impacted.
