According to the latest Allianz Risk Barometer report, cyber breaches represent the number one global business risk in 2024. What’s more, this is the third consecutive year that cyber has achieved such a vaunted position.
The anxiety that business leaders are feeling is valid, and the risk is real. Businesses today face increased threat vectors, including the use of AI for more effective attacks, heightened incidence of cyberwarfare from state-associated actors such as those from Russia and Iran, and cybercrimes from opportunistic hackers.
Splunk‘s 2023 CISO Report found that 96% of respondents had been affected by a ransomware attack in the past year, with 52% experiencing one that significantly impacted their business systems and operations.
On top of that, organizations are arguably becoming more vulnerable over time. Networks are bigger and more complex, offering larger attack surfaces with numerous entry points. The rise in third-party code, extended supply chains, and interconnected networks create more possible access points through a third party. At the same time, businesses have to comply with ever-more regulations, with the attendant threat of prosecution and loss of trust for non-compliance.
The consequences of any cyber incident can be significant. In 2023, data breaches cost organizations an average of $4.45 million per incident, according to IBM, and Apple reports that the first 9 months of 2023 alone saw almost 20% more breaches than the entirety of 2022. That doesn’t include lingering damage to a business’ reputation that puts off customers and partners.
Not surprisingly, cyber leaders are aware of these risks and are taking action. We’re not seeing many organizations sticking their heads in the sand, and virtually everyone realizes that it’s vital to mitigate risk as much as possible.
These are the actions that I’m seeing businesses taking after three years of peak cyber risk.
A more holistic approach to cyber risk
The last couple of years have brought a rise in combined cyber GRC (cyber governance, risk, and compliance) teams, integrating cybersecurity into their existing risk monitoring and regulatory compliance frameworks. This stems from recognition that cyber risks need to be assessed as an integral part of overall business risk, rather than being isolated as merely a procedural IT concern.
Business leaders are also reshaping their cybersecurity strategies in the face of more dynamic cyber threats. A more holistic attitude to cybersecurity includes integrating risks, policies, tools, data, people, processes, and technologies, in order to gain unified visibility and correlate business risks with cybersecurity programs.
AI and automation for faster responses
AI is part of both the problem and the solution as far as cyber business risks are concerned. While hackers are using generative AI to speed up attacks and improve phishing attempts, businesses are also adopting it to strengthen their defenses. Splunk reports that 35% of CISOs are already using AI for security applications, and 61% say they expect to apply it within the next 12 months.
AI-powered continuous monitoring means faster alerts that notify IT and cybersecurity teams about the earliest signs of penetration or emerging vulnerabilities. Automated remediation solutions can resolve issues, isolate areas of the network, change user access permissions, and apply patches and fixes independently. As a result, organizations see swifter reaction times and shorter MTTR, helping raise their resilience.
Extending the threat horizon
Real-time threat intelligence and AI-powered predictive analytics open up unprecedented visibility into the cyber threat landscape. Organizations are able to spot emerging threats before they become a serious and immediate danger.
This provides them with more time to decide on the best way to respond, and allows them to choose from a greater range of options in combating threats. Greater foresight into potential vectors and means of attack also increases agility in handling digital risks.
Risk prioritization
In the face of so many threats from so many possible directions, businesses are coming to the harsh realization that they can’t prevent all of them. This knowledge frees them to focus on those that pose the greatest threat, prioritizing their capabilities and directing their energies towards risks that bring the biggest potential fallout.
Today, risk prioritization involves a combination of AI and cyber intelligence modeling, in order to measure the possible impact and complexity of the many threats on the horizon. At the same time, it requires a new level of unity between organizations. Enterprises are working together to share intelligence about threats, attack tactics, and effective methods of defense and protection against major sources of danger.
Awareness training
It’s long been true that your employees are your greatest vulnerability. It just takes one weak password or clicked link to bring down the strongest of defenses. Enterprises are investing more in awareness training to ensure that every worker recognizes the risks.
According to Cybersecurity Ventures, the global security awareness training market will exceed $10 billion annually by 2027, based on 15% year-over-year growth from around $5.6 billion in 2023. This is light-years away from its $1 billion value just a decade ago. There’s particular focus on phishing awareness, as AI unleashes more sophisticated and authentic deepfakes.
Changing attitudes to cyber risk may not be enough
Given the dire consequences of a data breach or successful cyber attack and the multiplicity of threat vectors, it’s only to be expected that enterprises are upping their defenses and implementing new protections against cyber risk. But while these measures are consequential, there is no room for complacency. Enterprises need to continue to do more to prepare and mitigate cyber risks, applying new strategies, technologies, and tactics to improve their risk postures.
Arik Solomon is the CEO and Co-founder of Cypago, enabling companies to streamline and automate their processes and workflows around cyber governance, risk and compliance (GRC). He has more than 30 years of executive experience in the cybersecurity, consulting, and software development sectors, including as Chief Technology Officer of EY Israel, VP R&D and VP Security & Deep Learning at Deep Instinct, and VP Services at Mirato.