When it comes to organizations’ digital defense posture, many enterprise security practitioners are overwhelmed by the scale and tenacity of external digital threats—and they lack confidence in their processes, systems and tools.
That’s according to RiskIQ’s 2017 State of Enterprise Digital Defense Report, which found that an average of 40% of organizations experienced five or more significant security incidents in the past 12 months among most cited external threats: malware, ransomware, phishing, domain and brand abuse, online scams, rogue mobile apps and social impersonation. Across industries, an average of 35 tools are employed to thwart web, social and mobile threats.
Big brands in banking, retail and consumer goods had the most prevalence of attacks, and digital threat management appears more progressive among organizations in financial services, manufacturing and consumer goods, as expressed by overall expenditure. Larger companies felt that they were better able to update control systems and collaborate across departments, perhaps showing the benefits of scale; while smaller companies felt best able to inform others about the status of external attacks, perhaps reflecting the benefits of having a smaller base to worry about.
Although confidence in IT security management appears optimistic, overall survey findings showed a contradiction in efficacy and likely investment compared to where incidents have been most impactful. About 68% of respondents express no to modest confidence to manage digital threats, and 70% of respondents have no to modest confidence in reducing their digital attack surface, expressing the least confidence in threats against web, brand and ecosystem assessment.
From a vertical perspective, about a quarter (24%) of healthcare and pharmaceutical respondents felt little to no confidence in their ability to assess digital risk.
"While the results were both eye-opening and disturbing, the survey findings and insights should empower corporate leadership and IT security professionals to examine how their organizations are protecting their businesses, customers, and brands, and fortifying digital transformation," said Martin Veitch, editorial director at IDG Connect, which carried out the research.
The results were not without shimmers of positivity as organizations expressed a substantive increase in buying tools and managed services. The majority of those surveyed are aware that some of their digital security measures are immature or ineffective, with only 31% expressing high confidence in the likelihood that their organizations can mitigate or prevent digital threats—despite all respondents increasing their near-term digital security spend. Over half of survey respondents expect their near-term digital defense investment to increase between 15 to 25% or higher.
Correspondingly, nearly half of respondents view cyber-threat intelligence as ‘very important,’ and all respondents saw cyber-threat intelligence tools as being very important or somewhat important—especially in fortifying research and in reducing time to respond to external threats. When asked about the value gained by integrating digital threat intelligence and management tools to other security control tools, firewalls, security event management and logging, risk assessment, systems management and orchestration were regarded as benefiting the most.
“The findings validate the need for enterprises to leverage cross-channel intelligence, automation, and resource optimization as they build out digital defenses to reduce operational and reputational risk,” said Scott Gordon, CMO at RiskIQ.