2016 Cyberthreat Defense Report: What is keeping IT awake at night?

It shouldn’t surprise anyone that more organizations were victims of a successful cyber-attack in 2015. More than half (62%) of respondents expect their organization to be compromised by a successful cyber- attack in 2016, up from 39% two years ago.

The increase in successful attacks is contributing to the overall increase in IT security spending, with a third of the organizations spending more than 16% of their total IT budget. There is even evidence that board-level-attention is helping to increase IT spending on security.

Does more spending mean more protection?
Spending on advanced malware analysis technology (63.5%) trailed only signature-based antivirus/anti-malware technology (70.5%), but the confidence in handling malware threats is dwindling. The effectiveness and value of traditional endpoint security solutions are finally being questioned, but the damage is done from a spending perspective. A whopping 86% of the respondents are dissatisfied with their endpoint security solutions. The two are closely related when keeping data breaches in context. The cause and effect are evident in the California data breach report for 2015, where malware and hacking are the primary drivers for the increase in data breaches.
Barriers to Establishing Effective Defenses



The Achilles heel in IT security remains the user/employees. The above graph brings out every issue that exists in today’s approaches – too much data, lack of contextual information, too many false positives and lack of effective solutions. Today’s threat actors have a seemingly endless capacity to advance their wares and only need to find a single weak spot. Employees (or more generally, users) register themselves as the weakest link in organizations’ ability to establish effective cyber threat defenses for three consecutive years now. We have seen time, and again that employee training is not a practical solution, even executives are susceptible to spear phishing “whaling” attacks.
“The financial sector showed the greatest susceptibility to breaches caused by insiders (employees, service providers), both through unintentional errors and intentional misuse of privileges.” –California data breach report for 2015
A Better Solution
There has to be a paradigm shift when it comes to IT security. Data breaches are bound to happen; the focus has to shift from prevention to detection. There are signs of this change as evidenced by increased desire to acquire threat intelligence-based security solutions and user behavior analytics/activity monitoring. The mindset has to change towards monitoring data access and bubbling up suspicious behavior/activity.
For more information, please read the full 2016 Cyberthreat Defense Report here.