Are ransomware attacks slowing down? Absolutely not, according to a new research report “2022 Impacts: Ransomware attacks and preparedness,” released by Menlo Security on August 3.
In fact, Menlo, a cloud security company based in Mountain View, California, found that a one-third of organizations experience a ransomware attack at least once a week, with one in 10 experiencing them more than once a day, stated a news release.
For its report, Menlo Security commissioned SAPIO Research in June 2022 to conduct the research using an email invitation and online survey. SAPIO queried more than 500 IT security professionals in the U.S. and U.K. from companies of more than 1,000 employees.
When Menlo asked respondents “what keeps them awake at night,” 41% said they “worry about ransomware attacks evolving beyond their team’s knowledge and skillset.” Also, 39% “worry about attacks evolving beyond their company’s security capabilities.”
Forty-six percent said their biggest concern is the risk of employees ignoring corporate security advice and clicking on links or attachments containing malware, according to the report. Comparatively, only 26% of respondents are worried about losing their job.
More findings from the Menlo Security report include:
Mark Guntrip, senior director of Cybersecurity Strategy at Menlo Security, added perspective to the survey results:
“Security professionals are coming under increasing pressure as organizations face an unprecedented number of highly sophisticated threats like ransomware. On the frontline of cyber defense, they are often coping with huge amounts of stress, worrying about what employees are doing, their team and whether they are getting the right support internally, so it’s no surprise they are prioritizing the business over job security. Indeed, the burnout and high churn rate of CISOs is widely reported.”
Ransomware Recovery Costs Underestimated
There is a growing disparity between the perceived cost and actual cost of recovering from a ransomware attack among security professionals, according to the report. The findings note that the average estimated cost of a ransomware attack on a business is more than $326,531. Moreover, insurance payouts can average approximately $555,000.
However, Menlo Security reports that a “significant minority” (24%) admit they don’t know the value of their insurance policy or if they even have coverage. Menlo notes industry figures that show the average total cost of recovery from a ransomware attack in 2021 was $1.4 million.
To Pay or Not to Pay
Should an organization pay a ransomware demand? The survey found that 32% of decision-makers worry about the risk of paying a ransomware demand and not getting their data back. However, nearly two-thirds of respondents said they would pay a ransomware demand.
There is a disparity of opinion on who should pay ransom, or if it should be paid at all:
Guntrip explained that paying a ransomware demand depends on your level of preparedness:
“Do you have the right processes and strong backup in place? If so, you won’t need to pay it. If, however, your organization is unable to function as normal, access data or the damage is likely to bring down the business, that’s when you need to re-evaluate your options. With organizations adopting new ways of working and today’s Highly Evasive Adaptive Threats (HEAT), now is the time to re-examine your security structures to make sure you stop attacks before they even happen.”
