Ransomware Report: Most Organizations Unprepared for an Attack, Lack Incident Playbook, Axio Research Finds -

Some organizations have made significant improvements to their ransomware readiness profile in the last year, Axio said in a newly released report. However, a lack of fundamental cybersecurity practices and controls, inadequate vulnerability patching and employee training continues to leave ransomware defenses lacking in potency.

Key Deficiencies Identified

Axio's report reveals that only 30% of organizations have a ransomware-specific playbook for incident management in place. In 2021’s report Axio, maker of a cloud-based cyber management software platform, identified seven key areas emerged where organizations were deficient in implementing and sustaining basic cybersecurity practices.

The same patterns showed up in the 2022 report:

Managing privileged access

Improving basic cyber hygiene

Reducing exposure to supply chain and third-party risk

Monitoring and defending networks

Managing ransomware incidents

Identifying and addressing vulnerabilities in a timely manner

Improving cybersecurity training and awareness

Ransomware Preparations Lacking

Overall, most organizations surveyed are not adequately prepared to manage the risk associated with a ransomware attack. Key data findings include:

The number of organizations with a functional privileged access management solution in place increased by 10% but remains low at 33% overall.

Limitations on the use of service and local administrator accounts remain average overall, with nearly 50% of organizations reporting implementing these practices.

Approximately 40% of organizations monitor third-party network access, evaluate third-party cybersecurity posture, and limit the use of third-party software.

Less than 50% of respondents implement basic network segmentation and only 40% monitor for anomalous connections.

Critical vulnerability patching within 24 hours was reported by only 24% of organizations.

Active phishing training has improved but is still not practiced by 40% of organizations.

David White, Axio president and co-founder, offered his take on the report:

"Ransomware continues to wreak havoc on global organizations, regardless of size or industry,” "Success in ransomware intrusion and organizational impact continues to be impeded by the failure to implement and institutionalize the most fundamental cybersecurity practices. As the number of attacks will most likely continue on an exponential trajectory, it’s more important than ever for companies to re-evaluate their cybersecurity practices and make the needed improvements to help combat these attacks.”