Ransomware hijackers’ “pay up or else” demands and extortion fees are “massively” increasing while organizations' trust in legacy vendors is slipping and their cyber incident detection time is slowing, a recent CrowdStrike study showed.
Here are some highlights from the cybersecurity provider’s fourth Global Security Attitude Survey of 2,200 senior IT decision makers and IT security professionals:
What about trust and supply chain attacks?
- 63% are losing trust in legacy vendors due to frequent security incidents.
- 77% have suffered a supply chain attack.
- 45% experienced at least one supply chain attack in the past 12 months.
- 64% cannot claim that all their software suppliers have been vetted in the last 12 months.
- 84% fear supply chain attacks will become one of the biggest cybersecurity threats in the next three years.
What about ransomware?
- Ransomware remains a persistent and highly pervasive threat, costing organizations nearly $2 million on average.
- Average ransomware payments increased 63% in 2021 to $1.79 million from $1.1 million in 2020.
- 96% of organizations that paid a ransom were forced to pay additional extortion fees, costing businesses on average nearly $793,000.
- 66% of organizations suffered at least one ransomware attack in the past 12 months.
- 57% of businesses don't have a comprehensive ransomware defense strategy in place.
- The average ransomware payment was $1.34 million in EMEA, $2.35 million in APAC and $1.55 million in the U.S.
What about detection and response times?
- On average, it takes organizations 146 hours to detect a cybersecurity incident in 2021, up 25% from 117 hours in 2020.
- Once detected, it takes organizations 11 hours to triage, investigate and understand a security incident and 16 hours to contain and remediate.
- 69% of organizations suffered an incident because of staff working remotely.
“Today’s threat environment is costing businesses around the world millions of dollars and causing additional fallout,” said Michael Sentonas, chief technology officer at CrowdStrike. “This presents a clear clarion call that businesses need to change the way they operate and evaluate more stringently the suppliers they work with,” he said.
