Despite higher levels of investment in advanced cyber security technologies over the past three years, less than one-fifth of organizations are effectively stopping cyber attacks and finding and fixing breaches fast enough to lower the impact, according to a new report from Accenture.
Based on a survey of more than 4,600 enterprise security practitioners around the globe, Accenture’s Third Annual State of Cyber Resilience study explores the extent to which organizations prioritize security, the effectiveness of current security efforts, and the impact of new security-related investments.
From detailed modeling of cyber security performance, the study identified a group of elite ‘leaders’ — 17 percent of the research sample — that achieve significantly better results from their cyber security technology investments than other organizations. Leaders were characterized as among the highest performers in at least three of the following four categories: stop more attacks, find breaches faster, fix breaches faster and reduce breach impact. The study identified a second group, comprising 74 percent of the respondents, as ‘non-leaders’ — average performers in terms of cyber resilience but far from being laggards.
“Our analysis identifies a group of standout organizations that appear to have cracked the code of cyber security when it comes to best practices,” said Kelly Bissell, who leads Accenture Security globally. “Leaders in our survey are far quicker at detecting a breach, mobilizing their response, minimizing the damage and getting operations back to normal.”
For instance, leaders were four times more likely than non-leaders to detect a breach in less than one day (88 percent vs. 22 percent). And when defences / defences fail, nearly all (96 percent) of the leaders fixed breaches in 15 days or less, on average, whereas nearly two-thirds (64 percent) of non-leaders took 16 days or longer to remediate a breach — with nearly half of those taking more than a month.
Among the key differences in cyber security practices between leaders and non-leaders, the report identified:
- Leaders focused more of their budget allocations on sustaining what they already have, whereas the non-leaders place significantly more emphasis on piloting and scaling new capabilities.
- Leaders were nearly three times less likely to have had more than 500,000 customer records exposed through cyber attacks in the last 12 months (15 percent vs. 44 percent).
- Leaders were more than three times as likely to provide users of security tools with required training for those tools (30 percent vs. 9 percent).
The study also found that more than four in five respondents (83 percent) believe that organizations need to think beyond securing just their own enterprises and take better steps to secure their vendor ecosystems. Additionally, while cyber security programs designed to protect data and other key assets are only actively protecting about 60 percent of an organization’s business ecosystem, which includes vendors and other business partners, 40 percent of breaches come through this route.
Accenture Research surveyed 4,644 executives representing companies with annual revenues of at least US$1 billion in 24 industries and 16 countries across North and South America, Europe and Asia Pacific. Nearly all respondents (98 percent) were the sole or key decision-maker regarding their organization’s cybersecurity strategy and spending. The study was fielded from April to May 2019.