Over-confidence in ransomware and other cyber security protections seen in new survey

Published: Wednesday, 02 March 2022 09:08

ExtraHop has released findings from a new survey on ransomware that sheds light on the discrepancies between how IT decision makers (ITDMs) see their current security practices, and the reality of the ransomware attack landscape. The ExtraHop Cyber Confidence Index 2022 report shows that however capable IT organizations have been in managing the dramatic transformations of the past couple of years, confidence still tends to outstrip actual security posture.

The survey, conducted by Wakefield Research, found that 77 percent of ITDMs are very or completely confident in their company's ability to prevent or mitigate cyber security threats. Despite this confidence, 64 percent admit that half (or more) of their cyber security incidents are the result of their own outdated IT security postures, including widespread use of insecure and deprecated protocols, as well as growing numbers of unmanaged devices. This inflated confidence is even more dangerous in light of the frequency of ransomware attacks - as 85 percent reported having suffered at least one ransomware attack, and 74 percent reported experiencing multiple incidents in the past five years.

Other key survey findings include:

This study shows that, even as companies continue to innovate with cloud technologies and remote workforces, their IT infrastructures remain mired in the past, with obsolete protocols providing ongoing opportunities for attackers to infiltrate networks and unleash ransomware attacks. A lack of visibility and effective use of data has also contributed to organizations' obstacles in identifying vulnerabilities and preventing ongoing ransomware attacks.

"This research highlights the discrepancies between the reality of today's sophisticated attack landscape and the overconfidence that many business leaders have in their ability to manage an attack," said Jeff Costlow, CISO at ExtraHop. "Defenders need tools that can track attacker activity across cloud, on-premises, and remote environments so they can identify and stop an attack before they can compromise the business."


The survey of 500 security and IT decision makers in the US, UK, France, and Germany was conducted by Wakefield Research and sponsored by ExtraHop. Survey participants came from a wide range of industries, including financial services, healthcare, manufacturing, and retail, and worked at companies of varying sizes, including companies with annual revenue exceeding $50 million. About half the participants were in the US, with the rest hailing from the UK, France, and Germany.

Obtain the report