Immersive Labs has released a commissioned study conducted by Forrester Consulting to evaluate how global cyber security decision-makers perceive their organization’s cyber resilience, defined as the ability and confidence to effectively respond to cyber threats.
Despite high confidence in overall resilience, the study found that teams are insufficiently prepared for threats, as 82 percent agree they could have mitigated some to all of the damage of their most significant cyber incident in the last year if they were better prepared, and more than 80 percent don't think, or are unsure whether, their teams have the capabilities to respond to future attacks. To reduce risk, the study recommends a people-centric cyber security culture shift.
Forrester surveyed 316 global cyber security training strategy decision-makers in the UK, US, Canada, Germany, and Sweden, exposing a troubling inconsistency in cyber security team confidence. Respondents’ initial responses express confidence in overall team resilience, but when asked specifically about how prepared the team is for another attack or how effectively the team resolves incidents, confidence plummets.
Only 17 percent of respondents consider their cyber security team to be fully-staffed and nearly half of respondents admit they aren’t able to measure cyber capabilities, further eroding confidence in the organization’s preparedness. When cyber attack prevention and damage control are both lacking, organizations may be more vulnerable than initially thought.
“We’re seeing tremendous pressure on cyber security teams to prove their readiness for new and emerging threats, and while many feel they have built sufficient cyber workforce skills and judgment to respond, our study with Forrester Consulting reveals that nearly 50 percent lack the metrics to know for sure,” said James Hadley, CEO & Founder, Immersive Labs. “Our research suggests that it’s well past time to rethink traditional training programs, effectively measure cyber capabilities, and better equip cyber security teams with the skills and confidence to stand up to attacks.”
Other key findings in the research include:
- Cyber teams face growing pressure from senior leaders: 84 percent of respondents agree that cyber security teams feel increasing pressure to be prepared for the next cyber attack.
- Cyber threats are becoming more difficult to stop: 72 percent agree the threat landscape is becoming more challenging.
- Reporting is inconsistent: senior leaders should be sharing breach readiness and incident response results to a greater degree, but fewer than 60 percent do so today. In addition, over half (55 percent) agree their cyber security team doesn’t have the data needed to demonstrate readiness to properly respond to cyber threats.
- Teams aren’t strategically equipped to maintain cyber resilience: less than one-third (32 percent) believe their organization has a formal strategy to ensure cyber resilience.
- Talent shortages threaten cyber resilience: 83 percent of respondents think their cyber security team is understaffed, and 94 percent experienced at least one talent management challenge with the cyber security team.
- Cybersecurity teams can reduce risk by adopting modern approaches to upskilling: 64 percent of respondents agree that traditional cyber security training methods (e.g., certifications, video training courses, classroom instruction) are insufficient to ensure cyber resilience. Leveraging effective people-centric approaches, such as live simulations, and progressive, career-path-aligned online training and upskilling can bolster cyber security teams’ capabilities and, in turn, their organization’s cyber resilience.
