How Likely Is Your Organization to Be Breached?

Trend Micro and the Ponemon Institute teamed up to produce a new Cyber Risk Index (CRI), which will be updated every six months. Today I want to dive a bit deeper into the results found in the inaugural survey that went out to more than 1,000 IT professionals and executives within organizations based in the USA. I also want to identify some differences between the responses given by the different sized organizations, broken out by small, medium, and enterprise.

The CRI

Before we go into these details, I want to simply explain how the CRI was calculated. The CRI is made up of two components, the Cyber Preparedness Index (how prepared are you to combat threats) and the Cyber Threat Index (your experience dealing with threats). The formula is as follows:

CRI = CPI – CTI

The CRI is on a -10 to +10 scale with -10 being the highest risk. Below are the results based on organization size.

The results seem to line up with what most would expect – small businesses have the highest cyber risk, medium businesses with less cyber risk and enterprises having the least cyber risk based on the factors that make up the index. Let’s now look at some of the more detailed results from the survey.

Key Survey Results

The top risk reported for cyber preparedness was interesting, as small business and enterprise respondents face the same primary concern:

Small business & Enterprise: My organization’s IT security function has the ability to know the physical location of business-critical data assets and applications.

Medium business: My organization’s enabling security technologies are sufficient to protect data assets and IT infrastructure.

To some extent, this primary risk may not be surprising. In a small business, there isn’t usually a lot of IT function and in an enterprise, the network tends to be very big and broad so knowing where these assets are physically located can be a difficult task. On the other hand, the medium-sized businesses may not have sufficient budget to allow them to afford some of the key components that make up a very secure environment.

On the other end of the CRI – the Cyber Threat Index – we reaffirm that threats are universal. Businesses of all sizes are dealing with cyber threats every day. Here are some of the most interesting takeaways from the survey:

Small business respondents stated: 26% had 3-6 separate cyberattacks that infiltrated their organization in the past 12 months, while 11% have had 7-10 and 6% reported more than 10 such instances in the past year. 34% said it’s very likely they will experience a cyber-attack that will infiltrate their organizations in the next 12 months. Medium business respondents stated: 19% had 3-6 separate cyberattacks that infiltrated their organization in the past 12 months. 14% reported 7-10 such incidents, and 8% have faced more than 10 35% said it’s very likely they will experience a cyber-attack that will infiltrate their organizations in the next 12 months. Enterprise respondents stated: 19% had 3-6 separate cyberattacks that infiltrated their organization in the past 12 months. Another 15% have had 7-10, but only 3% said they’ve had more than 10. 39% said it’s likely they will experience a cyber-attack that will infiltrate their organizations in the next 12 months – only 29% said very likely

As you see above, it is almost inevitable that an attack will occur in the next 12 months and that it will be successful. These responses show why all organizations have a high cyber threat environment today.

The intent of the CRI is to give organizations an understanding of their risk levels and insights into many areas of their security posture. From the results, they can make changes to their security infrastructure, policies, and educating their employees and board members to help minimize their risk in the future. As we continue to run the CRI survey every six months, we hope to see gradual improvement in the results.

Stay tuned for more insights from the survey in future blogs. If you want to check out the current results and take a mini version of the survey, go to our landing page here.

Read More HERE