A Hiscox survey of managers and IT specialists at 3,000 small to large companies in the United States, the United Kingdom, and Germany found more than half (53 percent) of businesses ill-prepared to deal with cyber-attacks.
The study assessed firms according to their cyber readiness in four areas – strategy, resourcing, technology, and process – and ranked them from novice to expert.
Fewer than one-third (30 percent) qualified as “expert” in their overall cyber readiness, of which nearly half (49 percent) were U.S.-based companies.
Among the key findings, the study revealed significant cyber security shortcomings among the more than 1,000 companies surveyed in the United States.
- Cyber security budgets increasing: Seventy-two percent of large U.S. businesses (250 or more employees) and 60 percent of small companies (fewer than 250 employees) experienced at least one cyber-attack in the past year. The frequency of these attacks was driving cyber security spending, expected to increase for 63 percent of U.S. businesses.
- Cyber detection is a challenge: Nearly half (44 percent) of all U.S. companies surveyed reported taking two days or more to discover a cyber security incident, and more than half (54 percent) reported taking two days or more to return to “business as usual” after their largest breach. That said, the time taken to complete an investigation and remedial work could take even longer.
- Employee training works: For 77 percent of U.S. companies, employee training had significantly reduced the number of cyber hacks and incidents. Seventy-one percent of U.S. companies reported conducting cyber security exercises, such as phishing experiments, to understand employee behavior and readiness for an attack.
- Small businesses struggle to keep up: While large companies incurred the highest costs in nominal terms, the financial impact of cyber-attacks was disproportionately high for small businesses with fewer than 250 employees. The average cost of the largest cyber security incident experienced in the past 12 months for these small businesses was $41,000. Surprisingly, one-in-five (19 percent) small businesses said they had changed nothing following a cyber-security incident.
- Momentum builds behind cyber insurance: Across all geographies surveyed, 40 percent of businesses said they had cyber insurance coverage. Fifty-five percent of U.S. businesses reported having cyber coverage, the highest of any country surveyed. These figures also might reflect confusion over what exactly constituted cyber insurance coverage with some companies believing they were protected under their existing insurance coverage.
“Our study reveals a number of cyber security shortcomings among companies of all sizes,” said Ben Walter, the chief executive of Hiscox USA. “At Hiscox, our aim is to help our clients understand and navigate today's most pressing cyber security challenges, supplementing essential risk management and insurance with a roadmap for how to become more fully cyber ready.”
The study showed the biggest gaps between experts and novices were in their strategy and process.
Hiscox said that novices could better prepare themselves by taking the following actions:
- Involving top management in the cyber security discussions: Nine out of ten experts (91 percent) said cyber security was a top priority at the board and C-level. Only 62 percent of novices said the same.
- Formalizing a cyber security strategy: Nine out of ten experts (92 percent) had a budgeting process that was integrated into all security projects and activities versus only 40 percent of novices.
- Implementing more employee training: Nearly nine out of ten experts (86 percent) agreed that employee training had reduced the number of cyber incidents. The figure for novices was 57 percent.
- Documenting the firm's processes: An overwhelming majority of experts (96 percent) said their business had cyber security guidelines for employees, partners, and external users, but only 42 percent of novices said that they were as well organized.
- Tightening up technology: The gaps between novices and experts generally were less noticeable in technology deployment. Where the novices needed to improve was in internal and external message encryption and the integration of strong authentication throughout their businesses.
- Investing in cyber insurance: Nearly two-thirds of experts (64 percent) said they had cyber insurance. This compared with just 28 percent of novices.
“Making cyber security a top business priority is an important first step in preventing and managing cyber-attacks,” said Dan Burke, vice president and cyber product head at Hiscox USA. “Being cyber ready does not necessarily require a massive financial spend. By focusing on strategy, resourcing, and process, companies can help prevent costly business interruptions and irreparable damage to their brand.”
Learn more: www.hiscox.com.