Cybersecurity skills shortages are putting organizations at higher risk of cyberattacks: IDC 2022 Future Enterprise Resiliency and Spending Survey

With digital businesses and hybrid work environments now becoming the norm in a new digital-first era, organisations are encountering increasingly sophisticated threat vectors, all within the backdrop of an increasingly complex global economy. To date, over half (52.6%) of Asia/Pacific businesses are prioritising transforming their networks to better support a distributed workforce and hybrid cloud environments, according to the IDC Analyst Brief, Building Cyber Resiliency in a Digital-First Era, sponsored by Kaspersky.

Based on the IDC 2022 Future Enterprise Resiliency and Spending Survey, 65% of enterprises in the Asia/Pacific region experienced ransomware attacks or breaches that blocked systems or data access with 83% of compromised businesses suffering downtime and business disruptions ranging from a few days to several weeks. The financial losses from such targeted cyberattacks cost up to USD109,000 for enterprise segment in 2022, including reputational damage as proprietary data gets leaked or sold to other malicious threat actors.

To date, Kaspersky has detected over 1 billion cyberthreats in existence and 400,000 new malware samples detected daily. In the face of a pervasive and persistent threat, the true goal for cybersecurity operations beyond detecting and stopping threats is cyber resilience.

Cyber Resilience – A security framework for a new digital era

A strategic framework that combines business continuity, information systems security, risk management and organisational resilience in tandem with a goal to enhance cyber-response capabilities across the board, a cyber resilience framework aims to ensure that an organisation can deliver intended outcomes and continue business operations with little or no downtime even when undergoing challenging cyber threats.

Organisations need to align their cyber resilience strategies with both their business leaders and technologists, working closely together to ensure minimal disruption and easier recovery from evolving cybersecurity threats, though this is easier said than done. According to the IDC 2022 Asia/Pacific Enterprise Services and Security Sourcing Survey, 43% of businesses in the region stated that the biggest challenge to improving IT security capabilities was aligning business and security goals.

“A shortage of skilled IT security professionals, the implementation of fragmented IT and security platforms and the human factor in staff who do not have sufficient cybersecurity awareness training appears in every organisation, making the implementation of a working cyber resilience framework a daunting task,” says Adrian Hia, Managing Director for APAC, Kaspersky. “The growing sophistication of malware and often limited IT budgets also means that harried cybersecurity teams are outpaced with the sheer number of threat vectors,” adds Hia.

The skills shortage puts organisations at greater risk of cyberattacks. According to IDC’s 2022 Future Enterprise Resiliency and Spending Survey, IT security professionals (37%) are the most demanded technology role in the region followed by IT Operations professionals (33%). Unfortunately, this shortage of qualified IT security professionals has resulted in 76% of businesses in Asia/Pacific having to scale back, cancel or delay technology initiatives while 34% state that skills shortages are putting them at higher risk of cyberattacks. Over half (54%) state that they need an extra 3-4 months to fill in IT security roles versus 12 months ago.

In-house IT security teams also have to contend with fragmented IT and security platforms that generate unnecessary complexity and result in false positives which affects response times to cyber incidents. In the IDC 2022 Asia/Pacific Trust and Security Survey, 45% of organisations stated that their security team spent too much time maintaining and managing security tools while 36% cited a lack of integration in their security portfolio.

Even if stakeholders are in alignment with cyber resilience, the human factor is the weakest link of an organisation’s cybersecurity defences with many incidents resulting from careless employees triggering malware from convincing looking emails or divulging critical company information in targeted phishing attacks.

To stay ahead of cyber threats, organisations are seeking to collaborate with trusted cybersecurity vendors, especially those with extended detection and response (XDR) capabilities that offer their services and expertise on a technological, organisational and human resources front to ensure cyber resilience initiatives remain on-track.

Outsourcing XDR as a facet of cyber resilience

The implementation of XDR allows cybersecurity assets to unify data from various endpoints, leveraging artificial intelligence and machine learning (AI/ML), advanced analytics and automation to proactively detect and respond to cyberattacks more rapidly while reducing the complexity of siloed security tools that lack integration and interoperability.

By outsourcing XDR to a trusted partner, organisations are able to obtain access to the right expertise and technology to fast track cyber resilience initiatives while helping to take the workload off internal cybersecurity teams to manage tasks that fall outside the purview of a managed extended detection and response (MxDR) service. According to the IDC 2022 Asia/Pacific Enterprise Services and Security Sourcing survey, 63% of organisations prioritise partnering with MxDR vendors with the capabilities to consolidate and integrate disparate security tools for enhanced visibility into various environments.

“By collaborating with a trusted MxDR service provider, organisations will be able to consolidate threat intelligence while allowing for a holistic, comprehensive view of their entire solutions stack enabling proactive data-driven threat hunting while having the flexibility to scale operations depending on business needs for better cost efficiency,” says Hia. A trusted MxDR vendor is also able to address the human factor in cyber resilience by training employees to be more security conscious with a variety of modern learning techniques including gamified assessment tools and simulations.

While traditional approaches to cybersecurity tend towards secrecy, digital trust among consumers and stakeholders is becoming a part of corporate culture and an increasingly vital element which requires an above-board approach in verifying the trustworthiness of services, products, internal processes and business operations. Thus, Kaspersky’s Global Transparency Initiative aims to provide the company’s stakeholders and government regulators in the field of cybersecurity with an effective toolset for checking the integrity and trustworthiness of the company’s solutions and seeks to provide more visibility into the work of IT and cybersecurity solutions.

According to IDC’s FutureScape: Worldwide Future of Trust 2022 Predictions – Asia/Pacific (excluding Japan) (APeJ) Implications, by 2026, 25% of APeJ organisations will replace net promoter score-like metrics with trust indices in request for proposals (RFPs) to align traditional security risk solutions with customer success, brand, and reputation.