Untrained staff is the greatest cyber risk to business and 87 percent of executives know it, a new report found.
Compounding this finding is staff training is ranked among the categories to have made the least progress when measured against the NIST cybersecurity framework, according to the report by ESI ThoughtLab in conjunction with Willis Towers Watson.
ESI Thought Lab surveyed 1,300 organizations with revenues ranging from under $1 billion to over $50 billion, across multiple industries spanning APAC, Europe, U.S./Canada and Latin America.
The research also identified the most common types of attacks to include malware/spyware (81 percent) and phishing (64 percent), with external unsophisticated hackers (59 percent) and cyber criminals (57 percent) identified as the next biggest external threats.
Based on scores relating to progress on the NIST cybersecurity framework, ESI ThoughtLab segmented companies into three stages of cybersecurity maturity: Beginners, intermediates and leaders.
The survey found a company’s threat perception varied based on the firm’s cybersecurity maturity. For example, cybersecurity leaders tend to focus more on “Hacktivists” (52 percent) and malicious insider threats (40 percent), whereas cybersecurity beginners spend more time worrying about external threats (42 percent), such as partners, vendors, and suppliers.
Additionally, the research found when it comes to post-cyber incident processes, cybersecurity leaders invest more in cyber resilience versus their beginner counterparts.
As companies become more advanced in cybersecurity, they increase their investment in cybersecurity resilience, with cybersecurity beginners spending 14 percent of their cyber budget and cyber leaders spending 18 percent on recovery.
Other key findings around cybersecurity maturity and investment in cyber risk include:
• 91 percent of cybersecurity leaders feel their investment is adequate to meet their needs
• 33 percent of cybersecurity beginners view their investment as adequate to meet their needs
• 73 percent of companies plan to use behavior analytics as a cybersecurity tool over the next two years
• 80 percent of companies have at least a small amount of cybersecurity insurance, with healthcare companies averaging one of the highest amounts ($16.4 million) and manufacturing averaging one of the lowest ($8.6 million)