Cyber resilience has become a top priority for global organizations, but more than half (52%) of companies with programs in place lack a comprehensive assessment approach, according to Osterman Research. It is said that he is having a hard time.
Sponsored by analyst Immersive Labs Cyber Workforce Resilience Trends Report Compiled from interviews with 570 respondents in senior security and risk positions in the US, UK and Germany.
According to NIST, cyber resilience focuses on an organization’s ability to “anticipate, withstand, recover from, and adapt” to cyberattacks and incidents.
To learn more about cyber resilience, read 6 ways to improve your cyber resilience to combat cyberattacks.
Faced with concerns over ransomware, supply chain risks and vulnerabilities, 86% of respondents said they have cyber recovery programs in place.
But more than half are flying blind because there is no way to accurately measure the effectiveness of these efforts. Only 6% of respondents said they use useful metrics to track vulnerabilities, intrusion rates, internal data loss, threat types, etc.
The report also found other challenges such as:
- Most avenues for learning about the latest vulnerabilities are ad hoc and reactive, limiting the value of security professionals.
- Classroom-Based Training Can’t Keep Up with the Threat Landscape
- Industry Certifications for IT and Security Professionals Are Inadequate to Address Emerging Threats
- The board has not been involved. Fewer than half (46%) of respondents asked their security team to prove their company’s cyber resilience
In particular, there is great concern about the preparation of regular employees. More than half (53%) of respondents said their employees were not well prepared for the next cyberattack, and 46% said despite years of training and phishing tests , employees said they didn’t know what to do if they received a phishing email.
“To prepare for future threats, organizations urgently need to better assess their current resilience levels and implement ways to close the cyber skills gap,” the report concludes.
“A holistic approach that assesses capabilities, builds team-level skills, and highlights gaps is essential to advancing the cyber resilience agenda. “Traditional approaches to security cannot provide organizations with what they need to address emerging threats.”
