.svg){kind=icon}
.svg)
The world of cybersecurity is a high-stakes battlefield, and the challenges have never been greater. As our technology becomes smarter, faster, and more integrated, cybercriminals are keeping pace, evolving their tactics to exploit every vulnerability.
This article breaks down 170 key cybersecurity insights, statistics, and findings for 2025. We’ll cover the most critical threats, costs to businesses and consumers, and security trends worth considering.
Ready to see what the future holds? Let’s dive into the data and uncover what’s next in cybersecurity.
Table of Contents
Cybersecurity Overview
Cybercrime is on the rise, and attacks are becoming more sophisticated and expensive.
Let’s break down a few introductory statistics to set the stage for the top concerns for cybersecurity professionals.
1. Cybercrime is set to cost businesses up to $10.5 trillion by 2025 and could reach as high as $15.63 trillion by 2029.1
2. Research suggests there’s a worrying correlation between digital transformation and data breaches.2
3. 72% of business owners are concerned about future cybersecurity risks arising from hybrid or remote work.3
4. 74% of businesses are confident in their ability to detect and respond to cyberattacks in real-time, a high of 81% of C-suite leaders vs. 66% of Front-line managers.
AI is everywhere you look – unfortunately, that goes for AI cyber threats, too.
Generative artificial intelligence, or GenAI, is a hot topic in cybersecurity and is unlikely to simmer down in 2025.
• Predicting threats and vulnerabilities ahead of time. (45%)
• Increasing the scale of security patching. (45%)
• Creating more efficient incident response plans. (42%)
• Threat simulation to mimic a wide range of cyber threats. (39%)
• Managing cybersecurity alert fatigue. (36%)
• Threat simulation to mimic a wide range of cyber threats. (68%)
• Managing cybersecurity alert fatigue. (45%)
• Closing the cybersecurity talent shortage and skills gap. (42%)
• Automating security information and event management systems. (37%)
• Increasing the scale of security patching. (34%)
However, it’s also clear that business owners are worried about social engineering and insider threats – and that many companies are re-evaluating who they partner with on the supply chain.
5. 97% of companies are reporting GenAI security issues and breaches. 54
6. 24% of companies believe they can use GenAI technology to make incident response more efficient in the future. 45
7. To combat insider threats, many companies are moving away from encouraging awareness towards behavioral adaptation. 53% of companies actively train staff on how to minimize internal risks. 6
8. Firms are moving toward identity-first security measures – with more than 86% adopting zero trust models. 7
9. By the end of the year, up to 60% of companies on supply chains will be using the risk of cybersecurity as a buying consideration when partnering with others. 8
10. Up to 98% of cyberattacks – against businesses and otherwise – involve social engineering, making this a key trend to prepare for across the next year. 9
11. Around 76% of security leaders are concerned about cyber threats evolving in sophistication – and 72% believe they are “first adopters” of technology to combat them in the years ahead. 10
Cybercrime Costs and Frequency
The cost of cybercrime is skyrocketing for businesses worldwide. Much of this is due to the increasing number of attacks and vectors emerging, meaning companies need to plan wisely to reduce potential revenue loss.
America leads the way in terms of the most expensive cybercrime costs worldwide, but even globally, companies are paying almost $5 million per breach.
Let’s explore some of the most explosive data costs making waves right now.
12. Cybercrime costs are expected to escalate worldwide to almost $14 trillion by 2028.11
13. The average cost of a data breach globally is growing to around $4.88 million, a 10% increase year-on-year.12
14. The industrial sector is experiencing the highest increase in data breach costs, rising by $830,000 on average year-on-year.13 12
15. Data breach costs are projected to be the highest in the U.S., followed by the Middle East, Benelux, and Germany. 14
16. All four territories experience costs higher than the global average of $4.88 million, with the U.S. paying almost double this amount. 14
17. Ransomware costs victims an average of $1.85 million per incident, with attacks rising by 13% over a five-year period. 15
18. The average cost of ransom imposed by attackers increased by 500% over a year, with payments reaching an average of $2 million. 16
19. Phishing attacks currently cost companies an average of $4.88 million to bounce back from. 17
20. Business Email Compromise or BEC attacks are costing companies an average of $4.67 million per attack and account for 8.5% of all data breaches.18
21. BEC attacks have already cost businesses more than $55 billion over a decade. 19
22. Claims made on cybersecurity insurance are increasing by around 13% year-on-year. 20
23. Insurance carriers report an average loss of around $100,000 per claim. 20
24. Only 74% of companies have specific cybercrime insurance to cover losses. 21
25. Written, direct premiums for cyber insurance are expected to reach $23 billion by the end of the year. 22
26. Ransomware accounts for 19% of all claims made on cyber insurance. 20
27. On average, small businesses can expect to pay $120,000 to recover from a cyberattack. 23
28. Only 5% of companies have allocated additional budget to their cyber programs in the past year. 5
29. At least six in ten businesses are raising their prices to help recover the costs incurred by cyberattacks. 24
Business Interruption and Cyber Incidents
30. Businesses are paying $53,000 per hour, on average, due to downtime caused by ransomware.25
31. The average cost of downtime from a DDoS (Distributed Denial of Service) attack is $6,130 per minute. 26
32. The cost of recovering from a ransomware attack is currently, on average, ten times as much as the amount attackers demand in ransom. 27
33. Business owners view cyber risks as more threatening than any other cause of business loss – at 34% – surpassing natural disasters. 28
34. Firms lose up to 1.3% of their market value in the month following a cyberattack. 29
35. 15% of data breaches involve third parties found along the supply chain, putting several firms at risk without fault. 5
36. 49% of companies reported an increase in the frequency of cyberattacks in the last year. 5
37. 43% of companies reported an increase in the severity of cyberattacks in the last year. 5
38. 40% of cyber team members have personally – or have had someone else on their team - intentionally not report cyber incidents out of fear of losing their jobs. 5
39. 33% of companies have been late responding to a cyberattack because they were dealing with a false positive. 5
40. 63% of cyber teams spend four (4) or more hours per week dealing with false positives. 5
41. 15% of cyber teams spend more than seven (7) hours a week managing false positives. 5
Evolving Cyberattack Methods
Ransomware, phishing, social engineering, AI, and the cloud pose immense threats to businesses of all sizes worldwide.
Ransomware alone, in fact, still leads the way regarding threat risk, damage, and attack costs. What’s more, most of them are even attacking data backups!
But, don’t discount phishing, social engineering, and email attacks. We regularly help businesses navigate confidence tricks that – believe it or not – still work on even the best-informed people in 2025.
Let’s dive into some data on attack vectors.
Ransomware Attack Growth
42. Around 27% of all malware attacks right now involve ransomware. 15
43. Ransomware is the most significant contributor to cyberattack costs for small and medium-sized enterprises (SMEs), accounting for around 51% of the average – and this is projected to rise. 15
44. The financial services industry is experiencing a ransomware increase of 9% year-on-year. 16
45. Ransomware attacks are more than doubling year-on-year. 32
46. Projections show that 76% of all organizations suffer at least one ransomware attack per year. 33
47. 96% of ransomware attacks specifically target backup locations and repositories. 33
48. In 77% of ransomware incidents, malicious attacks are deployed within 30 days of an initial interaction–and 54% within the initial seven days. 34
49. The median time between hacker access and ransomware launch is 6.11 days for assumed and confirmed attacks. 34
50. Transport for London suffered one of the highest-profile ransomware attacks, resulting in the loss of traveler contact details, Oyster card information, and bank numbers of up to 5,000 people. 36
51. The healthcare industry reports the most expensive breaches at an average of $9.8 million – remaining at the top of industry costs for over a decade. 36
52. More than 630 ransomware attacks affected healthcare bodies in a single year. 37
Phishing and Social Engineering
53. 60% of recipients fall victim to GenAI-driven phishing attacks, comparable to traditional attack numbers. 38
54. It’s estimated that 80% of phishing attacks are AI-generated, with the trend likely to continue. 39
55. Tools such as ChatGPT that are available for free to the public can generate up to 30 phishing email templates every hour. 40 41
56. The use of GenAI in phishing attacks has increased by at least 17% year-on-year, with experts prepared for more significant jumps. 42
57. The FBI’s IC3 department recently reported almost 21,500 complaints regarding BEC attacks in one year, with losses estimating more than $2.9 billion. 43
58. Companies that employ more than 1,000 people have between 83% and 97% chance of receiving BEC scams every week. 44
59. Up to 74% of attacks involve spear phishing. 45
60. 74% of companies claim insider threats are becoming more frequent. 46
61. 74% of all data breaches involve some kind of human element or error. 47
62. 44% of companies claim they suffered cloud data breaches due to human error. 48
Device and Cloud Security Threats
63. Up to 61% of companies are experiencing at least one cloud attack a year. 49
64. 21% of cloud incidents result in data breaches. 49
65. 27% of business operators experience public cloud security issues, with 23% of them alone caused by misconfigurations. 50
66. Over half of all cloud breaches occur in part due to human error. 51
67. It’s thought up to 70% of IoT or internet-connected devices are still vulnerable to attack. 52
68. In a study regarding healthcare systems – within the NHS – up to 46% of IoT devices have at least one known but unaddressed risk. 53
69. DDoS (Distributed Denial of Service) attacks are increasing by 20% year-on-year. 54
70. Law enforcement shut down 48 DDoS-for-hire platforms in one year, though their numbers are growing by 20% annually. 55
Cybersecurity Vulnerabilities and Breaches
Unfortunately, as cyberattacks become more sophisticated, many companies simply aren’t doing enough to protect themselves—and a huge number of firms are going out of business because of data breaches.
VikingCloud proprietary research reveals: 5
- 42% of companies rate their cyber defense as mature.
- 55% of companies believe modern cybercriminals are more advanced than their internal teams.
- 35% of companies report that the technology cyber criminals use is more sophisticated than the tech their team uses.
- 53% believe emerging AI attack methods create new risks for which they are unprepared.
Let’s explore some data regarding weaknesses, costs, and how quickly companies are bouncing back from even the biggest threats. You might be surprised by what we’ve found.
71. Experts recently discovered 612 new, unique common vulnerabilities and exposures (CVEs) in one quarter. 56
72. Average monthly CVEs considered critical leaped by 13% in a year. 57
73. Experts estimate a 25% rise in CVEs over a year period. 58
74. It’s thought that around 1.1% of CVEs have already been exploited and that 2% are weaponized. 59
75. Operating systems with the most recorded CVEs include Debian Linux (8,809), Android (7,245), Linux Kernel (6,010), and Fedora (5,122). 60
76. In a single year, over 40% of Log4j downloads were still considered vulnerable to hacking. 61
77. 38% of Log4j users were still using vulnerable versions of the application after threats were revealed and patched. 62
78. Vulnerabilities within the MoveIt framework exposed more than 93 million sensitive records. 63
79. Industries most affected by MoveIt vulnerabilities included education, health, and finance. 64
80. High-profile data breaches arising recently include Ticketmaster, which saw 560 million people’s details compromised and up for sale online. 65
81. On average, cross-industry, it takes companies 204 days to spot a data breach and 73 days to contain it. 66
82. Financial companies take an average of 177 days to identify breaches, and 56 days to contain them. 67
83. 9% of publicly traded U.S. companies reported data breaches in a year’s period, impacting 143 million people. 67
84. The use of stolen credentials appears in up to 31% of data breaches. 69
85. Across a decade, the number of U.S. data compromises per year increased from 614 to 3,205. 70
86. Data breaches increased by 72% over two years. 71
87. U.S. data breaches impacted an estimated 353 million individuals in one year alone. 70
88. The cost per capita of a data breach is increasing by around 1 USD per year. 12
89. Companies that find and contain data breaches within 200 days are saving $1 million more than those that don’t. 72
90. Using AI helps companies find data breaches 108 days faster than those that don’t. 72
91. It takes companies in the healthcare industry longer than any other to contain breaches. 73
92. However, it takes entertainment businesses up to 287 days on average to detect a data breach compared to healthcare businesses’ average of 255 days. 73
Industry-Specific Cybersecurity Statistics
Data breaches and cyberattacks can affect different industries in many different ways. Six of those most at risk—healthcare, finance, insurance, manufacturing, retail, and education—continue to lose mind-boggling amounts of money and sensitive data even in 2025.
Let’s dig into these sectors' challenges and where things might be headed.
HealthCare
93. The healthcare industry is the third-most attacked worldwide. 74
94. Ransomware attacks, in particular, are growing in number across the healthcare industry – growing by at least 25%. 74
95. 68% of healthcare officials claim to have witnessed an average of two attacks a year. 75
96. More than 70% of U.S. hospitals surveyed by the HHS are following NIST cybersecurity protocols to fight back against attacks 76
97. Costs incurred by data breaches in healthcare are falling by 10.6% yearly. 77
98. The overall cost of healthcare data breaches has increased by 53% since the start of the COVID-19 pandemic. 78
99. The average cost of a data breach in healthcare was $9.77 million in 2024.78
Finance and Insurance
100. API and web application attacks on financial services companies increased by 65% over a year. 79
101. Financial services are the third-most attacked industry based on phishing alone.79
102. Malicious bot requests spiked by up to 69% year-on-year in the financial sector. 79
103. Data breach costs in the finance industry increased by around 2.3% year-on-year. 12
104. The average financial services firm pays $5.9 million per data breach. 81
105. The average cost of a data breach in financial services ranges from $5.86 to $6.08 million. 82
Manufacturing and Retail
106. On average, up to 44% of all computers used in manufacturing are affected by ransomware, and around 62% of ransomware victims in manufacturing pay the ransom demanded of them. 83
107. The average cost of a data breach in the manufacturing industry in 2024 was $5.56 million. 80
108. Around 62% of ransomware victims in manufacturing paid the ransom demanded of them. 83
109. Backdoor attacks account for 28% of malicious actions against the manufacturing industry. 84
110. 97% of U.S. top retailers have experienced third-party data breaches in the past year. 85
111. The average cost of security breaches in the retail industry rose by 18% year-on-year. 86
112. The retail industry accounts for 6% of all global data breaches annually. 87
113. The average data breach cost in the retail industry is $3.48 million. 24
Education Sector
114. There has been a 92% spike in attacks on K-12 educational establishments. 88
115. Educational businesses saw 265 attacks in the space of a year, an overall increase of 70%.88
116. The U.S. accounted for 80% of known ransomware attacks during this period. 88
117. 95% of ransomware attackers targeting higher-ed bodies attempt to access data backups. 89
118. 95% of higher-ed bodies that report ransomware suggest they experience significant revenue loss. 89
119. Each day of downtime costs schools up to $550,000. 90
120. The average cost of a data breach for higher-ed bodies is around $3.65 million. 91
121. Data breaches through ransomware cost the education sector more than $53 billion in downtime over a five-year period. 92
Cybersecurity Spending and Workforce Gaps
To fight cybercrime, businesses need to invest considerable time and money on resources and people. Thankfully, our research suggests most companies are taking security spending very seriously. After all, it’s better to invest money now than to risk losing massive amounts of business and recovery fees later.
What’s more, there continue to be worrying trends over cybersecurity job availability – there’s some serious skills gaps. Thankfully, a few statistics we’ve found appear to offer some hope.
Here’s what we’ve found with regard to how business owners are budgeting for data protection and planning for hiring and training.
Security Investment Trends
122. Global information security spending is set to increase by 15% for the year ahead. 93
123. Research shows yearly spending is estimated at $183.9 billion. 93
124. Investment in security services is expected to grow more than investment in software or network security. 93
125. Cybersecurity budgets are growing by about 8% per year. 94
126. The cybersecurity market has an annual growth rate of around 7.92% CAGR to the end of the decade. 95
127. Firms could reduce cybersecurity costs by an average of $2.2 million annually when investing in AI and automation tools. 12
128. Companies that actively use security automation and AI spend $1.8 million less per year on breaches than those that don’t. 96
129. Companies using security automation and AI also save more than $3 million per data breach. 97
130. The AI cybersecurity market is set to exceed $133 billion by 2030. 98
131. Identity and access management, a type of zero-trust security strategy, is set to exceed market worth of $24.1 billion by the year’s end. 99
132. At least 41% of businesses now use zero-trust security architecture. 100
133. 83% of IT SME professionals require employees to use multi-factor authentication, or MFA. 101
Cybersecurity Skills Shortage and Workforce Predictions
134. The cybersecurity industry has a talent shortage of four million professionals. 102
135. 45% of people claim skills shortages pose the biggest challenges to cybersecurity professionals. 102
136. Up to 570,000 cybersecurity roles remain unfilled in the U.S. alone. 103
137. Texas, Florida, California, Colorado, Illinois, Virginia, Maryland, and New York are the states with the most U.S. cybersecurity openings. 104
138. Research shows that U.S. cybersecurity jobs are expected to grow 33% by 2033. 105
139. Up to 17,300 new jobs for IT security analysts are projected to open each year across the next decade. 105
140. Growth of employment demand for information security analysts is 29% higher than the average demand for all occupations heading to 2033. 105
141. “Computer occupations” are expected to grow by 12%, again, 21% lower than information security analyst roles. 105
142. 63% of companies are considering implementing new technologies, such as GenAI, to support cybersecurity employment shortages. 5
143. Specifically, 41% of companies already leverage GenAI to address the cybersecurity skills gap. 5
144. It’s predicted GenAI will remove the need for specialized education for up to half of all entry-level roles in cybersecurity by 2028. 106
145. Around 40% of C-level executives intend to use GenAI to support critical skills shortages. 107
Key Takeaways and Recommendations for 2025
As we look to the future, understanding the numbers behind cybersecurity is critical to staying one step ahead of evolving threats. Here are 13 important statistics that could help you shape your cybersecurity posture for 2025 and beyond. We’ve split this section into risk mitigation and future trends worth watching – pulling from our own research along the way.
Mitigating Cybersecurity Risks
146. Proactive management of third-party software risks is vital – at least 29% of all data breaches involve third-party attacks. 108
147. Hiring talent to address growing threats is also important – and only 10% of firms are increasing their cyber hiring. 5
148. Up to 53% of companies feel they’re unprepared for cybersecurity risks and attack points posed by AI. 5
149. Research suggests companies adopting GenAI to support hyper-personalized training could result in 40% fewer employee-caused security incidents by 2026. 106
150. 56% of businesses intend to use AI to help train their cybersecurity professionals. 109
151. The worldwide zero trust security market is projected to be worth almost $133 billion by 2032. 110
152. 33.8% of business owners believe decentralized identity management will continue to be crucial for IAM (identity and access management), with 47.1% supporting passwordless access systems. 111
Future Trends to Watch
153. Business owners are most worried about GenAI model prompt hacking (46%), Large Language Model (LLM) data poisoning (38%), ransomware as a service (37%), GenAI processing chip attacks (26%), and API breaches (24%). 5
154. 41% of businesses are using AI to manage cyber alert fatigue. 38% use GenAI to support security patching, and 29% use it to automate management systems. 5
155. Cyber insurance policy numbers are increasing by around 11.7% yearly after a lull, and annual claims are increasing to more than 33,500. 112
156. The market size for cybersecurity insurance is set to top $20 billion. 113
157. Companies spend an average of 12% of IT budgets on measures for cybersecurity. 114
158. Businesses have increased the budget allocated to security by around 8.6% over the last half-decade. 115
FAQs
159. Ransomware is the biggest global cybersecurity threat, affecting 72.7% of organizations. 116
160. Google Cloud predicts major threats to cybersecurity in 2025 include AI attacks, continued disruption through ransomware, and evolving threats against Web3 companies. 117
161. Hundreds of millions of commercial and private devices will become vulnerable with Microsoft ending support for its Windows 10 operating system in October 2025. 118
162. Research suggests more than 2,300 unique cyberattacks occur every day. 15
163. There are at least 23,900 known cybersecurity vulnerabilities that could encourage these attacks. 84
164. As many as 88% of all cyber incidents are caused by human errors. 119
165. BEC attacks rely on human error and misjudgment and are responsible for more than half of all social engineering attacks. 47
166. Research claims that around 20% of breaches occur due to social engineering. 120
167. Verizon research further claims around 3,661 social engineering attacks were accounted for in its broad study, with 3,032 disclosing data. 121
168. 2021 was a huge year for cyberattacks – bolstered by the enormous data breach affecting the social media developer RockYou, which lost 8.4 billion passwords, affecting 32 million different accounts. 122
169. Companies can prepare for cyberattacks in many ways – by setting up firewalls, arranging penetration testing, and retraining employees – however, 54% of business owners are harnessing AI to mimic threats to prepare for them better. 5
170. Gartner research predicts that the cybersecurity market will expand to $212 billion by the end of the year. 93
Sources
- Statista
- Journal of Electronic Business & Digital Economics
- Statista
- Capgemini
- VikingCloud
- Securonix
- Cisco
- Gartner
- Sprinto
- KPMG
- Statista
- IBM
- SecurityIntelligence
- Statista
- Astra
- Sophos
- IBM
- HoxHunt (quoting IBM and Ponemon Institute)
- Infosecurity Magazine
- Coalition
- NetworkAssured
- Insurance Information Institute
- PurpleSec (quoting IBM)
- IBM
- PentestPeople
- Security Magazine (quoting Radware)
- Delphiix (quoting Soros)
- Allianz
- American Enterprise Institute
- Verizon
- Sophos
- Forbes
- Veeam
- Integrity 360
- Healthcare Dive (quoting IBM)
- Office of Information Security
- Harvard Business Review
- Abnormal Security
- Heimdal
- ChatGPT Community
- KnowBe4 (quoting Perception Point)
- IC3
- Abnormal Security
- ProofPoint
- Cybersecurity Insiders
- Verizon
- Thales Group
- Competitor
- Competitor
- Infosecurity Magazine (quoting Thales)
- CybelAngel (quoting HP)
- Cynerio
- Cloudflare
- Security Delta
- Statista
- CSO (quoting Coalition)
- Help Net Security (quoting Coalition)
- VulnCheck
- CVEdetails
- DarkReading
- VeraCode
- Cybersecurity Dive
- EmsiSoft
- BBC
- Secureframe (quoting IBM)
- Security Intelligence
- ID Theft Resource Center
- Verizon
- Statista
- ITRC
- Embroker (quoting IBM)
- Varonis (quoting IBM)
- Hit Consultant (quoting Ransomware Live)
- Security Magazine (quoting ProofPoint)
- Industrial Cyber (quoting HHS)
- Varonis (quoting IBM)
- Healthcare Dive (quoting IBM)
- Akamai
- Statista
- FinTech Magazine
- Statista
- Sophos
- Competitor
- CIO Influence (quoting SecurityScorecard)
- Retail TouchPoints (quoting IBM)
- Asimily (quoting IBM)
- ThreatDown
- Varonis (quoting Sophos)
- Campus Technology (quoting Comparitech)
- Asimily (quoting IBM)
- Comparitech
- Gartner
- IANS
- Statista
- Alt Index
- Security Intelligence (quoting IBM)
- Security Magazine (quoting Techopedia)
- MarketsAndMarkets
- JumpCloud (quoting IBM)
- JumpCloud
- Statista
- National Science Foundation
- Cyberseek
- US Bureau of Labor Statistics
- Gartner
- ComputerWorld (quoting Kaspersky Research)
- SecurityScorecard
- CompTIA
- Statista
- Kuppinger Cole
- NAIC
- Statista
- Statista
- The National CIO Review (quoting IANS)
- Statista
- Google Cloud
- Beyond Trust
- BreachSense (quoting Stanford and Tessian)
- SecureFrame (quoting Verizon)
- Verizon
- Clear Insurance
Cyber threats continually evolve, and hackers often find new vulnerabilities before corporate IT teams do. Unfortunately, this leaves the door open for malicious actors to steal sensitive information or demand a ransom payment to unlock essential systems.
Additionally, the frequency of these attacks and the time and money lost to them shows no signs of slowing down. Ransomware attacks, for one, grew by 41% between 2021 and 2022, according to the 2022 IBM Cost of a Data Breach Report. Meanwhile, the second most common cause of cyberattacks, lost or compromised credentials, continues to be the toughest to spot and contain. It takes, on average, 243 days to spot these breaches and 84 more days to contain them.
Penetration testing, or pen testing, helps companies identify the security gaps that could lead to a breach before hackers can take advantage of them. Then, by simulating different cyber-attacks, they find ways to gain and maintain access to a system by skirting its defenses providing the crucial information companies need to close potentially dangerous loopholes.
However, sprawling IT systems make wide-ranging pen testing costly, leaving IT leaders wondering how they can get the most protection from their security budget. Here are five steps companies can take to find and address critical vulnerabilities in their IT infrastructure without breaking the bank.
1. Identify Data, Systems, and Processes
Before making any moves, organizations must first determine what is most critical to protect. That step is often overlooked or relies solely on known information. A good discovery process should result in known and newly discovered locations and uses of critical data, systems, and processes. Some examples of questions to ask are:
- What kind of data is each system handling? Does it have access to sensitive data?
- How critical is each system to maintaining business continuity?
- What type of interfaces do they have?
- Are they accessible by external parties, internal team members, or both?
Once identified, the security teams can combine the data, systems, and processes into groups to understand the threats and vulnerabilities affecting these areas.
2. Start with a risk assessment
Rather than tasking pen tests to look for vulnerabilities across the entire system, companies can save time and resources by first doing a risk assessment on the groups identified above. A system-wide risk assessment helps companies identify critical and high-value areas that may need more attention, such as vital applications, business processes, and high-value data.
Risk assessments should include both external and internal threats. For instance, understanding where internal team members have access to sensitive data can help focus the targets on testing for social engineering attacks, the most common type of cyberattack that IT professionals see, according to ISACA's State of Cybersecurity 2022 report.
Another common use case is an incomplete off-boarding process that may leave dormant accounts active for exploitation. External vulnerabilities can include the exploitation of open-source intelligence (OSINT), a collection of data on the open (and dark) web accessible to nearly everyone.
Based on these considerations, IT teams can set the scope and objectives for their test and avoid wasting time and resources on security work that won't significantly impact the business. Of course, the more critical the system and the more sensitive the data the more valuable intensive testing will be. It is important to note that conducting a thorough risk assessment is a complex undertaking, requiring a broad knowledge of continually evolving threat vectors, system vulnerabilities, and risk management techniques. Many organizations require additional professional resources to complete a risk assessment properly and thoroughly.
3. Conduct targeted testing on a regular schedule
From attacking firewalls to infiltrating active directories, organizations should regularly conduct several types of pen tests at least once a year, depending on the security needs of each system. In addition, pen testing of critical and sensitive systems should occur more regularly to replicate the most recent cyber-attacks.
The three categories of pen tests organizations should consider are:
- White box: These are generally the most cost-effective pen tests, as organizations provide all necessary information to testers. White box pen tests make locating vulnerabilities easier, saving an organization time and money.
- Black box: These tests are similar to real-world attacks, as testers must start from scratch. Pen testers receive no information about the organization's systems, which means they must spend more time trying to find a way to breach the defenses. While they are more costly, black box tests provide more accurate results.
- Gray box: Testers receive minimal information about the organization's systems, simulating the damage an authenticated internal user could cause. Mimicking an insider attack offers teams valuable security insights more cost-effectively than a black box test, which makes this a popular choice for organizations looking to get more for their money.
In most instances, organizations will start with a network layer penetration test that assesses the security of basic assets and systems. That includes devices, operating systems, and other low-level systems. But pen testing the application layer tends to be more critical and complex. For example, application layer pen testing requires organizations to look at the types of services they receive from vendors, whether they need to use credentials and more.
Organizations should also find ways to test their vulnerability to advanced persistent threats (APTs) designed to evade detection for months. Understanding how these threats operate can help teams implement more sophisticated defenses.
4. Remediate issues
Companies should work with security experts to address vulnerabilities as quickly as possible and establish a process for escalating high-risk findings to make every minute count. IT leaders should also consider the overall results of pen tests in light of the risk assessment conducted earlier. Recall that the goal of the exercise is to reduce the risk to a level commensurate with the asset's value or criticality.
5. Feedback and Training
In addition to the direct risk-reduction benefits from penetration testing, penetration testing results and reports are a valuable snapshot into the effectiveness of current development capabilities and vulnerability management practices. When long standing vulnerabilities are found, or when related vulnerabilities are found inconsistently across devices, this points sporadic and ad hoc processes that may need to be improved. If similar or related vulnerabilities are found across applications, this may point to an opportunity for enhanced training on secure software development. And 85% of IT security professionals agree that pen testing provides them with valuable insights to improve developer and security team training, per research from Cobalt.
Get advice from the experts
While companies can conduct pen testing using internal resources, partnering with external experts can ensure objectivity. Working with someone with little to no knowledge of the systems in question is true to life and promises to deliver more accurate results. In addition, a third party can uncover vulnerabilities internal developers and security professionals have missed.
For more information about how VikingCloud can help protect your systems with professional pen testing, contact us.
References:
Cost
https://www.ibm.com/resources/cost-data-breach-report-2022/
Risk Assessment
https://www.isaca.org/-/media/files/isacadp/project/isaca/resources/white-papers/state-of-cybersecurity-2022_whpsc22_res_eng_0322.pdf
Insights
https://demo.cobalt.io/hubfs/Cobalt%20ROI%20of%20Modern%20Pentest%20Report%202021.pdf
.png)
