68% of Cyber Teams Can’t Achieve 4-Day Cyber Incident Disclosures

Four days. That’s the amount of time allowed for businesses to disclose cyber incidents. And although the SEC’s cyber disclosure rule only applies to public companies, it sets a new standard for incident disclosure for all businesses, regardless of size and industry.

So, are businesses prepared to meet this benchmark? Not quite. New VikingCloud research found 68% of companies could not meet a four-day disclosure rule if required today. In fact, 7% couldn’t even do it in 30 days. It’s no surprise that major companies are failing to be compliant. For smaller companies with limited resources, the challenge can become even greater.

To get ahead of a toughening regulatory environment, businesses must transform their approach to incident response. By overcoming common pain points and leveraging tech, leaders can go beyond compliance and reduce cyber risk like never before.

Behind the Scenes of Incident Response Failures

Cyber risks are increasing in frequency and severity, with data breaches surging to an all-time high in 2023. Yet only 5% of companies have allocated additional budget to their cyber programs. A mere 10% have increased cyber hiring in the past 12 months.

With attacks rising, employees are under more pressure than ever without the resources or hiring needed for protection. For 63% of companies, false positives are taking up 4+ hours per week (208 hours per year). As a result, 33% have been late to respond to a cyber attack for that very reason.

Even more concerning is the number of known cyber incidents that are going unreported. Four in 10 security professionals admit they’ve underreported cyber incidents out of fear of losing their jobs. The problem here isn’t just disclosing within a short time window – it’s disclosing at all, even to internal leaders.

The Path Toward Strengthening Your Risk Radar

To meet the new standard for disclosure – and more importantly, establish better visibility and protection against risk – businesses should prioritize three key steps toward effective incident response.

• ‍Reevaluate Current Incident Response Strategies: How often do you conduct incident response drills? When an incident occurs, how long does it take your team to identify and remediate it? How much of their time is wasted on false positives each year? Knowledge is power. Identify the gaps that need to be filled, set goals for improvement, and then create a go-forward plan.
  ‍‍
• Foster a Culture of Transparency: The underreporting crisis highlights the importance of developing a culture where employees don’t receive backlash for flagging security incidents. Whenever appropriate, there should be constructive conversations on how to do better going forward. Fueling fear will only lead to hindered visibility.
  ‍
• Invest in Emerging Technology: Cyber criminals are innovating faster than cyber security teams. 55% of companies believe modern cyber criminals are more advanced than their internal team, and 35% say the technology behind cyberattacks is more sophisticated than the tech they have access to. The strategic use of technology to overcome incident response failures is table stakes for businesses today. 41% of companies surveyed believe GenAI has the most potential to close the cybersecurity talent shortage and skills gap and 24% say GenAI can help create more efficient incident response plans.

Four days is a tight window – but harnessing the ability to disclose incidents quickly creates benefits that go beyond compliance. Fast detection leads to rapid response. It could be the difference between an attempted attack and a full-on breach. By benchmarking performance and setting goals, revitalizing the culture, and implementing the right tech, teams can level up to the disclosure challenge.

Download VikingCloud’s 2024 Cyber Threat Landscape Report to dive deeper into the failures of current incident response strategies, what attacks cyber teams are least prepared for, and where emerging technology like GenAI is already showing promise in beating cyber criminals at their own game.