A survey of IT decision makers in the United States, the United Kingdom, Germany, and France highlighted what Varonis Systems, Inc., said in a statement was “an alarming disconnect between security expectations and reality.”
The vast majority (89 percent) of respondents expressed confidence in their cybersecurity stance and said that their organization was in a good position to protect themselves from attack. Yet, according to Varonis, four in 10 organizations are not taking critical steps to lock down sensitive information, putting them at risk from data loss, data theft, and the next ransomware attack.
Nearly half of respondents (45 percent) said their organization will face a major, disruptive attack in the next 12 months.
Looking ahead to 2018, data theft and data loss were cited as top concerns for organizations. Other notable findings included:
- 25 percent reported their organization was hit by ransomware in the past two years.
- 26 percent reported their organization experienced the loss or theft of company data in the past two years.
- Eight out of 10 respondents are confident that hackers are not currently on their network.
- 85 percent have changed or plan to change their security policies and procedures in the wake of widespread cyberattacks such as WannaCry.
The survey also showed major differences on cybersecurity policies and tendencies by country. Key findings in this area included:
- Only 66 percent of U.S. organizations and 51 percent of EU-based organizations surveyed fully restrict access to sensitive information on a “need-to-know” basis. Organizations in Germany were the least likely to restrict access (38 percent).
- A majority (67 percent) of respondents reported their organizations had cybersecurity insurance policies. They were least prevalent in the U.S. (62 percent) and most common in France (75 percent).
- German organizations have been hit particularly hard by ransomware, with 34 percent affected in the past two years.
“Attackers are upping their game, using more sophisticated, blended attacks like WannaCry and NotPetya that make use of multiple attack vectors,” said Varonis' chief marketing officer, David Gibson. “At the same time, valuable data remains vulnerable to attacks that require little to no sophistication, like disgruntled employees snooping through overly accessible folders. While it's heartening that major security incidents are inspiring preparedness, if the past year is any indication, it is unlikely the actual security of these organizations aligns with perception.”