Survey Finds Gaps in Security Posture Visibility and Cyber Risk Measurement
Summary
A Cybersecurity Insiders survey of 297 U.S. IT and security professionals found widespread difficulty measuring security posture, quantifying cyber risk, and unifying cloud and on-premises visibility.
Key points
- The October 2021 online survey covered 297 U.S. IT and cybersecurity professionals across organizations of varying sizes and industries.
- Sixty-two percent said they were, at best, somewhat confident in their organization’s security posture; the same share could not quantify cyber risk in monetary terms.
- Sixty-three percent lacked a unified view of cloud and on-premises security posture.
- Fifty-eight percent reported awareness of fewer than 75% of their network assets.
- Forty percent struggled to distinguish vulnerabilities likely to pose real threats from those unlikely to be exploited; 37% said they assessed only a small subset of their attack surface.
- Respondents most often cited phishing, web threats, and ransomware as driving organizational risk (86%), followed by unpatched systems (54%) and misconfigurations (45%).
- The report recommends continuous asset and risk visibility, unified security data, and risk metrics that support prioritization and communication with leadership.
Article Details
- Publisher
- Cybersecurity Insiders
- Report Period
- 2022
- Scope
- Online survey of IT and cybersecurity professionals in the US, conducted in October 2021.
- Sample Size
- 297 respondents
- Key Statistics
- 62% of respondents were, at best, somewhat confident in their security posture.
- 62% of respondents could not quantify cyber risk in monetary units.
- 63% of organizations lacked a unified view of cloud and on-premises security posture.
- 58% of organizations reported awareness of fewer than 75% of their network assets.
- 86% of respondents identified phishing and ransomware as leading security threats.
- Recommendations
- Unify IT and cybersecurity data to improve visibility into asset inventory and attack surface.
- Maintain a continuous, real-time inventory covering managed and unmanaged, on-premises and cloud, fixed and mobile assets.
- Prioritize vulnerabilities by severity and business criticality, and improve visibility into risks across devices and applications.
- Combine cloud and on-premises security visibility into one view.
- Use quantifiable risk metrics and intuitive visualizations to communicate cyber risk to boards and senior management.