Cyber resilience programmes fall short according to study

Why cyber resilience is at the top of the list of strategic business objectives

The 2023 Cyber Workforce Resilience Trend Report by Immersive Labs, an employee-centric cyber resilience company, shows that organisations are focusing heavily on building holistic cyber resilience in the face of rising cyber attacks and the acute threat landscape. Cyber resilience as a package of measures can prevent cyber attacks on IT infrastructure - or ensure rapid recovery and secure continued operation of IT after an attack has occurred. It affects many parts of a company or organisation, not exclusively IT security teams. The study surveyed 570 cybersecurity and risk managers in the US, UK and Germany (companies with at least 1,000 employees).

Although 86 percent of the 570 security executives surveyed already have a cyber resilience programme in place at their companies, more than half of the respondents say there is a lack of a holistic approach to assessing cyber resilience. The most important areas of focus for companies are overall corporate strengthening, taking into account the entire workforce.Despite these efforts, 53 per cent of respondents say their employees are not adequately prepared to recognise and defend against potential future cyber attacks of any kind.

The study highlights the need for effective and modernised cyber resilience programmes that are not just tailored to cyber security teams. In many cases, companies express doubt that employees do not know how to specifically respond to cyber security incidents. As a result, the reliability of industry certifications and classroom training is questioned. Appropriate metrics for measuring their own cyber resilience are often not available at many companies, board and top management still often fail to recognise the urgency and need for action, and too few decision-makers (46%) still demand concrete evidence of the company's own resilience. The results of the study indicate that although the topic of cyber resilience has a high priority in the strategic orientation and sufficient training and programmes are available on the market, the existing structures and training methods are to be assessed as inefficient.

Findings of the study

• Ignorance among employees
  46 percent of respondents believe that despite training, employees do not know how to deal with phishing emails.
  Maintaining business operations without the failure of key IT systems, manually handling time-critical processes and avoiding the disruption of the recovery process by connecting compromised devices to the network are among the top priorities.
• Too little training
  Questioning the reliability of industry certifications and classroom training in building cyber resilience: while almost all companies support industry certifications, only 32 per cent consider them effective in mitigating cyber threats. Classroom training is offered too infrequently to be effective: Only 27 per cent of respondents say they attend training on a monthly basis.
• Industry certifications not effective
  While virtually all companies promote industry certifications, only 32 per cent see them as an effective means of mitigating current cyber threats.
• Lack of metrics framework for measurement
  46 per cent said they had no required metrics to demonstrate employee resilience in the event of a security incident. Only a tiny fraction of companies (6 per cent) have meaningful metrics to demonstrate the cyber resilience of teams to management, such as response times to remediate a vulnerability.
• Lack of sensitivity at management level
  In just under half of the companies surveyed (51 per cent), proof of cyber resilience was required of the cyber security teams by management. Raising board and executive awareness of the importance of cyber resilience is an important step in gaining more support.