The Cyberattack Price Tag

There are so many consequences that come with a data breach or cyberattack. The obvious ones are embarrassment at seeing your company in the headlines; upset customers who suddenly feel vulnerable or frustrated that your service is down due to a cyberattack; and if you are a public company, loss in investor and financial analyst confidence resulting in a likely hit to your stock price.

With GDPR just taking effect in the last two weeks, the financial penalty for any organization that is breached and found out of compliance is steep. The financial toll felt from lost customers, business and operational downtime, and lost productivity on top of any regulatory impacts just worsens the blow. This is just one example of the impact that a data breach can have, never mind the impact that another type of cyberattack (DDoS attack, ransomware, etc.) can have on a business.

To put actual numbers around the impact of cyberattacks overall, we recently conducted a poll on the topic, and the results are clear: the cyberattack price tag is not one any company wants to budget into their operating costs, but clearly it needs to be considered.

The survey, conducted by research company Vanson Bourne, asked 400 IT decision-makers to quantify both the number of attacks experienced in the last 12 months and the resulting financial damage.

The headline-grabber is the price tag that those surveyed admitted they faced as a result of a cyberattack or cyberattacks:

The sheer number of companies who have faced even just one cybersecurity incident in the last 12 months is high. I am not surprised by this number, but seeing hard data to support what we already knew – it is not ‘if’ but ‘when’ your company will be breached – is an eye-opening reminder.

The reality is, every organization will face a cyberattack or breach at some point in their company’s history. But realistically, most organizations will face multiple cybersecurity incidents in their tenure. In the case of our poll respondents, the average is nearly 30 over a 12-month period.

Thirty cybersecurity incidents in a 12-month span equates to more than two cybersecurity incidents per month. Keeping up with that level of cybersecurity activity puts incredible hardship on IT security teams and quite honestly, the entire company – from the corporate communications and HR teams who must manage the message internally and externally; to the investor relations and customer support teams who must manage the message that investors, financial analysts and customers receive; and the legal and privacy teams who now have a regulatory duty to report the incident or face the regulatory ramifications of not reporting it.

While the price tag that a cybersecurity attack comes with and the number of cyberattacks that we are seeing today has become our new reality, what did surprise me coming out of our poll was the number of respondents who actually did not know if they had experienced a cyberattack at all.

This signals a glaring lack of visibility across the organization. It should go without saying, but it could not be more important for enterprises to have crystal clear visibility into their users and what access they have to applications and data. This goes back to the notion that identity is everything. By understanding who has access to what, is that access appropriate, and understanding what they are doing with that access, you suddenly have the visibility needed to spot when a malicious actor may have overtaken one of your digital users’ identities. The most effective way to safeguard against the next would-be data breach or cyber threat: a comprehensive approach to identity that spans all digital identities and their access to all data, all applications and all systems. That is the surest path forward today to a secure enterprise.