Awareness of the importance of cyber resilience is a far cry from being effectively prepared to deal with cyber attacks.
A recent Palo Alto Networks Cyber Resilience Survey, conducted in partnership with IDC Research, reveals that while there is an awareness of the importance of cyber resilience, there is a lack of preparedness to manage and defend against a cyber attack.
The cyber resilience report
The report, “Reevaluating Cyber Resilience: beyond the Illusion of Maturity“, the result of a survey conducted in several countries in Latin America (Latam) and Europe, Middle East and Africa (Emea), including Italy, reveals that only 28 per cent of CISOs (Chief Information Security Officers) regularly test recovery plans, highlighting a gap between awareness of the importance of resilience and actual preparedness for cyber attacks.
Although 78 per cent of organisations recognise the critical role of cyber resilience in their digital strategies, only 40 per cent are confident that they can withstand an attack without suffering serious damage.
One of the biggest surprises is the low percentage (21%) of CISOs in banking, financial services and insurance who regularly test recovery plans. This is one of the lowest percentages of any vertical sector, despite being one of the most regulated. It is clear that as threat levels and market complexity increase, CISOs face a particularly difficult task in balancing increasingly sophisticated threats with a shortage of security talent.
The main challenges, according to 70% of respondents, are the skills gap and the lack of talent and new technology skills in security. The lack of correlation between multiple point solutions is another barrier, cited by 52% of respondents.
This data underscores the need to develop strategic initiatives and rethink existing tools to improve cybersecurity postures.
Limits between expectations and reality
Although 78 per cent of organisations in Emea and Latam recognise the importance of cyber resilience, fragmentation and lack of resources often prevent organisations from aligning their aspirations with reality.
“Given the relative level of maturity in EMEA and LATAM, it is surprising to see how few CISOs are equipped to regularly test their recovery plans,” said Haider Pasha, Chief Security Officer, EMEA LATAM di Palo Alto Networks. “Tuttavia, la battaglia che devono affrontare è complessa. Da un lato, gli eventi geopolitici e le interruzioni della catena di approvvigionamento aumentano il livello delle minacce, dall’altro la carenza di talenti e di competenze rilevanti rendono sempre più impegnativa l’implementazione di soluzioni e la preparazione a contrastare attacchi futuri.”
Market differences
The research shows few geographical differences between markets in Europe, Latin America and the Middle East, demonstrating the general consensus that cyber resilience is a key element for businesses.
In particular, markets in Saudi Arabia (48 per cent), Spain (44 per cent), Brazil (43 per cent) and France (42 per cent) cite cyber resilience as a top priority.
Italy is at the bottom of the list, with only 36% of companies considering cyber resilience a priority, followed by Israel (30%) and the Netherlands (24%).
Technological challenges
At the technology level, only 11 per cent of organisations use mature cybersecurity controls for cyber resilience, with some EMEA countries scoring between 0 and 5 per cent. Most rely on business continuity plans (74 per cent), disaster recovery (72 per cent), ransomware recovery (54 per cent) and crisis management strategies (51 per cent).
“It is clear that many organisations still lack the resources and confidence to implement a cyber resilient technology stack designed to prevent attacks,” aggiunge Haider Pasha. “They are forced to rely on tactics such as disaster recovery, which are designed to react to incidents rather than plan for them. The lack of visibility into the true impact of threats and the focus on remediation exposes organisations to more risk, precisely because they are unable to plan for the future.”
The transformation
However, the survey does reflect a desire to change the culture of cyber resilience, with the influence of top management becoming increasingly important. 72% of respondents said that board members were the main driver of the focus on cyber resilience, higher than the focus on regulatory obligations (70%).
“A clear commitment from senior management to create and maintain crystal-clear security policies and measure their impact, as well as empowering middle management to make faster decisions, is critical. Without all of this, the responsibility for responding to incidents falls to the cybersecurity teams, without preparing the business to develop better postures,” concludes Haider Pasha.
