Almost one in 10 US security professionals has admitted to having considered participating in Black Hat activity, according to a report released by Malwarebytes. Surprisingly, this was the lowest rate among all countries surveyed. More than one in five (21 percent) of UK security professionals have considered the Black Hat route.
Conducted by Osterman Research, the study “White Hat, Black Hat and the Emergence of the Gray Hat; The True Costs of Cybercrime” polled 900 senior IT decision-makers and IT security professionals in Australia, Germany, the U.S., UK, and Singapore about the impact of cybercrime on their bottom line, and also looks at all sides of IT security costs from budget and remediation, to hiring, recruiting and retention.
Black/Gray Hats aren’t hard to find in today’s SOCs. More than half of all US security professionals surveyed (50.5 percent) know or have known someone that has participated in Black Hat activity. This was the highest rate of all countries surveyed. The global average was 41 percent.
“The current skills shortage combined with a steady stream of attacks against antiquated endpoint protection methods continues to drive up costs for today’s businesses, with a seemingly larger hit to security departments of mid-market enterprises,” said Marcin Kleczynski, Malwarebytes CEO.
“On top of this, we are seeing more instances of the malicious insider causing damage to company productivity, revenue, IP and reputation. We need to up-level the need for proper security financing to the executive and board level. This also means updating endpoint security solutions and hiring and rewarding the best and brightest security professionals who manage endpoint protection, detection and remediation solutions.”
Security remediation costs are skyrocketing
The current skills shortage combined with a steady stream of attacks against antiquated endpoint protection methods continues to drive up costs for today’s businesses, with a seemingly larger hit to security departments of mid-market enterprises.
The study showed that US-based businesses experienced a higher number of very serious security events such as ransomware and intentional insider breaches compared to other countries surveyed – an average of 1.8 incidents in 2017.
Based on security budget per employee responses, the average 2,500 employee company in the US will spend more than $1.8 million dollars on security costs. That number is expected to increase to more than $2 million in 2018 – nearly twice the average cost of all global responses (more than $1 million in 2018).
Remediating major security incidents is extremely expensive: the average global expenditure for remediating just a single event is approximately $290K for a 2,500-employee organization. In the US, the average cost escalates to $429K.
Phishing was the most common cause of major incidents globally (44 percent) with ransomware (26 percent) and spear phishing (20 percent) also in the top five. While the delivery tactics are familiar, the malware has grown increasingly complex and sophisticated.
Massive increases in security incidents and exploding security budgets
To protect against a high volume of malicious attacks, mid-sized companies’ security budgets increased by 36 percent, according to the study.
Mid-market businesses had the highest percentage of security budget increases from 2017 to 2018 (36.32 percent increase for midsize companies; 20.46 percent increase for large companies; 8.5 percent increase in budget for small companies) to counter the significantly higher levels of adware, accidental insider data breaches and intentional insider data breaches and even nation state attacks.
Mid-sized companies spent 19 percent of their security budget remediating compromises. Fewer staff on-hand in mid-sized companies’ Security Operations Centers (SOCs) to handle the volume of attacks resulted in the highest percentage of security budget spent on remediating attacks (18.62 percent of budget spent on remediating compromises) compared with both large (11.3 percent of budget spent on remediating compromises) and smaller (13.97 percent of budget spent on remediating compromises) enterprises.
Forty-nine percent of global mid-market professionals were most likely to suggest that it’s easy to get into cybercrime without getting caught.