Nearly 75% of Organizations in 5 Countries Fail in Cyber Security Readiness: Hiscox

Major shortcomings exist in cyber security readiness for nearly three-quarters (73%) of more than 4,100 organizations in five countries, despite keen awareness of the threat, according to a study commissioned by specialist insurer Hiscox.

Indeed, almost half, or 45 percent, of survey respondents experienced at least one cyber attack in the past year, while two-thirds suffered two or more attacks, said the “Hiscox Cyber Readiness Report 2018,” which surveyed a representative sample of private and public sector organizations in the UK, U.S., Germany, Spain and the Netherlands.

While the costs of cyber crime range up to $25 million, the average cost of all incidents for survey respondents was $229,000. However, the average cost “masks some wide variations,” said the report, explaining that the average costs ranged between $356,000 in Spain and $1.05 million in the U.S. for organizations with 1,000-plus employees.

At the same time, some organizations faced still higher costs – up to $25 million in the U.S. and $20 million in Germany and the UK, the study confirmed. “For the very smallest (those with fewer than 100 employees), average costs ranged between $24,000 in Spain and $63,000 in Germany.”

Financial services, energy, telecoms and government organizations are the prime targets for hackers, while financial services firms are the largest spenders on cyber security, followed by the pharmaceuticals and healthcare sector and then government entities, the survey revealed.

The Hiscox study assessed each organization according to their cyber security strategy and the quality of its execution – and ranked them accordingly. Only 11 percent scored highly enough in both areas to qualify as cyber security “experts,” while one in six firms (16 percent) achieved expert status in either strategy or execution, but not both, the study revealed.

“The survey highlights a widening gulf between those who ‘get’ cyber security, take it seriously, and spend appropriately, and those who still regard the issue as someone else’s problem. Cyber security is not an IT issue but rather a risk for the whole organisation; tackling it is more about people, behavior and culture than clever technology,” said the report.

The report offers a picture of what best practice looks like, which often “is not ‘more technology’ but proactive thinking, more rigorous processes and better trained staff,” said Steve Langan, chief executive of Hiscox Insurance Co., in a prepared statement