20 years later: reflecting on Cybersecurity Awareness Month

20 years later: reflecting on Cybersecurity Awareness Month

For the past 20 years, October 1 marked the start of Cybersecurity Awareness Month. This is a time where security leaders come together to raise awareness, stress the importance of and bring attention to this critical issue to all businesses and to all citizens.

As we celebrate the 20th anniversary, I looked back and reflected on how much has changed.

Let’s contextualize some data points to put things into perspective:

·        The number of cyber attacks has increased exponentially. According to the Cybersecurity and Infrastructure Security Agency (CISA), in 2000, there were an estimated 360,000 cyber attacks. By 2022, that number had grown to more than 600 billion.

·        Cyber attacks are increasing in sophistication. In the early 2000s, the majority of cyber attacks were simple phishing attacks or malware infections. Today, cyber attacks are more sophisticated, using a variety of vectors, such as ransomware and deepfakes.

·        The cost of cyber attacks has increased. In 2000, according to CISA, the average cost of a data breach was $100,000. By 2022, that number grew to $4.24 million.

·        The cost of breaches is outpacing the GDP growth rate of the world’s largest economies. The two largest economies today are China and the US. Per World Bank statistics, in the past 20 years, US GDP has grown by 148%; China grew at a staggering 1,383%. But that is nothing compared with the 4,140% growth we see in the estimated average cost of a cyber breach.

·        The laws and regulations governing cybersecurity have tightened. In the early 2000s, there was far less regulation governing cybersecurity, either industry-wide or from federal mandates. Today, businesses are under constant pressure from myriad cyber regulations that vary widely worldwide. The recent enactment of the SEC rules is another significant step designed to enhance and standardize registrants’ disclosures related to cybersecurity risk management, strategy and governance. These are important changes, but did they take too long to enact given the cost of breach growth noted above?

With this evolution, the focus and mindset of leadership also have evolved in the past 20 years. Coincidentally, the inaugural EY Global Information Security Survey launched in 2003. I thought it would be interesting to look back to compare how security leaders’ priorities have changed compared with our 2023 report.

C-suite disconnect: In 2003, only 51% of respondents believed they were aligned with broader business. Today, 60% of chief information security officers (CISOs) are satisfied with integration into C-suite business decisions. While this is a vast improvement, it’s surprising to see that there is still a large disconnect between the CISO and C-suite. In recent years, destructive malware attacks have demonstrated to boards just how cybersecurity can disrupt a company’s ability to operate, manufacture products and deliver business services. Closing this gap is key —organizations that have cybersecurity operations embedded with core business strategic priorities show higher security performance.

Budgets remain top of mind. In 2003, 56% of security leaders cited budget as a top concern. In 2023, that number has dropped to 38%. While we have seen leaders finding increased success securing budgets, there is still room to improve. Amid the clutter of tools available to mitigate cyber threats today, there is a need to simplify, optimize and rationalize existing cybersecurity technologies to reduce the total cost of ownership and execute seamless operations at speed. CISOs need to do a better job communicating the business value of the programs that they run.

Threats are evolving. In 2003, 33% said they were inadequate in responding to incidents. In 2023, 53% feel they are well positioned to address tomorrow’s threats. This is great news amid the fact that the cyber threat environment continues to worsen and evolve every year — with organizations facing an average of 44 significant cyber incidents a year and 52% of leaders sharing that “too many attack surfaces” was the most cited internal challenge to an organization’s cybersecurity approach. To overcome this increasing complexity, it is critical for organizations to implement standardization, simplification and the use of automation to make it easier and faster to respond to threats and recover confidently from disruption.

Human risk. In 2003, only 35% said they had a continuous education program for employees. Today, 56% say upskilling and training talent is a top priority. And while these growing numbers are a positive sign, only half are satisfied with the effectiveness of their cybersecurity training program. Thirty-six percent say the same with non-IT adoption leading practices. It is important to remember that human error continues to be a leading cause of cyber breaches. Mature organizations today must simplify leading practices asked of the workforce and combine incremental and well-designed training with automation and prevention tools to make the workforce cyber secure by design.

What do the next 20 years hold?

The reality is that as technology evolves, cybercrime costs are expected to grow by 15% per year over the next five years, reaching $10.5 trillion USD annually by 2025. And with the rise of generative AI (GenAI), a new wave of cybersecurity technology adoption is imminent, both defensively and offensively.

As new technologies continue to emerge, we find ourselves at a crucial moment in time where 84% of organizations are in the early stages of adopting two or more cybersecurity technologies coinciding with new technology implementation. Compounding this is the risk that cloud at scale and IoT pose — more than 7 in 10 leaders rank these as the top two technology risks in the next five years.

It is hard to contemplate what we will face in 20 years as emerging technologies are adopted at scale. For example, 20 years ago, Gartner’s Hype Cycle highlighted grid computing, process portals and virtual content repositories. Now, leaders are responding to such emerging technologies as GenAI, quantum computing and multi-cloud.

In this new era of innovation, organizations cannot assume cyber risk is being handled by their service providers. They need to take a proactive and shared responsibility approach and hold providers to the same security standards that are embedded across the organization.

In closing, I am curious to hear from you. What has been the biggest change you observed in the past 20 years? What are you thinking about as we approach the next 20? Please comment with your thoughts below.

The views reflected in this article are those of the author and do not necessarily reflect the views of Ernst & Young LLP or other members of the global EY organization. Findings about specific emerging technologies are among employees who are familiar (very/somewhat) with the respective technology.