Companies Suffer Crippling Business Damage During First 24 Hours of IT Outage
November 15, 2021
Share this

Most (83%) companies would suffer business damage during the first 24 hours of an outage and thereafter, according to Pivoting to Risk-Driven Security Operations, a report from Netenrich based on a global survey of IT and security professionals.


The survey also revealed interesting findings and contradictions when it comes to scaling security operations:

■ When looking to upgrade their security posture, 67% focused on tool upgrades yet organizations found that tool integrations (55%), lack of tool expertise (52%) and tool sprawl (41%) were their biggest pain points.

■ While security teams aspire to do more proactive and risk-driven operations, like risk management (37%), incident analysis (34%), threat modeling (29%), they spend most of their time doing foundational and reactive security tasks, like updating patches (43%), researching and analyzing critical incidents (41%) and removing false positives (40%).

Security teams are trapped doing the same thing they have been doing for years — reactive security. They're adding more tools, needing more resources and chasing thousands of alerts while lacking the contextual data and prioritization that's highly needed.

"Organizations fail to shift to a proactive approach that prioritizes security defenses around the most likely, highest business-impacting attack vectors," said John Bambenek, Primary Threat Researcher at Netenrich. "Security teams need to start evaluating business risk based on the likelihood of attack success and mapping that attack success to what it would actually cost the business. Focus on the critical issues that matter most to reduce the attack and outage impact."

The survey finds that companies want to do more threat modeling, incident analysis and risk management, however, very few employ it or even know how:

■ Less than 40% perform threat modeling.

■ Less than half conduct threat modeling on a daily (16%) or weekly basis (31%).

■ Only 30% practice external attack surface management.

"Our industry has taken an IT internal view to security rather than an attack external view of security," adds Bambenek. "Organizations need to shift mindsets, adopt a managed risk, not an IT-based approach. Security operations needs to be data-driven and predictive where continuous threat modeling runs at its core."

Other key findings from the report include:

■ 80% of companies have 30% or less of their IT budget dedicated to security.

■ Companies experienced minimal security budget increases despite growing IT demands as a result of remote work shifts and COVID impact: 19% reported no increases to security budgets, 29% received less than 10% budget and 8% received 50% or more budget increase.

■ Companies looked to MSPs to augment their security operations: 47% rely on managed services to run their ops entirely or in hybrid arrangements.

■ MSPs have an opportunity to expand their services by offering advanced, risk-based security and threat modeling services: only 17% of MSPs are offering threat modeling.

Methodology: Administered by Dimensional Research, a total of 333 qualified global IT and security professionals participated in the survey and carried enterprise security responsibilities at medium to enterprise-sized companies.

Share this

The Latest

June 29, 2022

When it comes to AIOps predictions, there's no question of AI's value in predictive intelligence and faster problem resolution for IT teams. In fact, Gartner has reported that there is no future for IT Operations without AIOps. So, where is AIOps headed in five years? Here's what the vendors and thought leaders in the AIOps space had to share ...

June 27, 2022

A new study by OpsRamp on the state of the Managed Service Providers (MSP) market concludes that MSPs face a market of bountiful opportunities but must prepare for this growth by embracing complex technologies like hybrid cloud management, root cause analysis and automation ...

June 27, 2022

Hybrid work adoption and the accelerated pace of digital transformation are driving an increasing need for automation and site reliability engineering (SRE) practices, according to new research. In a new survey almost half of respondents (48.2%) said automation is a way to decrease Mean Time to Resolution/Repair (MTTR) and improve service management ...

June 23, 2022

Digital businesses don't invest in monitoring for monitoring's sake. They do it to make the business run better. Every dollar spent on observability — every hour your team spends using monitoring tools or responding to what they reveal — should tie back directly to business outcomes: conversions, revenues, brand equity. If they don't? You might be missing the forest for the trees ...

June 22, 2022

Every day, companies are missing customer experience (CX) "red flags" because they don't have the tools to observe CX processes or metrics. Even basic errors or defects in automated customer interactions are left undetected for days, weeks or months, leading to widespread customer dissatisfaction. In fact, poor CX and digital technology investments are costing enterprises billions of dollars in lost potential revenue ...

June 21, 2022

Organizations are moving to microservices and cloud native architectures at an increasing pace. The primary incentive for these transformation projects is typically to increase the agility and velocity of software release and product innovation. These dynamic systems, however, are far more complex to manage and monitor, and they generate far higher data volumes ...

June 16, 2022

Global IT teams adapted to remote work in 2021, resolving employee tickets 23% faster than the year before as overall resolution time for IT tickets went down by 7 hours, according to the Freshservice Service Management Benchmark Report from Freshworks ...

June 15, 2022

Once upon a time data lived in the data center. Now data lives everywhere. All this signals the need for a new approach to data management, a next-gen solution ...

June 14, 2022

Findings from the 2022 State of Edge Messaging Report from Ably and Coleman Parkes Research show that most organizations (65%) that have built edge messaging capabilities in house have experienced an outage or significant downtime in the last 12-18 months. Most of the current in-house real-time messaging services aren't cutting it ...

June 13, 2022
Today's users want a complete digital experience when dealing with a software product or system. They are not content with the page load speeds or features alone but want the software to perform optimally in an omnichannel environment comprising multiple platforms, browsers, devices, and networks. This calls into question the role of load testing services to check whether the given software under testing can perform optimally when subjected to peak load ...