Companies Suffer Crippling Business Damage During First 24 Hours of IT Outage
November 15, 2021
Share this

Most (83%) companies would suffer business damage during the first 24 hours of an outage and thereafter, according to Pivoting to Risk-Driven Security Operations, a report from Netenrich based on a global survey of IT and security professionals.


The survey also revealed interesting findings and contradictions when it comes to scaling security operations:

■ When looking to upgrade their security posture, 67% focused on tool upgrades yet organizations found that tool integrations (55%), lack of tool expertise (52%) and tool sprawl (41%) were their biggest pain points.

■ While security teams aspire to do more proactive and risk-driven operations, like risk management (37%), incident analysis (34%), threat modeling (29%), they spend most of their time doing foundational and reactive security tasks, like updating patches (43%), researching and analyzing critical incidents (41%) and removing false positives (40%).

Security teams are trapped doing the same thing they have been doing for years — reactive security. They're adding more tools, needing more resources and chasing thousands of alerts while lacking the contextual data and prioritization that's highly needed.

"Organizations fail to shift to a proactive approach that prioritizes security defenses around the most likely, highest business-impacting attack vectors," said John Bambenek, Primary Threat Researcher at Netenrich. "Security teams need to start evaluating business risk based on the likelihood of attack success and mapping that attack success to what it would actually cost the business. Focus on the critical issues that matter most to reduce the attack and outage impact."

The survey finds that companies want to do more threat modeling, incident analysis and risk management, however, very few employ it or even know how:

■ Less than 40% perform threat modeling.

■ Less than half conduct threat modeling on a daily (16%) or weekly basis (31%).

■ Only 30% practice external attack surface management.

"Our industry has taken an IT internal view to security rather than an attack external view of security," adds Bambenek. "Organizations need to shift mindsets, adopt a managed risk, not an IT-based approach. Security operations needs to be data-driven and predictive where continuous threat modeling runs at its core."

Other key findings from the report include:

■ 80% of companies have 30% or less of their IT budget dedicated to security.

■ Companies experienced minimal security budget increases despite growing IT demands as a result of remote work shifts and COVID impact: 19% reported no increases to security budgets, 29% received less than 10% budget and 8% received 50% or more budget increase.

■ Companies looked to MSPs to augment their security operations: 47% rely on managed services to run their ops entirely or in hybrid arrangements.

■ MSPs have an opportunity to expand their services by offering advanced, risk-based security and threat modeling services: only 17% of MSPs are offering threat modeling.

Methodology: Administered by Dimensional Research, a total of 333 qualified global IT and security professionals participated in the survey and carried enterprise security responsibilities at medium to enterprise-sized companies.

Share this

The Latest

December 08, 2022

Industry experts offer thoughtful, insightful, and often controversial predictions on how APM, AIOps, Observability, OpenTelemetry and related technologies will evolve and impact business in 2023. Part 4 covers monitoring, site reliability engineering and ITSM ...

December 07, 2022

Industry experts offer thoughtful, insightful, and often controversial predictions on how APM, AIOps, Observability, OpenTelemetry and related technologies will evolve and impact business in 2023. Part 3 covers OpenTelemetry ...

December 06, 2022

Industry experts offer thoughtful, insightful, and often controversial predictions on how APM, AIOps, Observability, OpenTelemetry and related technologies will evolve and impact business in 2023. Part 2 covers more on observability ...

December 05, 2022

The Holiday Season means it is time for APMdigest's annual list of Application Performance Management (APM) predictions, covering IT performance topics. Industry experts — from analysts and consultants to the top vendors — offer thoughtful, insightful, and often controversial predictions on how APM, observability, AIOps and related technologies will evolve and impact business in 2023. Part 1 covers APM and Observability ...

December 01, 2022

You could argue that, until the pandemic, and the resulting shift to hybrid working, delivering flawless customer experiences and improving employee productivity were mutually exclusive activities. Evidence from Catchpoint's recently published Site Reliability Engineering (SRE) industry report suggests this is changing ...

November 30, 2022

There are many issues that can contribute to developer dissatisfaction on the job — inadequate pay and work-life imbalance, for example. But increasingly there's also a troubling and growing sense of lacking ownership and feeling out of control ... One key way to increase job satisfaction is to ameliorate this sense of ownership and control whenever possible, and approaches to observability offer several ways to do this ...

November 29, 2022

The need for real-time, reliable data is increasing, and that data is a necessity to remain competitive in today's business landscape. At the same time, observability has become even more critical with the complexity of a hybrid multi-cloud environment. To add to the challenges and complexity, the term "observability" has not been clearly defined ...

November 28, 2022

Many have assumed that the mainframe is a dying entity, but instead, a mainframe renaissance is underway. Despite this notion, we are ushering in a future of more strategic investments, increased capacity, and leading innovations ...

November 22, 2022

Most (85%) consumers shop online or via a mobile app, with 59% using these digital channels as their primary holiday shopping channel, according to the Black Friday Consumer Report from Perforce Software. As brands head into a highly profitable time of year, starting with Black Friday and Cyber Monday, it's imperative development teams prepare for peak traffic, optimal channel performance, and seamless user experiences to retain and attract shoppers ...

November 21, 2022

From staffing issues to ineffective cloud strategies, NetOps teams are looking at how to streamline processes, consolidate tools, and improve network monitoring. What are some best practices that can help achieve this? Let's dive into five ...