Some of the findings from this year’s Risk & Resilience research show cyber risk continues to be a blind spot for global executives – where they appear to be failing to see or understand the changing face of cyber crime.

• The perceived threat of cyber to global business leaders continues to drop – with just only a quarter (26%) ranking cyber as their top threat – down from 34% in 2021. 
• However, at the same time perceived resilience to cyber risk is dropping – with 75% of executives feeling resilient to cyber risk, down from 80% in 2022.
• And 11% of global boardrooms admitted in the survey that they believe their organisation has inadequate protection for cyber risk.
• 23% of c-suite leaders said they are unprepared for cyber risks this year – this rises to 29% among large UK firms (£1bn+ revenue).

Many cyber crime techniques established over the past forty years continue to be used today and have been updated to meet current business paradigms. This means that, while the technical sophistication of many attackers has increased, one of the best defences an organisation can deploy is having sound process related to patching, governed access to systems, and monitoring of systems, user behaviours, and data.

Where things get more complicated is the change in motivation. Threat actors that were previously driven by activism have fallen away almost completely, and been replaced by those motivated entirely by profit. And, as a business focused on efficiency, these actors have continued to innovate.

Advanced techniques and tools that were formerly only available only to nation states are now commercially available to well-funded and organized criminal organisations. This raises the stakes for firms as they face a steady supply of experts ready to infiltrate IT systems, exfiltrate data at speed, exploit their targets and sell data on the dark web to maximise profit. 

“The core activity is the same. Cyber criminals exploit businesses for financial gain. However, the techniques and methodologies of the attacks are becoming more sophisticated. We have seen that cyber crime networks are becoming more industrialised.” 

Patricia Kocsondy
Head of Global Cyber Digital Risks