The BCI is pleased to launch the BCI Update Series: Cyber Resilience Report 2024. The report examines disruption levels, organizations’ cyber resilience arrangements, and highlights changes and trends in the sector.
Cyber threats have increased in severity over the past year, with 75% of respondents reporting a rise in attempted breaches and 39.4% falling victim to a successful cyber-attack. Traditional phishing, particularly credential harvesting, continues to thrive due to widespread digitalisation and availability of sophisticated, but highly accessible, AI tools. In total, 61.3% of respondents said their organizations suffered a cyber incident as a result of phishing or spear phishing, highlighting the continued popularity and effectiveness of this method of attack.
Despite this trend, ransomware, which emerged as the third most disruptive type of cyber-attack to affect businesses in 2024, is identified as the top threat for more than 90% of organizations over the next five years. Its position at the top of the table is not surprising: ransomware attacks have become more complex, often using sophisticated social engineering attempts on senior management. Such attacks have the potential to wreak financial havoc on organizations, as well as delivering severe reputational harm. Additional identified threats for the next five years include lack of staff awareness and understanding, reputational damage, artificial intelligence, and state-sponsored cyber-attacks.
Over the last 12 months, nearly half of organizations have successfully thwarted cyber-attacks through their focus on preparedness and fast response, despite growing sophistication and increasing attack volumes. A positive move is the increased uptake of controls to manage cyber security risk: 93% of organizations now have controls in place to manage cyber risks marking a rise from 89.9% in 2023. In addition, there has been a significant increase on previous years’ cyber-attack response times with 73% of respondents capable of orchestrating a response within an hour, and 14% doing so instantaneously.
Overall, despite challenges in technology access across regions, advancements in detection and response capabilities, plus robust awareness and training programmes, have enhanced cyber resilience.
In response to the reported increasing severity and the sophistication of cyber-attacks, 65.9% of respondents reported a high level of commitment from top management to cyber risk, indicating a growing recognition of cybersecurity's critical importance at the highest organizational levels, as well as the potential for business-changing financial and reputational impacts. However, there remains a need for ongoing education and awareness efforts to ensure comprehensive understanding of cybersecurity complexities among top managers.
Perhaps due to the recognition of severe financial loss that could be caused by an attack, organizations are increasingly leveraging cyber insurance to provide a financial safety net. While less than half of respondents reported cumulative impacts of cyber-attacks under 50,000 euros, most do not account for indirect costs, such as lost customers and lost sales, when estimating the financial impact of cyber incidents.
The BCI Update Series: Cyber Resilience Report 2024 is available now