Is your organization ready for a ransomware attack? What if you were hit weekly, or even daily?
According to Menlo Security’s 2022 Impacts: Ransomware attacks and preparedness report, one-third of organizations face ransomware attacks at least weekly, while 9% deal with attacks more than once a day. They also report that in the last 18 months, 53% of respondent organizations have been the victim of a ransomware attack.
Ransomware attacks are on the rise — especially ‘Highly Evasive Adaptive Threats’ or (HEAT). As explained by Menlo, “a HEAT attack is a class of cyberthreat that leverages web browsers as the attack vector and employs various techniques to evade multiple layers of detection in current security stacks.”
It’s also important to note that the rise in remote work has also increased potential entry points, opening up a whole new range of vulnerabilities.
Additional findings from Menlo’s survey, conducted among 500+ IT security decision makers at US- or UK-based companies with more than 1,000 employees, include:
- 41% of respondents said they worry about ransomware attacks evolving beyond their team’s knowledge and skillset.
- 39% worry about attacks evolving beyond their company’s security capabilities.
- 46% of respondents are most concerned about the risk of employees ignoring the advice of corporate security, clicking on links or attachments with malware.
- The average estimated cost of a ransomware attack is $326,531.00. Insurance payouts brought this up to an average of $555,971.00.
“Security professionals are coming under increasing pressure as organizations face an unprecedented number of highly sophisticated threats like ransomware,” explained senior director of Cybersecurity Strategy at Menlo Security, Mark Guntrip, in a press release.
“On the frontline of cyber defense, they are often coping with huge amounts of stress, worrying about what employees are doing, their team and whether they are getting the right support internally, so it’s no surprise they are prioritizing the business over job security.”
Should ransomware demands be paid?
On the one hand, it seems quite risky. On the other hand, you want your data back.
Menlo found that 32% of respondents worry about the risk of paying a ransomware demand and not getting their data back. Two-thirds did say they would pay a demand, while 27% say they would never pay a demand.
Ultimately, though, who pays? 31% of respondents would leave it to their insurance company to pay. Almost one in five think the government should pay up.
A big factor here? Preparedness, Guntrip adds.
“Do you have the right processes and strong backup in place? If so, you won’t need to pay it. If, however, your organization is unable to function as normal, access data or the damage is likely to bring down the business, that’s when you need to re-evaluate your options.”
All in all, the report emphasizes that with advancing ransomware technology — including ransomware-as-a-service (RaaS) readily available to low-level criminals — making sure your security infrastructure is able to stop attacks is key.
Access the full report from Menlo, including featured insights, here.
