.png)
Cybersecurity attention often rises after an incident, then recedes as organizations return to their existing priorities and practices, according to a new ManageEngine survey of 700 IT and cybersecurity leaders in the US and Canada.
(Source: ManageEngine)
All of them had already been through a breach or incident. Still, 91% said they trust their organization’s current cybersecurity posture. Only 8% said cybersecurity becomes a permanent priority once the incident is behind them.
“The belief that breaches are inevitable has lowered the bar for security,” said Dr. Erik Huffman, a cyberpsychology researcher who commented on the findings. “We’ve said ‘it’s not a matter of if, but when’ for far too long. But we still have control over the security processes that directly influence the outcome.”
Confidence that outpaces prevention
A third of respondents believe a major incident is inevitable regardless of their defenses, and a similar share accept the risks they consider manageable. Known gaps often stay open until an audit or an actual incident forces the issue. Only a minority said security gets consistent attention throughout the year, outside the aftermath of an incident.
“It is unfortunate that we have accepted the idea that bad things will happen no matter what we do,” he said. “Many organizations buy security tools in pursuit of the outcome of being ‘secure.’ But security cannot simply be bought or sold. It is an ever-evolving process and should be treated as such.”
The urgency fades fast
Right after a breach, organizations do react. Process discussions ramp up, urgency spreads through the team, and technical fixes go in, such as patching, access reviews, and backup improvements. That attention rarely lasts. Eighty percent of respondents said increased focus on cybersecurity holds for only one to six months before it fades.
Close to half of organizations kept their existing structures and strategy in place after the incident, making no wider change at all. A smaller share made targeted fixes aimed at the specific gap that caused the incident, and fewer still made broader, long-term changes to governance, training, or escalation.
Business priorities are often the reason why. A majority of respondents said competing demands regularly cause security initiatives to be postponed or downgraded, and one in five named exactly that as the leading factor behind their most recent incident.
Fear shapes what gets said after the fact
Most employees, according to respondents, report a mistake immediately when it happens. 83% admitted that fear of consequences influences how the incident is handled once it’s reported, and a notable share described their organization’s response as blame-focused.
“Cybersecurity has had a fear-based culture for a long time, and it has created an environment many people want to avoid,” Huffman added. “Incident response should not be about who did what. The focus should be on what happened, why it happened, and who it impacts.”
Part of the problem, according to the survey, is that ownership itself is unclear. Close to one in five respondents said they weren’t sure whether security, IT, or business teams should be responsible for a given failure. That uncertainty carries a cost, including delayed remediation, business disruption, and a higher risk that data ends up exposed before anyone closes the gap.
AI recommendations often go unchecked
AI use is widespread among these organizations, running incident response automation, threat intelligence, penetration testing, and vulnerability scanning. A large majority said it has made decisions easier to reach, and more than half credit it with greater efficiencies or stronger security capabilities. AI has also made a majority of respondents more willing to accept cyber risk.
Among organizations using AI in cybersecurity, about two in three said they often or always act on its recommendations without additional verification.
“AI undoubtedly introduces new risks for organizations,” Huffman noted. “LLMs are frequent targets for attackers because of the level of trust people place in the information they receive from AI systems. We need to move from ‘trust but verify’ to ‘verify, then trust.'”
“Organizations that genuinely learn from incidents aren’t just the ones that respond quickly. They’re the ones that preserve visibility after the crisis, make risk decisions explicit, and turn temporary urgency into lasting discipline,” researchers concluded.
from Help Net Security https://ift.tt/9rMPpRs
0 comments:
Post a Comment