One in Three IT Organizations Have No Cyberattack Incident Response Plan

Despite increases in ransomware attacks, ransom amounts and how often payments are made, new data shows organizations aren’t responding in kind and putting response plans in place.

As expected, we’re continuing to see data corroboration around the rise in ransomware attacks this year; according to GetApp’s 2021 Data Security Report, ransomware attacks have increased 25% over last year. And yet, the report found that 33% of organizations have no incident response plan, as well as 23% have no processes in place to report a cyberattack.

While I’m glad to see that a majority of organizations believe themselves to be somewhat ready, the GetApp data digs a bit deeper to help determine why the increases in ransomware attacks are occurring. According to the report:

  • The percentage of users clicking links in phishing emails has risen nearly 14% over last year while the percentage of orgs experiencing phishing attacks remained relatively flat.
  • 60% of users admit to reusing the same password for multiple accounts.
  • Those admitting to reusing password were 7x more likely to experience a ransomware attack, 3x more likely to experience account takeover, and 3.1x more likely to click on a phishing link.

In short, it’s your users that are the problem. These users a) don’t know how to spot a phishing email, b) aren’t concerned about their role in the organization’s cybersecurity stance, or c) both. The only way to truly counteract this issue of user ignorance and apathy is to enroll them in online Security Awareness Training. This training reinforces the need for users to always be vigilant and to use good cyber hygiene practices.

With ransomware not looking like it’s going anywhere but up for the foreseeable future, it’s necessary to shore up the human aspect of your layered defenses; and Security Awareness Training is the means to do that.

The blog originally appeared on the KnowBe4 website.

Stu Sjouwerman
About the Author
Stu Sjouwerman (pronounced “shower-man”) is the founder and CEO of KnowBe4 Inc, a provider of the most popular Security Awareness Training and Simulated Phishing platform. A serial entrepreneur and data security expert with more than 30 years in the IT industry, Sjouwerman is the author of four books, with his latest being “Cyberheist: The Biggest Financial Threat Facing American Businesses.” Along with his CEO duties, Stu is Editor-in-Chief of Cyberheist News, an e-zine tailored to deliver IT security news, technical updates, and social engineering alerts. Stu is a four-time Inc 500 award winner and EY Entrepreneur of the Year finalist.