ExtraHop, a leader in cloud-native network detection and response (NDR), today released its third annual Global Cyber Confidence Index, which found Australian organisations are generally ill-equipped to manage and mitigate their cyber risk following a significant increase in ransomware attacks and cybersecurity incident downtime.

Although an overwhelming majority (91%) of IT and cybersecurity decision makers said they are confident in their organisations’ ability to manage cyber risk, most acknowledged that they are frequently the victim of ongoing threats, and falling behind when it comes to identifying and remediating threats.

Amid a recent onslaught of attacks against the world’s most profitable industries and critical infrastructures, and industry regulatory bodies tightening compliance rules, understanding an organisation’s ability to effectively manage cyber risk is more critical than ever before.

Key insights from the report include:

Cyberattackers are raking in ransomware payments

15% of Australian respondents deemed ransomware the biggest risk to their organisation - an unsurprising finding as about half say they are still running at least one insecure network protocol that threat actors are known to exploit in ransomware attacks. Highlighting this concern, 82% said they experienced six or more ransomware incidents in 2023.

Of those surveyed, more than three in four (77%) that experienced a ransomware attack paid up in 2023, compared to 82% in 2023 and 72% in 2022. On average, the research found ransomware payments alone cost nearly $1.3 million per organisation in the last year - before adding in the unrealized costs associated with remediation.

Downtime is draining organisations of their time and money

When discussing the impact cybersecurity pitfalls have on their businesses, Australian respondents said they averaged 62 hours of downtime following a security incident last year. Organisations with 1,000-1,999 employees experienced the most downtime at nearly 74 hours on average per incident. Globally, France led downtime at 68 hours, followed by the United States (63 hours) and Australia (62 hours).

Organisations are putting their faith in AI

Australian organisations are overwhelmed by a multitude of barriers holding them back from effectively managing cyber risk, citing immature risk management processes (24%), a lack of alignment between the cybersecurity organisation and the business (18%), insufficient personnel resources (18%), the inability to catch up in a fast-paced industry (17%), outdated technology (14%), and insufficient budget (9%).

In response to this widespread set of unique challenges, more than a third (37%) of respondents agree using AI and machine learning to help manage and mitigate cyber risk is a top priority for their organisation this year.

Organisations are investing in business resilience

Nearly half (48%) of Australian respondents say they need more than a 50% budget increase to effectively manage and mitigate cyber risk.

Security technology adoption is growing, though only around a third of respondents currently have deployed or plan to deploy any individual solution. The most popular solution was extended detection and response (XDR), which brings together the capabilities of best of breed endpoint detection and response (EDR), network detection and response (NDR), SIEM, and SOAR solutions. Zero trust network access and identity and access management, which placed third, also rely on NDR to reach their full security potential, making NDR an essential investment for organisations planning to implement a range of solutions.

“Cyber risks are inevitable and no single organisation is immune to the threat bad actors pose to their business,” said Raja Mukerji, co-founder and Chief Scientist, ExtraHop. “With ransomware and downtime on the rise and ripple effects being felt throughout entire organisations, leaders are recognising an inherent need to prioritise cybersecurity, and, better yet, business resilience. With greater visibility into and awareness of the current threat landscape, they can better identify their weaknesses, shore up their defences, and develop an action plan that keeps disruption to employees, customers, and other stakeholders to a minimum.”

Download the 2024 Global Cyber Confidence Index.

*This survey was conducted by Censuswide.*