Security operations by the numbers: 30 cybersecurity stats that matter – Security Boulevard

Enterprise IT and security operations (SecOps) leaders are under growing pressure from threat actors pounding away at their infrastructure defenses using a variety of new and proven tactics, techniques and procedures.

Phishing, vulnerability exploits, and credential theft continue to be popular vectors for initial access. But increasingly threat actors have also begun leveraging weaknesses in the software supply chain and — more recently — AI-enabled tools and techniques to break into organizational networks.

The trends have complicated an already complex cyber risk management challenge and heightened breach risks for many organizations. Here’s a curated list of 30 cybersecurity stats from reliable industry sources on some of the most important trends facing cybersecurity front over the past year.

Breaches and attacks

6.06 billion: The total number of malware attacks

The number of malware attacks for 2023 represented a 11% increase in malware attacks over 2022. Attacks involving cryptojacking increased 659% over the same period while those involving encrypted threats shot up 117%.

Source: 2024 SonicWall Cyber Threat Report, SonicWall

$4.45 million: The global average cost of a data breach

Data breach cost continue to tick upwards steadily. Between 2023 and 2023 the average cost of a data breach globally increased 15.3% from $3.86 million to $4.45 million.

Source: Cost of a Data Breach Report 2023, IBM

$1.68 million: Average data breach cost savings among DevSecOps adopters

Among organizations with a high level of DevSecOps adoption alongside robust incident response planning and testing had a higher success rate than others in containing the cost of a data breach.

Source: Cost of a Data Breach Report 2023, IBM

14%: Breaches in which a software vulnerability was used to gain initial access

In 2023, the percentage of incidents investigated that involved vulnerability exploits as an initial access vector tripled compared to the previous year.

Source: 2024 Data Breach Investigations Report, Verizon

68%: Breaches involving social engineering — or user error

The proportion of breaches involving the human element remained largely unchanged over the prior year, highlighting the importance of security awareness training.

Source: 2024 Data Breach Investigations Report, Verizon

37%: Percentage of breaches in 2023 that resulted in data theft

Other common post-compromise activity included financial gain (36%) and extortion (11%).

M-Trends 2024 Special Report, Mandiant

62%: Intrusions where attackers abused of valid accounts

Credential abuse — especially incidents involving the use of privileged domain accounts and default accounts — contributed to a high percentage of security incidents in 2023.

Source: 2023 Threat Hunting Report, CrowdStrike

160%: Increase in secrets and other credential attacks involving cloud metadata APIs

Threat actors are increasingly exploiting weaknesses in cloud environments to probe organizations for privileged credentials.

Source: 2023 Threat Hunting Report, CrowdStrike

266%: The increase in cybercriminal use of information stealers

Threat groups that previously specialized in ransomware have increased turned to  infostealers for many of their campaigns. The most notable among these stealers were Rhadamanthys, LummaC2 and StrelaStealer.

Source: Threat Intelligence Index 2024, IBM X-Force

7.6 trillion: Attempts at unauthorized access via vulnerability exploit

The number of attempts that threat actors made in 2023 to gain unauthorized access to a protected system or service via a vulnerability exploit has increased steadily over the past decade — up 613% from 2013.

Source: 2024 SonicWall Cyber Threat Report, SonicWall

22.3%: Observed attacks that involved Living off the Land binaries (LOLBINs)

Of these 2023 LOLBIN attacks, more than nine-in-10 (92%) included Rundll32, Msiexec, and Mshta.

Source: ReliaQuest Annual Cyber-Threat Report: 2024, ReliaQuest

75.8%: Percentage of nation-state actor attacks involving Living off the Land techniques

Other common attack vectors that nation-state actors leveraged last year included custom malware (63.7%), off-the-shelf tools (62.6%) and software supply chain attacks (54.9%).

Source: 2024 Threat Hunting Survey, SANS Research Program 

Vulnerabilities and threats

67%: Percentage of organizations with one critical vulnerability in their enviornment

Despite growing risks, many organizations lagged behind on vulnerability management last year. More than nine-in-10 organizations had at least one CVE in their environment with known exploits. Another 25% had five or more CVEs.

Source: Threat Intelligence Index 2024, IBM X-Force

260,773: The number of vulnerabilities, exploits, and zero-days from 1988-2023

Cumulative software vulnerabilities continued to present a major breach risk for organizations last year, as they have for more than three decades.

Source: Threat Intelligence Index 2024, IBM X-Force

84,245: The number of total vulnerabilities and zero-days with known exploits since 1988

While the cumulative number of flaws with known exploits is holding steady, only 7,506 of the vulnerabilities (7%) were zero-day threats.

Source: Threat Intelligence Index 2024, IBM X-Force

32%: Percentage of organizations able to evaluate AI-generated code for security risk, etc.

Despite burgeoning use of AI tools such as OpenAI Codex, ChatGPT and GitHub Copilot in software development, less than one-third of organizations have the ability to detect potential security issues, licensing and other quality issues in the code.

The State of Supply Chain Security Risks, Synopsys

74%: CISOs and security leaders who described AI-powered cyberthreats as significant

While Gen AI technologies such as ChatGPT and GitHub CoPilot are transforming enterprise IT infrastructures, a recent survey found they are also giving threat actors a handy way to refine their attacks.

Source: State of AI Cybersecurity 2024, Darktrace

60%: Security leaders who say their organizations are not prepared for AI-enabled threats

Nearly all IT and security leaders (96%) believe AI-driven security products will better prepare them for next generation AI-powered cyberattacks.

Source: State of AI Cybersecurity 2024, Darktrace

Software supply chain security

54%: The percentage of organizations that experienced a software supply chain attack

Fifty percent of the victim organizations took more than one month to respond to these attacks in 2023, while about 20% said their mechanisms for detecting and responding to supply chain attacks were ineffective. 

Source: The State of Supply Chain Security Risks, Synopsys

15%: Percentage of software supply chain breaches involving a third-party

Incidents where an intrusion resulted from a software vulnerability or compromise at a third-party (data custodian or infrastructure provider) surged 68% last year, fueled largely by zero-day exploits.

Source: 2024 Data Breach Investigations Report, Verizon

28%: The increase in malicious packages on the npm and PyPI repositories 

Attackers increasingly tried to breach enterprise software development environments last year by planting weaponized packages and libraries on two of the most widely used public code repositories.

Source: The State of Software Supply Chain Security 2024, ReversingLabs

11,000: The number of malicious packages uploaded to npm, PyPI and RubyGems

In many cases, threat actors uploaded malicious package that were obfuscated or encrypted making them hard to detect by conventional tools in 2023.

Source: The State of Software Supply Chain Security 2024, ReversingLabs

$45 billion: The global cost of software supply chain attacks

While the number in 2023 is staggering, by 2031 the financial costs to organizations globally from supply chain attacks will soar to $138 billion.

Source: 2023 Software Supply Chain Attack Report, Snyk

Ransomware

36%: The decrease in ransomware attacks globally year over year

Researchers recorded 317.6 million ransomware attacks last year, which represented a substantial year-over-year decline compared to 2022. All regions, including North America and Europe, witnessed a fall in ransomware volumes in 2023. The only exception was Asia, which experienced a sharp increase.

Source: 2024 SonicWall Cyber Threat Report, SonicWall

59%: The percentage of security leaders who say they have experienced a ransomware attack 

Respondents in a survey of 5,000 IT and security pros noted the volume of reported ransomware attacks last year was lower than in the previous two years. In both 2023 and 2022, 66% of organizations experienced at least one ransomware attack.

Source: The State of Ransomware 2024: Sophos

49%: Ransomware attacks on average impacted 49% of a victim organization’s computers

Contrary to perception, ransomware attacks rarely result in all computers at an organization getting encrypted. In fact, only 4% of ransomware victims last year reported their full environment as being encrypted.

Source: The State of Ransomware 2024: Sophos

Incident response

10: The global median dwell time in days after an initial compromise

Enterprise organizations are getting better at detecting intruders in their environment. In 2022, the median dwell time (the duration for which an attacker remained undetected on a network) was 16 days. Ten years ago, that number was 205 days.

Source: M-Trends 2024 Special Report, Mandiant

54%: Organizations that learned about breaches, ransomware etc. from an external source 

Most organizations still first learn about a security incident in their environment only from a security vendor, law enforcement agency, industry partner, customer or other external entity, such as a ransomware actor.

Source: M-Trends 2024 Special Report, Mandiant

58 minutes: The average MTTR to security incident for organizations using AI and automation

In contrast, organizations that utilized traditional incident detection and response mechanisms had an average MTTR (Mean Time to Respond) of 2.3 days

Source: ReliaQuest Annual Cyber-Threat Report: 2024, ReliaQuest

50.8%: Organizations that have implemented threat-hunting in their environment

Another 35% have implemented ad hoc methods to hunt down threats and 13% plan to implement a threat hunting capability soon.

Source: 2024 Threat Hunting Survey, SANS Research Program

*** This is a Security Bloggers Network syndicated blog from ReversingLabs Blog authored by Jai Vijayan. Read the original post at: https://www.reversinglabs.com/blog/secops-by-the-numbers-stats-that-matter