Increasing cybersecurity concerns pose risk to UK security leaders, study shows

By Puja Sharma

Proofpoint, Inc., a cybersecurity and compliance company, released its annual Voice of the CISO (chief information security officer) report, which explores key challenges, expectations, and priorities of chief information security officers (CISOs). The findings reveal that most CISOs have returned to the elevated concerns they experienced early in the pandemic.

Globally, 6% of surveyed CISOs feel at risk of a material cyber attack, compared to 48% the year before, when they may have felt a brief sense of calm after successfully navigating the chaos of the pandemic. This year’s data represents a shift back to 2021 when nearly two-thirds of CISOs believed a material attack was imminent. Notably, UK CISOs feel most at risk globally (84%) in 2023, compared to 60% last year and 81% in 2021.

While organisations have largely overcome the disruptions of the last two years, the effects of the Great Resignation and employee turnover continue to linger, exacerbated by the recent wave of mass layoffs—It’s interesting to see that 73% of CISOs believe they have adequate data protection in place yet 74% of UK security leaders had to deal with the loss of sensitive information in the past 12 months. There is a trend to these data loss events also, as 84% of UK CISOs say that employees leaving the organisation played a role in a data spill.

The 2023 Voice of the CISO report examines global third-party survey responses from more than 1,600 CISOs at mid-to-large size organisations across different industries. Throughout Q1 2023, 100 CISOs were interviewed in each market across 16 countries: the U.S., Canada, the UK, France, Germany, Italy, Spain, Sweden, the Netherlands, UAE, KSA, Australia, Japan, Singapore, South Korea, and Brazil.

“In protecting their people and data, a task made increasingly difficult as insiders prove themselves as a significant contributor to sensitive data loss,” said Ryan Kalember, executive vice president of cybersecurity strategy for Proofpoint. “If recent devastating attacks are any indication, CISOs have an even tougher road ahead, especially given the precarious security budgets and new job pressures. Now that they have returned to elevated levels of concern, CISOs must ensure they focus on the right priorities to move their organisations toward cyber resilience.”

Key Findings:

• UK CISOs have returned to the elevated concerns they experienced early in the pandemic and feel more unprepared than last year: 84% of UK CISOs feel at risk of experiencing a material cyber attack in the next 12 months, compared to 60% last year and 81% in 2021. Further, 76% believe their organisation is unprepared to cope with a targeted cyber attack, compared to 65% last year and 68% in 2021.
• The loss of sensitive data is exacerbated by employee turnover: 74% of UK security leaders reported having to deal with a material loss of sensitive data in the past 12 months, and of those, 84% agreed that employees leaving the organisation contributed to the loss. Despite those losses, 73% of UK CISOs believe they have adequate controls to protect their data.
• Email fraud tops the list of the most significant threats: the top threats perceived by UK CISOs have shifted, with email fraud (business email compromise) now leading the way, followed by cloud account compromise, insider threats, and smishing/vishing. Last year, DDoS attacks were the top concern, followed by malware and email fraud.
• Most organisations are likely to pay a ransom if impacted by ransomware: 75% of UK CISOs believe their organisation would pay to restore systems and prevent data release if attacked by ransomware in the next 12 months. And they are relying on insurance to shift the risk—79% said they would place a cyber insurance claim to recover losses incurred in various types of attacks.

• Supply chain risk is a recurring priority: Around 79% of UK CISOs say they have adequate controls in place to mitigate supply chain risk, a slight increase from last year’s 73%. While these protections may feel adequate for now, going forward, CISOs may feel more strapped for resources—73% say the shaky economy has negatively impacted their cybersecurity budget.