One in every 12 (83%) of organisations in the Asia-Pacific region were breached by ransomware at least once in the past five years, but only 32% publicly disclosed that an incident occurred, according to the ExtraHop 2022 Cyber Confidence Index-Asia Pacific.
Sponsored by ExtraHop, The survey of 300 security and IT decision makers — 100 each — in Australia, Japan, and Singapore, was conducted by StollzNow Research in January 2022.
Growing cybersecurity budgets don’t necessarily buy improved degrees of protection and confidence, with only 39% of IT decision makers (ITDMs) in APAC expressing a high degree of confidence in their organisation’s ability to prevent or mitigate cybersecurity threats, and an equal percentage having low confidence.
ITDMs in Singapore are the most confident in their ability to handle cyber threats (52% overall), with 88% confident in their ability to prevent attackers from breaking into internal networks, and 31% confident in being able to always identify and block ransomware.
Their confidence may be a by-product of regulatory enforcement: 86% say the threat of legal action and fines promotes action by senior management in security decisions, far higher than in other jurisdictions. As a result, 74% have an NDR solution in place already, which is 25% more than in Australia and 19% more than in Japan.
In APAC, 45% of organisations have paid a ransom, despite a majority believing that paying increases the number of attacks.
Only 17% of respondents said they experienced no ransomware incidents in the past five years; 46% had experienced one to five attacks, while 35% had experienced six or more.
But 20% of organisations wouldn’t tell anyone if they were breached anyway, suggesting the proportion of organisations hit by ransomware is probably a lot higher.
Only 32% of organisations are public and transparent about ransomware attacks; 48% let some people know but keep it as private as possible, and 20% tell no one.
This is largely against the wishes of IT security personnel, of whom 66% feel it would be better to be transparent and public about ransomware attacks.
The “stick” of legal action and fines promotes action by senior management in security-related decisions, with a total of 73% agreeing with this statement.
However, there are significant regional variations with 86% of Singapore-based organisations worried, compared to 68% in Japan and 64% in Australia.
Just under two-thirds (61%) of organisations expect cybersecurity budgets to increase in 2022. This is higher in Singapore (70%) and Australia (66%) but lower in Japan where 48% anticipate budget increases and 49% expect to see stable budgets year-on-year.
The report identifies several courses of action that APAC organisations intend to take in 2022.
These include network detection and response (NDR), social engineering strategy, improved threat training and identification, and onboarding more resources.
