Company bosses are boosting their cybersecurity following an alarming increase in cyberattacks, a new study commissioned by Kaspersky has found. The data shows that more than three quarters (77%) of companies in Asia Pacific (APAC) suffered at least one cyber incident in the last two years.
One of the main reasons cited was the shortage of qualified IT security staff (24%). Among other measures to strengthen cybersecurity, 57% of respondents from the region claimed that their companies plan to invest in outsourcing cybersecurity in the next 12 to 18 months.
Kaspersky conducted a study[1] to learn the opinions of IT Security professionals working for SMEs and corporations worldwide regarding the impact people have on cybersecurity in a company. The survey gathered information about various groups of people who influence cybersecurity, looking at both internal staff, and external actors. It also analyzed levels and types of online safety company bosses believed warranted investment. A total of 234 respondents from APAC were surveyed.
In the study, more than three quarters (77%) of respondents reported that their company had experienced cybersecurity incidents within the last two years, with 87% of these judged as ‘serious’. Some said the main reasons for cyber incidents occurring in their company were a lack of necessary tools for threat detection (20%) and a shortage of internal IT security staff (24%).
“Businesses in APAC have been battling shortage in local cybersecurity professionals for years now. In fact, in 2022, it’s reported that the region needs 2.1 million more security staff to meet the demand. Clearly, the result of our recent study put a definite number on how this gap can take a toll on enterprise security. For our part, we’ve been proactively fostering mutual partnerships with universities, governments, and non-government organisations here with the shared goal of building a country’s cybersecurity capability as well as to help develop the local cybersecurity talent pool in APAC,” comments Adrian Hia, Managing Director for Asia Pacific at Kaspersky.
The respondents from the region indicated that a variety of measures would be appropriate to address cybersecurity gaps, and among them, 32% said they would like to see more external specialists brought in.
It also appears company investment plans are well in line with their expectations. One quarter of organizations (34%) plan to invest in third-party professional services, and as many as 34% of respondents are aiming to outsource their cybersecurity to MSP/MSSP (Managed Service Providers/Managed Security Service Provider). The most likely industries to invest in third-party services in the near future are critical infrastructure, energy and oil & gas companies.
At the same time, many organizations from the region plan to invest in automation of their cybersecurity processes. In the next 12 months, more than half of businesses here (51%) have concrete plans to implement software that automatically manages their cybersecurity, while 15% are discussing the subject.
“The automation and outsourcing of cybersecurity tasks are major areas that organizations struggling because of a lack of experts and alert fatigue can focus on. Turning to external experts, — whether it’s outsourcing, to manage the whole cybersecurity system, or adopting expert-level services to assist the IT Security department — is the optimal solution for many. Cybersecurity vendors, Managed Service Providers, Managed Security Service Providers are the companies that have relevant expertise, all the necessary tools, and can manage cybersecurity effectively for customers of any size. Additionally, they can provide the customer with various options, such as Managed Detection and Response services, where SOC experts continuously carry out monitoring, or assistance in case of emergency like investigating a particular incident. Automation tools provided by cybersecurity vendors is another way an organization can strengthen its cybersecurity. For example, our XDR and MDR has out-of-the-box automation through investigation and response playbooks and embedded AI, enabling clients and partners to significantly automate their information security processes. With all possible options provided by experts, each company can determine the scope of services that are needed, based on cybersecurity gaps or desired development trajectory,” comments Ivan Vassunov, VP, Corporate Products at Kaspersky.
To cope with a shortage of tools or IT Security employees in-house, Kaspersky recommends:
The full report and more insights on the human impact on cybersecurity in business are available via the link.
