Columbia-based cybersecurity company Tenable has published a study revealing that Indian organisations could not prevent 42 per cent of cyberattacks on their businesses, only successfully thwarting 58 per cent of cyberattacks over the past two years. Consequently, organisations have had to rely on reactive measures rather than preventing attacks from occurring in the first place.
The study further revealed that 78 per cent of Indian respondents believe their organisations could better defend against cyberattacks with more resources dedicated to preventive cybersecurity. However, a concerning 64 per cent indicated that their cybersecurity teams spend the majority of their time addressing critical incidents, hampering their capacity to take a proactive stance.
The data is drawn from, “Old Habits Die Hard: How People, Process and Technology Challenges Are Hurting Cybersecurity Teams in India,” a commissioned study of 825 IT and cybersecurity professionals including 69 Indian respondents, conducted in 2023 by Forrester Consulting on behalf of Tenable.
The study, which emphasises the significance of adopting a proactive cybersecurity approach, found that a core reason for the prevalent reactivity in Indian organisations’ cybersecurity practices is the lack of alignment in goals between IT and security teams. Seven in 10 (71 per cent) organisations say their IT teams are more concerned with uptime than patching and remediation. The disparity results in a lack of coordination between the two teams, a challenge acknowledged by 43 per cent of Indian organisations.
“In today’s threat landscape, by the time organisations react to cyberattacks, the battle is half lost. Organisations in India simply cannot afford to remain in reactive mode. The study we conducted sheds light on the inherent issues within Indian organisations’ own structure and operations. This misalignment in goals between IT and security teams results in a palpable lack of synchronisation, making it challenging for these vital components of an organisation to work cohesively towards a shared goal,” said Kartik Shahani, Country Manager, Tenable India.
This goal misalignment is further exacerbated as organisations race to adopt new and emerging Software-as-a-Service (SaaS) applications from third-party providers. Eight in 10 respondents (81 per cent) of their organisations use a third-party programme for SaaS apps and services. However, only over half (54 per cent) have visibility into these third-party environments making proactive security measures elusive.
Shahani further noted, “While there are no quick fixes to these challenges, implementing an exposure management programme enables security professionals to better allocate time and resources so they can focus on taking the preventive actions that legitimately reduce an organisation’s cyber risk. It requires security teams to place as much importance on proactive efforts as they currently do on reactive incident response efforts. It requires security and IT professionals to consider how siloed organisational structures — and the myriad security tools used in support of those silos — are hindering their ability to see what an attacker sees. And, it requires a way for security professionals to analyse the data coming from disparate tools to empower them to draw meaningful insights they can apply to their risk-reduction goals.”