Most Asia Pacific Organisations Feel Unprepared as Cyber Incidents Mount, Cloudflare Survey Finds
A Cloudflare survey of more than 4,000 security leaders in 14 Asia Pacific markets finds 78% hit by incidents and only 38% highly prepared.
Cloudflare has released research on how ready organisations across Asia Pacific are for cyber attacks, and its central finding is uncomfortable: most do not consider themselves prepared, even as the number of incidents they deal with keeps climbing. The report, titled "Securing the Future: Asia Pacific Cybersecurity Readiness Survey", looks at how companies in the region are handling a growing volume of incidents, how ready they believe they are, and what those incidents have cost them.
Four in five were hit, and many more than once
The company polled upwards of 4,000 cybersecurity decision makers and leaders in 14 markets: Australia and New Zealand; China, Hong Kong SAR, Taiwan, Japan and South Korea; India; and in South-East Asia, Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam.
Over the year before the survey, 78% of respondents had suffered one or more cybersecurity incidents. Within that group, 80% counted at least four incidents, and half had dealt with ten or more. Looking ahead a year, 72% expected the number to go up.
Low readiness, high costs
Only 38% of organisations rated themselves as highly prepared. Respondents in four sectors were the most likely to say they could not withstand an incident: healthcare (16%), education (13%), government (10%) and tourism (10%).
The money involved is substantial. Around 63% said incidents had cost their organisation US$1M or more during the previous year, and 14% put the loss above US$3M. Regulators are a further worry. A third of respondents (33%) said their organisation had reported a breach to the authorities, 26% had paid a fine and the same share had faced legal action.
Staffing remains a constraint across the region. Asked what stands in the way of better preparedness, 60% pointed to a shortage of talent.
The attacks respondents had seen during the year included web attacks, phishing, distributed denial-of-service (DDoS), insider threats and stolen credentials. Asked what attackers were mainly after, they put planting spyware first, ahead of financial gain, data exfiltration and ransomware. Their three biggest challenges were securing a hybrid workforce (51%), defending against cyber attacks (48%) and deploying Zero Trust (42%).
More security products, worse results
Most respondents run somewhere between six and 15 products in their security architecture. Larger organisations run close to double that, at 20 or more. The survey suggests this sprawl has hurt effectiveness to a degree, which points towards simplification.
Among organisations using fewer than 15 solutions, 39% had experienced ten or more incidents. For those with over 15 solutions, the figure was 73%. Response times followed the same pattern: 80% of the smaller-stack group resolved incidents within 12 hours, against 65% of those with more than 15 tools.
Budgets are set to grow
Over the previous year, 53% of respondents devoted between 11% and 20% of their organisation's total IT budget to cybersecurity, and a further 28% spent over 20%. Healthcare, transportation and finance were the biggest spenders, while education, gaming, government and manufacturing spent the least. Two thirds (67%) expect their security budget to rise over the coming year, and 22% expect to keep spending at its present level.
Jonathon Dixon, Cloudflare's vice-president and managing director for Asia Pacific, Japan and China, said that while being prepared matters, organisations are wrestling with a threat environment that is more volatile and complex than at any time before. In his view, spending more or buying more products will not by itself produce the best result. He argued for a strong security culture in which business leaders treat cybersecurity as a strategic imperative for the whole organisation, including consolidating technology and costs. That, he said, delivers a "double benefit": lower spending alongside security infrastructure that is more robust and simpler to manage.
Cloudflare counts Envato, JCB and Melbourne Airport among its customers in the region. Ross Simpson, senior principal security engineer at Envato, described his company as cloud native with staff spread around the world who need to reach key company resources from any location. He said Cloudflare suited that model well, calling it a secure and effective approach that is simpler than traditional access controls.