More than one-third of global organizations still lack confidence in their ability to detect sophisticated cyber attacks, EY survey finds

- 88% of companies don't believe their information security fully meets their organization's needs

- 69% say they should spend more money on cybersecurity to protect data

- Criminal syndicates, hacktivists and state-sponsored groups cited as most likely sources of cyber attacks

News provided by

Nov 10, 2015, 02:30 ET

LONDON, Nov. 10, 2015 /PRNewswire/ -- More than one-third (36%) of global organizations still lack confidence in their ability to detect sophisticated cyber attacks, according to the annual EY's Global Information Security Survey 2015, Creating trust in the digital world.

The survey of 1,755 organizations from 67 countries examines some of the most important cybersecurity issues facing businesses today and finds that 88% do not believe their information security structure fully meets their organization's needs. When it comes to IT security budgets, 69% say that their budgets should be increased by up to 50% to align their organization's need for protection with its managements' tolerance for risk.

The most likely sources of cyber attacks: criminal syndicates (59%), hacktivists (54%) and state-sponsored groups (35%) retained their top rankings. However, compared with last year's survey, respondents rated these sources as more likely: up from 53%, 46%, and 27%, respectively, in 2014.

Ken Allan, Global Cybersecurity Leader, EY, says:

"Organizations are embracing the digital world with enthusiasm, but there must be a corresponding uptick in addressing the increasingly sophisticated cyber threats. Businesses should not overlook or underestimate the potential risks of cyber breaches. Instead, they should develop a laser-like focus on cybersecurity and make the required investments. The only way to make the digital world fully operational and sustainable is to enable organizations to protect themselves and their clients and to create trust in their brand."

Vulnerabilities and threats: a shift in perceptions

The survey found that companies currently feel less vulnerable to attacks arising from unaware employees (44%) and outdated systems (34%); down from 57% and 52%, respectively, in the 2014 Global Information Security Survey (GISS). However, they feel more threatened today by phishing and malware. Forty-four percent of respondents (compared with 39% in 2014) ranked phishing as their top threat; 43% consider malware as their biggest threat versus 34% in 2014.

The survey also finds that organizations are falling short in thwarting a cyber attack:

54% say they lack a dedicated function that focuses on emerging technology and its impact
47% do not have a security operations center
36% do not have a threat intelligence program, while 18% do not have an identity and access management program

More than half (57%) said that the contribution and value that the information security function provides to their organization is compromised by the lack of skilled talent available, compared with 53% of respondents in the 2014 survey, indicating that the situation is deteriorating, rather than improving.

Paul van Kessel, Global Risk Leader, EY, says:

"Cybersecurity is inherently a defensive capability, but organizations should not wait to become victims. Instead, they should take an 'active defense' stance, with advanced security operations centers that identify potential attackers and analyze, assess and neutralize threats before damage can occur. It is imperative that organizations consider cybersecurity as an enabler to build and keep customers' trust."

Some examples of the industries surveyed:

EY's Global Information Security Survey 2015 – Sector highlights
Industries	Likely sources of cyber attacks	Top priorities for information security	Companies not changing security budget over next 12 months
Consumer products	Employees: 61% Criminal syndicates: 52% External contractors: 43%	Business continuity/disaster recovery resilience: 59% Data leakage/data loss prevention: 50% Incident response capabilities: 40%	38%
Banking and capital markets	Cyber attacks to steal financial information: 21% Malware: 20% Fraud: 19%	Data leakage/data loss prevention: 67% Business continuity/disaster recovery: 56% Identify and access management: 56%	33%
Power and utilities	Outdated security information, careless or unaware employees, malware: 20% each	Business continuity/disaster protection: 52% Data leakage/data loss prevention: 44% Security operations, such as anti-virus, patching, encryption: 43%	33%

Notes to editors

About EY

EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.

This news release has been issued by EYGM Limited, a member of the global EY organization that also does not provide any services to clients.

About the survey

EY's Global Information Security Survey was conducted between June 2015 and September 2015. Participants included 1,755 organizations from 67 countries and across all major industries. For our survey, CIOs, CISOs, CFOs, CEOs and other information security executives took part in the annual survey.