Survey Shows Growing Crisis of Trust with Microsoft and Legacy IT Vendors

A new survey commissioned by cyber security firm CrowdStrike uncovered disturbing trends when it comes to ransomware breaches, supply chain attacks, and incident detection times.

The survey conducted by independent research firm Vanson Bourne that polled 2,200 senior IT decision makers and IT security professionals, highlights ransomware payout demands and extortion fees are massively increasing, while trust in legacy IT vendors has dipped and organizations are in fact getting slower at detecting cyber security incidents.

“The survey presents an alarming picture of the modern threat landscape, demonstrating that adversaries continue to exploit organizations around the world and circumvent outdated technologies. Today’s threat environment is costing businesses around the world millions of dollars and causing additional fallout,” said Michael Sentonas, chief technology officer at CrowdStrike. “The evolving remote workplace is surely accentuating challenges for businesses as legacy software like Microsoft struggles to keep up in today’s accelerated digital world.”

Customers are facing a crisis of trust in legacy vendors as software supply chain attacks continue to present challenges, said the survey. 

Recent attacks such as Sunburst and Kaseya have once again brought supply chain attacks to the forefront as evidenced by 63% of respondents admitting their organization is losing trust in legacy vendors, like Microsoft, due to frequent security incidents against these previously trusted technology suppliers.

The issue is so widespread that more than 3 out of every 4 respondents (77%) have suffered a supply chain attack. It’s clear that swift action and newer technologies will be required by businesses looking to increase their cyber resiliency. For example, 45%of respondents had experienced at least one supply chain attack in the past 12 months and 84% of respondents are fearful of supply chain attacks becoming one of the biggest cyber security threats in the next three years.

The survey further brings to light that ransomware remains a persistent and highly pervasive threat, costing organizations nearly $2 million on average.

Survey data indicates that ransomware attacks are continuing to prove effective, with average ransomware payments increasing 62.7% in 2021 (from $1.1 million in 2020 to $1.79 million in 2021). Not only that, organizations are almost universally getting hit with “double extortion,” when threat actors not only demand a ransom to decrypt data, they additionally threaten to leak or sell the data unless the victims pays more money. It shows that 96% of organizations that paid a ransom were forced to pay additional extortion fees, costing businesses on average $792,493.

Organizations are moving in the wrong direction when it comes to detection and response time, says CrowdStrike researchers that encourages organizations to strive to meet the 1-10-60 rule, where security teams demonstrate the ability to detect threats within the first minute of an intrusion, investigate and understand the threat within 10 minutes, and contain and eradicate the threat within 60 minutes.

In today’s remote-first digital world, organizations continue to face massive challenges in detecting security incidents, as evidenced by eye-opening survey data. On average, respondents estimated it would take 146 hours to detect a cybersecurity incident, from 117 hours in 2020. Once detected, it takes organizations 11 hours to triage, investigate and understand a security incident and 16 hours to contain and remediate one. Nearly 7 out of 10 respondents said that their organization suffered an incident because of staff working remotely

In the 2021 Threat Hunting Report, CrowdStrike’s Falcon OverWatch reported that eCrime threat actors are able to move laterally across an organization’s network in an average of 92 minutes. This paints a sharp contrast between the capabilities of today’s swift attackers and defenders who are increasingly slowed down by high volumes of alerts and tools that lack integrated workflows.

“This presents a clear clarion call that businesses need to change the way they operate and evaluate more stringently the suppliers they work with,” adds Sentonas.

“The threat landscape continues to evolve at a frightening pace and it’s obvious that modern organizations need a cloud-native, holistic end-to-end platform approach to tackle and remediate threats in a swift manner,” concludes Sentonas.