A paltry 19% of organisations in South Africa have the ‘Mature’ level of readiness needed to be resilient against today’s modern cybersecurity risks.
This is according to Cisco’s first Cybersecurity Readiness Index, developed against the backdrop of a post-Covid, hybrid world, where users and data must be secured wherever work gets done. The report highlights where businesses are doing well and where cybersecurity readiness gaps will widen if global business and security leaders don’t take action.
Organisations have moved from an operating model that was largely static – where people operated from single devices from one location, connecting to a static network – to a hybrid world in which they increasingly operate from multiple devices in multiple locations, connect to multiple networks, access applications in the cloud and on the go, and generate enormous amount of data.
This presents new and unique cybersecurity challenges for companies.
Alongside the stark finding that only 19% of companies in South Africa are at the Mature stage, 52% of companies fall into the Beginner (8%) or Formative (44%) stages. While organisations in South Africa are faring better than the global average (15% of companies in the Mature stage), the number is still very low, given the risks.
This readiness gap is telling, not least because 65% of respondents said they expect a cybersecurity incident to disrupt their business in the next 12 to 24 months. The cost of being unprepared can be substantial, as 57% of respondents said they had a cybersecurity incident in the last 12 months and 17% of those affected said it cost them at least $500 000.
“The move to a hybrid world has fundamentally changed the landscape for companies and created even greater cybersecurity complexity. Organisations must stop approaching defense with a mix of point tools and instead, consider integrated platforms to achieve security resilience while reducing complexity,” says Jeetu Patel, executive vice-president and GM: security and collaboration at Cisco. “Only then will businesses be able to close the cybersecurity readiness gap.”
Business leaders must establish a baseline of ‘readiness’ across the five security pillars to build secure and resilient organisations. This need is especially critical given that 78% of the respondents plan to increase their security budgets by at least 10% over the next 12 months. By establishing a base, organisations can build on their strengths and prioritise the areas where they need more maturity and improve their resilience.
“With highly distributed teams and devices leading to a rapidly expanding attack surface, achieving security resilience must remain a top priority. Cisco’s Cybersecurity Readiness Index provides a clear picture of what businesses have been doing to protect their operations across South Africa and, more importantly, what steps still need to be taken to deliver secure, seamless online environments,” says Conrad Steyn, chief technology officer and head of engineering at Cisco Sub-Saharan Africa.
The Index found readiness across the five key pillars as follows:
* Identity: Progress is needed here as 62% of organisations are in the Beginner or Formative stages.
* Devices: This has the highest percentage of companies in the Mature stage at 44%.
* Network Security: Companies are lagging on this front with 53% of organisations in the Beginner or Formative stages.
* Application Workloads: This is the pillar where companies are the least prepared, with 59% of organisations in the Beginner or Formative stages.
* Data: This has the second-highest number of companies in the Mature stage (27%).
Titled, Cisco Cybersecurity Readiness Index: Resilience in a Hybrid World, the report measures the readiness of companies to maintain cybersecurity resilience against modern threats. These measures cover five core pillars that form the baseline of required defences: identity, devices, network, application workloads, and data, and encompasses 19 different solutions within the pillars.
Conducted by an independent third-party, the double-blind survey asked 6 700 private sector cybersecurity leaders across 27 markets to indicate which of these solutions they had deployed and the stage of deployment. Companies were then classified into four stages of increasing readiness: Beginner, Formative, Progressive and Mature.