As we approach the end of another year, one thing is for certain; the cybersecurity landscape has evolved yet again. Looking back on 2024, businesses have faced a rapidly shifting threat environment – one where we’ve seen the rise of advanced technologies, increasingly complex supply chains, and the widespread adoption of cloud infrastructure. All of which has contributed to an expanded attack surface, exposing organizations to more frequent and severe cyber threats than ever before.
Our recently published Cyber Roundup Report 2024 offers an in-depth analysis of these threats, which draws on data from over 46 million small and medium-sized enterprises (SMEs) across the U.S., U.K., and Japan.
Let’s start by delving into some of the most pressing cybersecurity trends the data uncovered before we look at what proactive steps businesses should be taking in light of these trends:
- Supply Chain Attacks Up 431%
Between 2021 and 2023, we found that supply chain attacks surged by a staggering 431%, with further growth projected by 2025. These attacks are effective because they exploit the trust between interconnected organizations and their vendors or suppliers, and can potentially compromise multiple entities simultaneously through one weak link. The dramatic rise can be attributed to a number of factors, including:
- Increased digitization and interconnectivity of business operations.
- Growing complexity of supply chains, making them harder to secure.
- The potential for high-value targets through a single point of entry.
- The challenge of maintaining visibility and control over third-party security practices.
- Manufacturing faces escalating cyber risks
In terms of identifying the most vulnerable sectors, we found manufacturing came top, with cyber risk scores 11.7% below the global average. Cyber incidents in this sector are not only 1.6 times more frequent but also 1.2 times more severe compared to other industries. These statistics can be attributed to:
- A heavy reliance on automation and interconnected devices.
- Legacy systems and bespoke software that may lack modern security features.
- High sensitivity of data, including intellectual property and design plans.
- Increasing digitization of manufacturing processes without corresponding security measures.
- Complex supply chains that introduce potential points of vulnerability.
- Ransomware targets public administration and education
Public administration and educational services continue to face heightened cyber exposure, with a more dangerous threat landscape than the global average. The report also highlighted a 70% increase in ransomware attacks on educational institutions in the last year and 20-40% higher severity of claims than average. Factors contributing to this include:
- Budget constraints, which can often lead to outdated IT infrastructure and security measures.
- Large user bases with varying levels of cybersecurity awareness.
- Valuable personal and research data that attracts cybercriminals.
- The critical nature of services, increasing pressure to pay ransoms in case of attacks.
- Larger Businesses See 2.5X More Cyber Incidents
Enterprises with annual revenues exceeding $50 million experience cyber incidents 2.5 times more frequently than smaller organizations. While these companies may have more resources to invest in cybersecurity, their size and complexity introduce new vulnerabilities, specifically:
- Larger companies present a more attractive target due to their valuable data assets.
- Complex IT infrastructures in larger organizations create more potential entry points for attackers.
- Higher public profile of larger companies can make them targets for reputation-damaging attacks.
However, smaller businesses are not immune. While they may face a lower frequency of attacks overall, they remain at risk due to supply chain vulnerabilities and limited cybersecurity resources. What’s more, the consequences of a single incident can be devastating for a small SME, with severe financial losses, downtime, business interruption, and, in some cases, closure, all on the line.
- Critical technologies present the greatest risks
Operating systems, content management tools, virtualization technologies, server-side technologies, and business applications are foundational to many business operations. However, these exact five technology categories were identified as presenting significant cybersecurity risks. Thanks to their ubiquity and complexity, they’re all highly vulnerable to exploitation, posing far-reaching consequences when breached.
Interestingly, the report also found that the choice of cloud providers plays a pivotal role in cybersecurity outcomes, with businesses using Google Cloud reporting a 28% lower frequency of cyber incidents and the lowest severity of breaches compared to users of other platforms. By contrast, Microsoft Azure showed the highest severity of cyber incidents.
Action points for business leaders
Understanding these trends is half the battle. Next, business leaders should consider implementing the following action points with the above trends in mind:
- Conduct regular cyber risk assessments: Identify critical assets and data, evaluate existing security controls, and prioritize risks based on potential impact. Businesses can even leverage tools like Cowbell Factors to benchmark their organization’s security against industry peers and identify vulnerabilities.
- Strengthen supply chain security: Implement robust third-party risk management practices, including vetting suppliers, conducting security audits, and monitoring vendor cybersecurity performance. This should include ensuring contractual agreements mandate strong cybersecurity measures across your supply chain.
- Invest in employee cybersecurity training: Not only do business leaders across the board need to provide ongoing, role-specific training focused on phishing awareness, safe data handling, and secure remote work practices – but they should also promote a culture of cybersecurity awareness within the organization.
- Fortify incident response and backup systems: As well as developing a detailed incident response plan, with clearly assigned roles and responsibilities in the event of a cyber event, implementing automated, regular backups stored offline or in segmented networks is one of the best ways to minimize ransomware impact.
- Take a proactive approach to technology risk management: Establish a rigorous patch management program for operating systems, server-side technologies, and business-critical tools. Also look to secure content management and collaboration platforms with access controls, encryption, and regular audits.
- Tailor cybersecurity strategies to industry-specific risks: It’s vital you consider your industry when implementing cybersecurity strategies. Those in manufacturing, for example, should prioritize securing operational technology, updating legacy systems, and protecting intellectual property, while those in education and public services must focus on ransomware defenses, including strong backup strategies and email security enhancements.
Only by truly understanding these trends and implementing the recommended action points, can business leaders take the necessary steps toward improving their organization’s cyber resilience.
And one final note – cybersecurity is not a one-time effort. The threat landscape will undoubtedly continue to evolve as we head into 2025. As such, the long-term success and security of businesses across all sectors requires continuous vigilance, adaptation, and investment to stay ahead.
About the Author
Rajeev Gupta is Co-Founder at Cowbell, a leading provider of cyber insurance for small and medium-sized enterprises (SMEs). Gupta was the GM for the Application Protection Business Unit at Zimperium, a leader in mobile security. He comes with 20 years of hands-on experience in software architecture and design of large-scale secure enterprise applications. Prior, at CA Technologies, he was the Head of Product for the Application Delivery business unit, where he mentored several customer teams and led efficient software development strategies for Fortune 500 clients.
Rajeev can be reached online at rajeev@cowbellcyber.ai and on LinkedIn and at our company website https://cowbell.insure/
