HIDDEN RISKSIN CYBERDEFENCE: LAYING
A FOUNDATIONFOR EFFECTIVECYBERSECURITY
RISK MITIGATIONHLB CYBERSECURITY REPORT 2022

www.hlb.global

HLB CYBERSECURITY REPORT 2022

CONTENTS
THE INVISIBLE THREAT

02

TOP 5 CYBERSECURITY CONCERNS

05

ACHIEVING CYBERSECURITY
MATURITY

11

HOW HLB CAN HELP

17

HLB CYBERSECURITY REPORT 2022 1

CEOs worldwide face a broadand complex risk environment.
Challenges appear at every turn,from supply chain disruptions totalent shortages. The risingcosts of inflation and energy
reverberate across operations as
geopolitical tensions mount,like the war in Ukraine.
However, another threat is happening in real-time, andit’s far less visible than other issues: Cyber-attacks.
Indeed, 47% of respondents to our 2022 cybersecurity
survey cited an increase in attacks against theirorganisations in the past twelve months. Yet, only 22%
are fully prepared for an incident. Part of the problem
lies in the sheer number and types of cyber-attacks.
But, barriers to mitigating risks also impact readiness.
In September 2022, we surveyed 753 senior IT
professionals via an online questionnaire about thechallenges they face in today’s cyber-risk landscape.
In this report, we cover the top cybersecurity threats
and offer recommendations for navigating themsuccessfully. This report also contains a framework to
help you enhance your security practices and readyyour business for an attack.

2 HLB CYBERSECURITY REPORT 2022

THE INVISIBLE THREATWork occurs in the cloud over networks where hundreds or thousands ofdevices connect.
The expanding attack surface and increasingly
sophisticated cyber-attacks make it challenging
to protect assets and infrastructure. Cybersecurity
and password tools provide protection, but
hidden weaknesses lurk in your network, softwareor hardware. Moreover, human error remains a
constant threat.

The technology leaders we surveyed almost
unanimously agree that changing humanbehaviour is the most significant barrier to bettercybersecurity. Accordingly, most concerns anddata breaches are linked to human mistakes or
conduct.

FIG. 1: HUMAN BEHAVIOUR POSES THE GREATEST SECURITY CHALLENGE
To what extent do you agree or disagree that changing human behaviour is the greatest barrier to amore secure cyber defence?

4% 1%
37%

Strongly agree
Agree
Disagree58%

Strongly disagree

3 HLB CYBERSECURITY REPORT 2022

Senior information technology professionals
experienced higher numbers of cyber-attacks
during 2020 and 2021. As a result, 81% of
respondents to HLB’s 2021 Cybersecurity survey 1
altered their security strategies and protocols.
But the scrutiny diminished slightly as new,formidable challenges arose. The obstacles tosecuring diverse environments left businesses
vulnerable.
Indeed, only 7% of respondents to HLB’s 2022
cybersecurity survey saw cyber-attacks decreaseover the past twelve months. The incoming
threats had sweeping consequences, affecting
operations across the board. Business activities

were disrupted, and employee productivity
dropped. As leaders deployed IT resources toremedy the situation, they faced the loss ofintellectual property and corporate data. Those
severely impacted reported regulatory fines andlegal issues.
It’s time to shed light on cybersecurity andincreasing visibility into your risks is an essential
first step. Understanding the main challenges andhow to resolve them helps your organisation movefrom a reactive approach to a proactive strategy.

FIG. 2: CYBER-ATTACKS STILL ON THE RISE
Have the number of cyber-attacks against your organisation increased, decreased or stayed the samein the past 12 months?

7%
Increased

47%

Stayed the same
Decreased46%

4 HLB CYBERSECURITY REPORT 2022

TOP 5 CYBERSECURITY CONCERNS
Technology professionals are well aware of the increase incyber-attacks and are actively working to mitigate them. But several
challenges impede progress. Here’s how to break down the barriers
preventing practical cybersecurity management.

FIG. 3: CYBERSECURITY SKILLS SHORTAGE IS THE TOP CONCERN
To what extent are you concerned about the following challenges in order to mitigate cyber-risk?
Cybersecurity skills shortage

Lack of cybersecurity training

Lack of cybersecurity awareness from staff

Advanced technologies provide higher threats

Cloud technology vulnerabilities

Very concerned

Concerned

NeutralNot concerned

Not at all concerned

HLB CYBERSECURITY REPORT 2022 5

ONGOING CYBERSECURITY
SKILLS SHORTAGE
In 2021, 2.7 million cybersecurity positions
remained unfilled worldwide, according to
ISC2 2. The Information Systems Security
Association International (ISSA) 3 reported
that the multi-year shortage had affected
more than half of organisations. Likewise,
it’s a top issue for HLB survey respondents,
with 85% saying they are concerned orvery concerned that a lack of talent is acybersecurity risk.
The cybersecurity skills crisis is due, in part,to rapid technological advancements. In
cybersecurity, the game of prevention anddetection changes every 24 hours. Many
security professionals aim for 40 hours of
training annually, at a minimum. Yet, ISSA
found that 21% of those surveyed failed toachieve this goal.
There is also a high demand for people withdata security backgrounds, including security
analysis and investigations, application
security and cloud computing security. As
positions go unfilled, cybersecurity staff
experience burnout and heavier workloads,
potentially leading to increased staff
turnover.

1

Solution
A holistic approach to professional development and worker retention
Start with an investment in your current and future workforce, focusing on
recruitment, retention and training. This multi-level approach uses a continuous
learning environment to attract and keep employees while helping IT teams
fine-tune their talents. Indeed, nearly half of IT professionals lacking yearlytraining said it was due to their employers not contributing to the cost. You
can differentiate your business by highlighting your professional development
programme.
It’s also essential to align your human resources (HR) and cybersecurity goals.
Almost one in three IT workers believe their organisation overlooks promising
job candidates “because they don’t understand the skills necessary to workin cybersecurity.” The National Institute of Standards and Technology (NIST)
provides resources for companies to assess, measure and develop cybersecurity
teams. Use NIST’s National Initiative for Cybersecurity Education (NICE) workforce
framework to build a model that works for your business.
In the meantime, consider outsourcing to supplement your in-house team.
After all, only 4% of respondents to a CISO buying trends survey 4 handle all
cybersecurity tasks within their company. An outsourced CISO, training consultant
and managed IT services can reduce the burden on your staff, allowing them toupdate their skills.

HLB CYBERSECURITY REPORT 2022 6

2
LACK OF EMPLOYEE TRAINING
Without an ongoing training programme, companies face severe cybersecurity vulnerabilities.
HLB survey respondents acknowledge this, with 79% feeling concerned or very concerned
about a lack of education affecting their security posture. The human factor is almost always
involved when a data breach occurs. Half of CISO survey 5 respondents said that human error orinadequate training is the main reason for IT vulnerabilities.
Yet, only 50% of global CISOs surveyed by Proofpoint 6 expanded the frequency of employee
cybersecurity training. And those that attempt to train workers still face issues. In fact, one inthree HLB survey respondents said they try to educate staff but face non-compliance.
Enforce mandatory training with real-life drills

Solution

Many training objectives and activities look good on paper,
helping companies meet compliance and cybersecurity goals.
Yet, too often, training doesn’t reflect real-life scenarios. A
comprehensive programme with cyber simulations increases
awareness while reducing risky behaviour. When combinedwith a security-first culture, you can empower employees to beguardians of security and privacy.
Aim to develop security-focused mindsets from day oneof employment by providing staff with the right tools
and information. Training should be mandatory for every
individual, from the top down. Your team must understand thatcybersecurity isn’t just a knowledge workers’ problem.
Use technology to gamify the experience, reward participation
and allow staff to engage from their preferred devices.
Random drills and simulations mimic real-life experiences,helping leaders find weaknesses and continually improvetraining efforts. Outsourcing training alleviates pressure on
cybersecurity leaders and HR staff. It also ensures that yourprogrammes have the latest information and resources.

HLB CYBERSECURITY REPORT 2022 7

3
CLOUD VULNERABILITIES
One-third of organisations run more than
50% 7 of their workloads in the cloud, and
71% deploy 8 a multi-cloud or hybrid strategy.
Although cloud applications are vital totoday’s workforce and employers, theircomplex nature puts companies at risk. Over
80% of HLB respondents express concern
about cloud vulnerabilities affecting theircybersecurity. Indeed, they should be, withThales 9 reporting that two in five companies
encountered a cloud-related data breach inthe past twelve months.
Ponemon Institute 10 identified cloud accounttakeovers as a significant security risk. It
noted that cyber-criminals target popular
tools like Google Workspace and Microsoft
365 accounts with phishing and brute force
attacks. Likewise, misconfiguration andinsecure application programming interfaces(APIs) threaten cloud security.

Solution
Develop and maintain a robust cloud security posture
In many cloud deployments, security is an afterthought. Companies
rely on third-party providers to secure the application but fail to takea security-first mindset with their strategy. Cybersecurity should be at
the core of your cloud migration plan. One of the best ways to protect
your hybrid or multi-cloud environment is by working with a cloud
migration and cybersecurity professional. Risk management experts
assess threats and make recommendations to ensure a seamless
transition.
In addition, our HLB cybersecurity professionals can help implement
best practices when migrating to the cloud. These approaches typicallyinvolve understanding compliance concerns and deploying policies
and technologies to limit risk exposure. Other essential measures
include adopting a security framework with clearly defined roles andaccountability, increasing employee awareness and training staff.

HLB CYBERSECURITY REPORT 2022 8

LACK OF CYBERSECURITY
AWARENESS FROM STAFF
Verizon’s 2022 Data Breach Investigations
Report (DBIR 11) found that four in five data
breaches involved human-related weaknesses.
In 2021, bulk phishing attacks increased by
12%, and business email compromise (BEC)
incidents rose by 18%. Accordingly, 77%of HLB survey respondents are concernedthat a lack of awareness negatively impacts
cybersecurity.
Your employee’s personal choices and risk
tolerance affect your organisation’s security.
Unfortunately, more than 30% of working
adults consider emails with familiar logos
safe, and 35% believe that all cloud-stored
files are secure. Even with training, 42%
reported taking a dangerous action suchas clicking a malicious link or downloading
malware. Additionally, over half of employees
admit they allow family or friends to use
employer-issued electronic devices, and 77%
use them for personal purposes.

4

Solution
Embrace vigilance as a shared responsibility
Training can only get you so far. To increase awareness, companies must
develop a culture with security at its core. In this model, everyone from the CEO
to the entry-level worker participates in cyber-defence. As stewards of yourorganisation’s cyber policies, employees feel they contribute to a greater purpose.
For this approach to work, leaders must frequently communicate, sharing thelatest threat intelligence and explaining the impact on individuals and thecompany as a whole.
It’s also critical to acknowledge that cybersecurity skills are life skills, meaning
personal habits affect workplace cybersecurity. Your awareness initiatives
should help staff improve vigilance at home and in the workplace. Work with risk
management specialists to identify vulnerabilities based on role or permission
levels, and develop a strategy that considers current challenges and behaviours.
A personalised approach encourages mindfulness when performing everyday
routines. Focus on policies and systems that work with employees, not against
them. To this end, the right technologies should boost awareness without
disrupting workflows and productivity.

HLB CYBERSECURITY REPORT 2022 9

5INCREASED THREATS FROM ADOPTING NEW TECHNOLOGIESBig data, artificial intelligence (AI), cloud infrastructure and the internet of things (IoT) fuelgrowth opportunities across industries. Yet, their application expands the attack surface andcomplicates governance. Hence, 78% of HLB respondents express concern about the impact of
new technology on cybersecurity.
Cyber-criminals also weaponise the same technologies companies use to improve operations
and protect networks. Threat actors leverage AI to design malware capable of imitating a securesystem, which leads to undetectable ransomware attacks. Hijacked IoT devices assist with denialof service (DDoS) attacks and harvest sensor data.
These hidden threats cause significant harm. To avoid danger, organisations may complete aninternal risk-benefit analysis. While beneficial, this process can be time-consuming and slow
down or halt digital initiatives. A risk-averse mindset to new technologies can hinder growth andreduce a company’s competitiveness in the rapidly changing marketplace.

Assess risks and prepare for attacks

Solution

Safeguard your critical assets andinfrastructure by completing a risk assessment
before adopting new technology. An
independent evaluation lays the groundwork
for a security-first strategy. It identifies key
weaknesses and threats without bias, allowing
leaders to make evidence-based decisions.
Also, consider requesting external audit
results from technology partners before
signing a contract or deploying new softwareor systems. Doing so establishes trust andincreases visibility into third-party practices.
Even with these protections, your cyberdefence plan isn’t foolproof. Leaders shouldplan for business continuity and disasterrecovery to prevent stagnation from risk
aversion. Work with a risk specialist tobuild a cohesive, actionable BCDR strategy
that outlines solutions to data privacy andcybersecurity incidents. Outsourcing security
audits and evaluations can reduce your internal
staff and resource burden, allowing you to stayon track for your transformation goals.

10 HLB CYBERSECURITY REPORT 2022

ACHIEVING CYBERSECURITY MATURITY
An effective cybersecurity programme is anorganisation’s strongest defence. Yet maturity rates
vary among companies. The majority of HLB survey
respondents feel somewhat prepared to respond toa severe cyber-attack. Still, nearly 20% report being
somewhat unprepared and 6% are not ready.

FIG. 4: LESS THAN A QUARTER OF ORGANISATIONS IS FULLY PREPARED FOR CYBER-ATTACKS
Where do you rank your organisation’s level of readiness to respond to a severe cyber-attack?

6%
22%
20%

Not prepared
Somewhat unprepared
Somewhat prepared
Fully prepared52%

HLB CYBERSECURITY REPORT 2022 11

Businesses with a low maturity level may haveundersized teams with skill gaps, unpredictableprocesses and poor asset management. Medium
cybersecurity maturity rates improve systems
but lack consistent measurement and monitoring.
Often mid-level firms have documented the bestpractices to ward off an attack and implemented
security frameworks, such as ISO, SOC and NIST.
Yet, resources and capabilities remain abarrier to risk mitigation efforts. Low and midmaturity companies may have trouble executing
the strategy, running drills and performing
penetration tests in-house. It’s also difficult
to attract cybersecurity talent and set aside
resources for implementation and ongoing
testing.
In contrast, higher maturity organisations haveformalised policies in place. These establishments
uniformly measure and monitor risks while
focusing on cyber cost reduction and a positive
return on investment (ROI). Also, leaders meet
regularly with cyber professionals to evaluate
the resiliency and strength of their security
technology and processes.
Overall security programme improvements areamong the top three outsourced cybersecurity
services. In addition, organisations outsource
technology integration and optimisation services
along with 24/7 threat monitoring, detection, andresponse.

You can develop a pathway to cybersecurity
maturity by following the framework of the
National Institute of Standards and Technology(NIST). These guidelines and best practices
help organise and improve your cybersecurity
program.

UNDERSTANDING THE NIST CYBERSECURITY
FRAMEWORKThe NIST Cybersecurity Framework 12 has threemain elements: the core, implementation tiers andprofiles. The Framework Core highlights preferredcybersecurity activities and outcomes. It guides
companies toward the best ways to manage andreduce cybersecurity risks and complements
your current cybersecurity and risk management
system. The core consists of five pillars, andcompanies can choose activities and threats toaddress under each category.
At the implementation level, the framework helps
leaders decide what level their cybersecurity
programme requires. Companies can use
the implementation tiers to spark internalconversations about risk appetite, budget andmission priority. Lastly, the framework profilesalign your organisational requirements, goals,
resources and risk appetite against your desired
outcomes. Leaders use the profiles to findand prioritise opportunities to improve theircybersecurity.

12 HLB CYBERSECURITY REPORT 2022

NIST

CYBER SECURITY FRAMEWORK

1

Identify
AM: Asset Management
BE: Business Environment
GV: Governance
RA: Risk Assessment
RM: Risk Management Strategy

Recover2
Protect

RP: Recovery Planning
IM: Improvements
CO: Communications

AC: Access Control
AT: Awareness Training
DS: Data Security
IP: Information Protection
Processes and Procedures
PR: Protective Technology

5
Respond
RP: Response Planning
CO: Communications
AN: Analysis
MI: Mitigation
IM: Improvements

Detect
AE: Anomolies and Events
CM: Security Continious Monitoring
DP: Detection Processes

43

HLB CYBERSECURITY REPORT 2022 13

Identify

Protect

The first function of the NIST framework
encourages companies to increase visibility under
the premise that anticipating attacks is impossible
when you don’t fully understand your risks.
Companies with low cybersecurity maturity canstart by listing all software, data and equipmentused. This should include on-premise and remotedevices and applications.

During the protect phase, the focus is on
minimising the impact of an attack. It defines
the security measures to defend mission-critical
functions, systems and employees. Begin byreviewing the list of assets you identified in
the first part of the framework. Prioritise themaccording to your business needs and level ofcybersecurity maturity. This helps focus yourcybersecurity efforts on the most important
items first.

Next, develop and share a company cybersecurity
policy. Have discussions with leaders from various
departments to clarify employee roles andresponsibilities. The idea is to provide the rightamount of access to data and programs without
creating additional vulnerabilities. Remember toinclude anyone with access to sensitive data, suchas vendors and contractors. Outline the steps you
currently take to protect against an attack andhow you minimise the damage if one occurs.
This procedure gives you a high-level view of
how employees, systems and processes interact.
Use this time to connect the dots showing how
everything is interconnected. Superimpose yoursecurity measures over your usage diagram todiscover activities and assets requiring more
protection.

Layer security safeguards, such as:•	Restrict permissions for digital and physicalassets.
•	Provide awareness education and training.
•	Implement processes for securing data andsystems.
•	Conduct necessary repairs and maintenance.
•	Leverage protective technology solutions forcyber-resilience.

Detect

Respond

The detect function relates to how you catchand analyse anomalies and events. It requires
processes and technologies to establish anenvironmental baseline, perform vulnerabilityscans and set alert thresholds. Companies must
implement various controls, including continuous
security monitoring and detection. Additionally,
this phase requires regular testing.

Nearly half of HLB respondents reported anincrease in cyber-attacks. As a result, theyexperienced business disruptions and loss of dataand intellectual property. However, more than halfof small and mid-sized companies 13 don’t have an
incident response strategy.

Your organisation should understand the threats
to operational continuity and the potential impactof security incidents. Leaders should be able tospeak to the effectiveness of protective actions.
Again, methods vary according to cybersecurity
maturity level, business size, industry and more.
Ways to detect issues include:•	Use threat hunting, file integrity monitoring(FIM) and intrusion detection and prevention
systems (IDS/IPS).
•	Monitor all connected devices and software forunauthorised personnel access.
•	Take note of abnormalities and investigate
unusual network or employee activities using
logs or third-party tools.
•	Regularly stress test your cybersecurity system,
including after implementing technology
changes.

The respond function of the NIST framework
recommends that organisations develop a
response plan. Your plan should outline theimmediate steps to contain the attack and keep
your business operational. Also, it must detailyour investigation and elimination methods.
Your cybersecurity strategy will identify ways tocollect and analyse incident data. This allows you
to gain insights and use them to revise your plan.
You also need a communication process to alert
those involved, including employees, customers,
vendors and, if necessary, the authorities.
Remember to identify the human and financial
resources required, and have a system forallocating resources as needed.
However, documenting your strategy is only partof the respond function. It’s essential to test yourplan regularly by running practice drills. Adjust it
as needed and update your policies and training
to ensure a smooth response to an attack.

Recover
The recovery period after a data breachor cyber-attack is risky for businesses.
On average, companies experience
20 to 23 days of downtime after aransomware attack. IBM 14 reported thatthe global average data breach costreached an all-time high in 2021, andalmost 50% of the expenses incur morethan a year after the breach. Even after
paying a ransom, only about 8% ofvictims recuperate all of their data.

None

Don’t know/
unsure19%

Lawsuit /legal issues

20%

Regulatory fines

Loss/compromise of
intellectual property

26%

Corporate data
loss or theft

Reduced revenue /lost business

41%

Deployment of IT resources to triage andremediate issue

42%

Reduced employee productivity

43%

Increased helpdesk time to repair damage

Disrupted business activities

HLB CYBERSECURITY REPORT 2022 15

FIG. 5: THE COST OF CYBER-ATTACKS

What negative impact have security
incidents had on your company?

39%

24%

18%

3%

3%

16 HLB CYBERSECURITY REPORT 2022

HOW HLB CAN HELP
Invisible threats to your data privacy and cybersecurity hide in the shadows, waiting for one humanerror or unpatched weakness. Being somewhat prepared isn’t enough to withstand the sophisticatedattacks leveraged at businesses of any size. A robust security posture safeguards your organisation,and it begins with an accurate risk assessment. HLB’s experienced cybersecurity professionals
specialise in helping you understand, prioritise and harden vulnerabilities. Move the needle fromsomewhat to fully prepared by reaching out to us.

OUR SERVICESCYBER RISKSCONSULTING

SOC AS ASERVICESTANDARDSCOMPLIANCEGAP ANALYSISMONITORING
OF SECURITY
EVENTSRISKASSESSMENT

INCIDENTRESPONSE

SECURITY
MATURITYASSESSMENTCOMPUTERFORENSICS

SOURCE CODEREVIEW

T ECHNOLOGYMANAGEMENT& SUPPORTTHREATHUNTINGRED TEAM
EXERCISESSECURITY
AWARENESSCYBERSECURITY
STRATEGYCYBERDRILLSCAPABILITIESASSESSMENT
OF INCIDENTRESPONSE

ASSESSMENTOF CYBERRESILIENCE
NATIONALCYBERDRILLSTECHNICALSECURITYASSESSMENTS
VULNERABILITYASSESSMENTPENETRATIONTESTINGMANAGED
SECURITY
INTERNAL
AUDITSTHREATINTELLIGENCEHLB CYBERSECURITY REPORT 2022 17

ENDNOTES
1 	HLB International, 2021. HLB Cybersecurity Report 2021: Threat or opportunity: Addressing the cyber-risk landscape in the age ofhybrid work2 	(ISC)2, 2021. (ISC)2 Cybersecurity Workforce Study 2021: A resilient cybersecurity profession charts the path forward3 	ISSA, 2021. Cybersecurity skills crisis continues for fifth year, perpetuated by lack of business investment
4,5 Nuspire, 2022. Nuspire Annual Study: Top 10 CISO buying trends of 2022
6 	Proofpoint, 2022. 2022 voice of the CISO: Global insights into CISO challenges, expectations and priorities
7 	Fortinet, 2021. Cloud security report8 	Thales, 2021. 2021 Thales Cloud Security Study – report9 	Ponemon Institute, 2021. The cost of cloud compromise and shadow IT
10 	Verizon, 2022. 2022 Data breach investigations report11 	Proofpoint, 2022. 2022 State of the Phish: An in-depth exploration of user awareness vulnerability and resilience
12

NIST, 2022. Cybersecurity Framework

13 	Connectwise, 2021. Vanson Bourne shares stats on the state of SMB cybersecurity in 2021 and how to prepare for attacks
14 IBM, 2022. Cost of a data breach report 2022

www.hlb.global© 2022 HLB International Limited. All rights reserved.
HLB International is a global network of independent advisory and accounting firms, each of which is a separate
and independent legal entity, and as such HLB International Limited has no liability for the acts and omissions of
any other member. HLB International Limited is registered in England No. 2181222 Limited by Guarantee, which coordinates the international activities of the HLB International network but does not provide, supervise or manage
professional services to clients. Accordingly, HLB International Limited has no liability for the acts and omissions ofany member of the HLB International network, and vice versa and expressly disclaims all warranties, including but
not limited to fitness for particular purposes and warranties of satisfactory quality.
This publication has been prepared for general guidance on matters of interest only, and does not constituteprofessional advice. You should not act upon the information contained in this publication without obtaining
specific professional advice. No representation or warranty (express or implied) is given as to the accuracy
or completeness of the information contained in this publication, and, to the extent permitted by law, HLB
International does not accept or assume any liability, responsibility or duty of care for any consequences of youor anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any
decision based on it.
In no event will HLB International Limited be liable for the acts and/or omissions of any member of the HLBInternational network, or for any direct, special, incidental, or consequential damages (including, without limitation,
damages for loss of business profits, business interruption, loss of business information or other pecuniary loss)
arising directly or indirectly from the use of (or failure to use) or reliance on the content of this Website or any third
party website, or from your use of any member’s services and/or products. Any reference to a member’s services or
products should not be taken as an endorsement.
HLB refers to the HLB International network and/or one or more of its member firms, each of which is a separate
legal entity.