The Economic Value of Prevention in the
Cybersecurity Lifecycle
Sponsored by: Deep Instinct

Independently conducted by Ponemon Institute LLC
Publication Date: April 2020
Ponemon Institute© Research Report

The Economic Value of Prevention in the Cybersecurity Lifecycle
Ponemon Institute, March 2020

Table of Contents

Page

Part 1. Introduction

2–3

Part 2. Key Findings

4 – 23

The top security threats organizations must prevent

4–6

Prevention in the cybersecurity lifecycle is difficult to achieve

7 – 11

Attacks in the cybersecurity lifecycle

12 – 16

Artificial intelligence, automation and deep learning are reshaping IT security

17 – 20

Budget and investments in the cybersecurity lifecycle

21 – 25

Part 3. Methods

26 – 28

Part 4. Caveats

28

Appendix: Audited Findings

Ponemon Institute© Research Report29- 49Page 1

Part 1. Introduction
Ponemon Institute is pleased to present the findings of The Economic Value of Prevention in the
Cybersecurity Lifecycle, sponsored by Deep Instinct. The cybersecurity lifecycle is the sequenceof activities an organization experiences when responding to an attack. The five high-level
phases are prevention, detection, containment, recovery and remediation.
We surveyed 634 IT and IT security practitioners who are knowledgeable about theirorganizations’ cybersecurity technologies and processes. Within their organizations, most ofthese respondents are responsible for maintaining and implementing security technologies,
conducting assessments, leading security teams and testing controls.
The key takeaway from this research is that when attacks are prevented from entering andcausing any damage, organizations can save resources, costs, damages, time andreputation.
To determine the economic value of prevention, respondents were first asked to estimate thecost of one of the following five types of attacks: phishing, zero-day, spyware, nation-state andransomware. They were then asked to estimate what percentage of the cost is spent on eachphase of the cybersecurity lifecycle, including prevention. Because there are fixed costs
associated with the prevention phase of the cybersecurity lifecycle, such as in-house expertiseand investments in technologies, there will be a cost even if the attack is stopped before doing
damage. For example, the average total cost of a phishing attack is $832,500 and of that 82
percent is spent on detection, containment, recovery and remediation. Respondents estimate 18
percent is spent on prevention. Thus, if the attack is prevented the total cost saved would be$682,650 (82 percent of $832,500).
Figure 1 illustrates the dilemma organizations face with respect to prevention in the cybersecurity
lifecycle. Seventy percent of respondents (34 percent + 36 percent) believe the ability to prevent
cyberattacks would strengthen their organization’s cybersecurity posture. However, 76 percent ofrespondents (40 percent + 36 percent) say they have given up on improving their ability toprevent an attack because it is too difficult to achieve.
Figure 1. Perceptions about the prevention of cyberattacks

My organization focuses on the detection of
cyberattacks because prevention is perceived to
be too difficult to achieve

40%

The ability to prevent cyberattacks would
strengthen our cybersecurity posture

34%

0%

36%

10% 20% 30% 40% 50% 60% 70% 80%

Strongly agree

Ponemon Institute© Research Report

36%

Agree

Page 2

The following are the most noteworthy findings from the research.
§

Organizations are most effective in containing cyberattacks. Fifty-five percent ofrespondents say their organizations are very or highly effective at containing attacks in the
cybersecurity lifecycle. Less than half of respondents (46 percent) say their organizations arevery or highly effective in preventing cyberattacks. Organizations are also allocating more of
the IT security budget to technologies and processes in the containment phase than in theprevention phase.

§

Prevention of a cyberattack is the most difficult to achieve in the cybersecurity
lifecycle. Eighty percent of respondents say prevention is very difficult to achieve followed byrecovery from a cyberattack. The reason for the difficulty is that it takes too long to identify anattack. Other reasons are outdated or insufficient technologies and lack of in-house expertise.
The technology features considered most important are the ability to prevent attacks in realtime and based on different types of files.

§

Automation and advanced technologies increase the ability to prevent cyberattacks.
Sixty percent of respondents say their organizations currently deploy AI-based or plan to
deploy AI for cybersecurity within the next 12 months. Sixty-seven percent of respondents
believe the use of automation and advanced technologies would increase their organizations’ability to prevent cyberattacks. Further, 67 percent of respondents expect to increase theirinvestment in these technologies as they mature.

§

Deep learning is a form of AI and is inspired by the brain’s ability to learn. In the context
of this research, deep learning is defined as follows: once a human brain learns to identify an
object, its identification becomes second nature. Deep learning’s artificial brains consist ofcomplex neural networks and can process high amounts of data to get a profound and highly
accurate understanding of the data analyzed. The top three reasons to incorporate a deeplearning-based-solution are to lower false positive rates, increase detection rates and prevent
unknown first-seen cyberattacks.

§

Perceptions that AI could be a gimmick and lack of in-house expertise are the twochallenges to deployment of AI-based technologies. Fifty percent of respondents saywhen trying to gain support for the adoption of AI there is internal resistance because it isconsidered a gimmick. This is followed by the inability to recruit personnel with the necessary
expertise (49 percent of respondents).

§

Organizations are making investments in technology that do not strengthen theircybersecurity budget based on the wrong metrics. Fifty percent of respondents say theirorganizations are wasting limited budgets on investments that don’t improve theircybersecurity posture. The primary reasons for the failure are system complexity, personnel
and vendor support issues. Another reason is that most organizations are using return on
investment (ROI) to justify investments and is not based on the technology’s ability toincrease prevention and detection rates.

§

IT security budgets are considered inadequate. Only 40 percent of respondents say theirbudgets are sufficient to achieve a strong cybersecurity posture. The average total IT budget
is $94.3 million and of this 14 percent or approximately $13 million is allocated to IT security.
Nineteen percent or approximately $2.5 million will be allocated to investments in enabling
security technologies such as AI, machine learning, orchestration, automation, blockchain
and more.

Ponemon Institute© Research Report

Page 3

Part 2. Key findings
In this section, we provide an analysis of the research. The complete audited findings arepresented in the Appendix of this report. We organized the report according to the following
topics.
§§§§§

The top security threats organizations should prevent
Prevention in the cybersecurity lifecycle is difficult to achieve
Attacks in the cybersecurity lifecycle
Artificial intelligence, automation and deep learning are reshaping IT security
Budget and investments in the cybersecurity lifecycle

The top security threats organizations should prevent
Figure 2 presents a list of security threats affecting organizations represented in this study. As
shown, phishing attacks, DNS-based attacks and electronic agents top the list.
“Ready or not we have to be prepared for the security risks of IoT and digital transformation.
The ability to prevent attacks will be critical to prevent security exploits related to unsecured IoT
devices and the digital transformation process.”
IT security manager, retail industry.

Figure 2. What are the top security threats affecting your organization?
Three responses permitted
Phishing attacks

47%

DNS-based attacks

40%

Electronic agents (viruses, bots and more)

35%

Denial of service attacks

34%

Ransomware

32%

Web-based attacks

26%

Active adversaries

25%

Fileless attacks

22%

Nation-state, terrorist or criminal syndicate
sponsored attacks

21%

System failures

15%

Other

3%
0%

Ponemon Institute© Research Report

5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

Page 4

Negligent insiders, third-party error and insecure endpoints are the top security vulnerabilities that
respondents believe can be the source of a security exploit.
Figure 2. What are the top security vulnerabilities affecting your organization?
Two responses permitted
Negligent insiders

40%

Third-party error

36%

Insecure endpoints

35%

System failures25%

Insecure applications

24%

Social engineering

19%

Insecure cloud platform

18%

Other

3%
0%

5%

10%

15%

20%

25%

30%

35%

40%

45%

BYOD brings risk to the workplace. Fifty-four percent of respondents say their organizations
allow the use of personal mobile devices in the workplace and an average of 41 percent of
employees use their mobile device for work. According to Figure 3, 44 percent of respondents areusing their personal device. Only 35 percent of respondents say the device is approved by theorganization.
Figure 3. What type of mobile device is allowed?
50%
45%

44%

40%

35%

35%
30%
25%

21%

20%
15%
10%
5%
0%
Personal mobile device

Ponemon Institute© Research Report

Corporate office sanctioned
deviceA combination of bothPage 5

Only 39 percent of respondents say their organizations take steps to protect its information assets
on employees’ mobile phones. According to Figure 4, the top two steps taken are to encrypt
stored or transmitted data (41 percent of respondents) or the use of an enterprise mobility
management platform (40 percent of respondents).
Figure 4. How does your organization secure mobile devices used by employees?
More than one response permitted
Encryption of stored or transmitted data

41%

Enterprise mobility management platform

40%

Mobile device management

37%

Active sync only

37%

Secure containers

32%

Mobile hypervisors

25%

Other

2%
0%

Ponemon Institute© Research Report5%

10% 15% 20% 25% 30% 35% 40% 45%

Page 6

Prevention in the cybersecurity lifecycle is difficult to achieve
In the context of this research, we define each phase of the lifecycle as follows:
Prevention is the effort to stop malicious threats from running and to classify in real time what
type of attacks are targeting the organization. It is the ability to stop files or fileless attacks preexecutive before any process is running.
Detection is the effort to identify cyber threats through heightened visibility of the IT security
infrastructure. It is the ability to identify the malicious process while already running on themachine or network.
Containment occurs once a cyber threat is identified and includes efforts to stop it spread.
Recovery occurs once the cyber threat is contained and efforts are made to restore the IT
security infrastructure to its previous state.
Remediation is the effort to ensure that for the present and future there are the people,
processes and technologies in place to prevent future cyber threats.
Organizations are most effective in containing cyberattacks. Respondents were asked torate the effectiveness of dealing with the five stages of the lifecycle on a scale from 1 = noteffective to 10 = highly effective. Figure 5 presents the high effective responses (7+ on the 10point scale). Fifty-five percent of respondents rate their organizations’ ability to contain acyberattack as highly effective. Less than half (46 percent of respondents) say their organizations
are very effective in preventing, recovering and remediating an attack.
Figure 5. How effective is your organization in preventing, detecting, containing,recovering from and remediating a cyberattack?
On a scale of 1 = not effective to 10 = highly effective, 7+ results presented
56%

55%

54%
52%
50%

49%

48%
46%

46%

46%

46%

Recover from acyberattack

Remediate after acyberattack

44%
42%
40%
Prevent acyberattack

Detect acyberattack

Ponemon Institute© Research Report

Contain acyberattack

Page 7

Prevention of a cyberattack is the most difficult to achieve in the cybersecurity lifecycle.
According to Figure 6, 80 percent of respondents rate prevention as highly difficult (7+ responses
on the 10-point scale) the next most difficult is the recovery phase.
“We believe the prevention of attacks is ideal and I think achievable but senior leadership
accepts the fact that attacks cannot be prevented. ”
Senior IT security manager, hospitality industry.

Figure 6. How difficult is it to prevent, detect, contain, recover from and remediate acyberattack?
On a scale of 1 = not difficult to 10 = highly difficult 7+ results presented
81%
80%

80%
79%

79%
78%
77%

76%

76%

76%
75%

75%
74%
73%
72%
Prevent acyberattack

Detect acyberattack

Contain acyberattack

Recover from acyberattack

Remediate after acyberattack

Prevention is difficult because it takes too long to identify an attack. As shown above, 80
percent of respondents say prevention is the most difficult to achieve. According to Figure 7, 63
percent of respondents say difficulty can be attributed to the length of time it takes to identify anattack and outdated or insufficient technologies (59 percent of respondents).

Ponemon Institute© Research Report

Page 8Figure 7. What are the barriers to preventing a cyberattack?
More than one response permitted
Takes too long to identify an attack

63%

Technologies are outdated or insufficient59%

Lack of in-house expertise55%

The false positive rate is too high49%

Our devices are not connected to the network orInternet

29%

Other

4%
0%

10%

20%

30%

40%

50%

60%

70%

Respondents were asked to rate the impact of different technologies on the ability to prevent acyberattack on a 5-point scale of 5 = very high impact to 1 = low impact. The technologies thatare considered to have the greatest impact on an organization’s ability to prevent cyberattacks
are presented in Figure 8. Intrusion detection/prevention, SIEM, network traffic intelligence, user
behavior activity monitoring and access governance systems are considered to have a highimpact on improving the ability to prevent cyberattacks.
Figure 8. Technologies with the highest ability to prevent cyberattacks
On a 5-point scale of: 5 = very high impact, 4 = high impact, 3 = moderate impact, 2 = low impact and 1 =very low impact
Intrusion detection / prevention

4.6

Incident & event management (SIEM)

4.4

Network traffic intelligence

4.2

User behavior activity monitoring

4.1

Access governance systems

4.1

Public key infrastructure (PKI)

3.9

Privileged access management (PAM)

3.9

Web application firewalls (WAF)

3.8

Digital certificate management

3.6

Identity & access management systems

3.5

Database scanning

3.2

Endpoint detection & response (EDR)

3.0
1.0

Ponemon Institute© Research Report

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Page 9

The technologies used to prevent cyberattacks are only moderately effective. As discussed,
a primary barrier to preventing cyberattacks are outdated or insufficient technologies. As shown in
Figure 9, the technology most often used is endpoint detection and response, which is considered
only moderately effective in improving the prevention of cyberattacks (3.0 on the 5-point scale, as
shown in Figure 8).
“Once attacks are on the inside, we cannot accurately determine the financial and reputational
consequences to our company.”
Security analyst, healthcare industry.

Figure 9. What solutions do you currently use to prevent cyberattacks?
Two responses permitted
Endpoint detection and response

44%

Encryption37%

Signature-based antivirus

37%

Isolation

31%

Machine learning anti-virus

28%

Hardening

20%

Other

3%
0%

Ponemon Institute© Research Report5%

10% 15% 20% 25% 30% 35% 40% 45% 50%

Page 10

The ability to prevent attacks in real-time and based on different types of files are the two mostimportant technology features, according to 71 percent and 64 percent of respondents. As shownin Figure 10, the majority of respondents believe all these features are important when attempting
to prevent a cyberattack.
Figure 10. What technology features are important in the prevention of cyberattacks?
More than one response permitted
Ability to prevent attacks in real-time

71%

Ability to prevent attacks based on different typesof files64%

Ability to prevent zero-day attacks

62%

Minimize false positives

61%

Domain agnostic and can be inserted on mobile
devices, endpoints and servers

60%

Ability to prevent fileless attacks

60%

Ability to be predictive

54%

Cross-operating system protection (not just
Windows)

49%

Other

5%
0%

Ponemon Institute© Research Report

10% 20% 30% 40% 50% 60% 70% 80%

Page 11

Attacks in the cybersecurity lifecycle
In this section, we discuss in what phase of the cybersecurity lifecycle organizations are able todeal with an attack. The five attacks featured in this section are: phishing, zero-day, spyware,nation-state and ransomware. According to the findings, very few respondents are able to preventand detect these attacks. Respondents were also asked what the one attack cost theirorganizations and estimate the cost savings if their organization were able to prevent the attack.
Most organizations are only able to deal with the phishing attack in the later phases of thecybersecurity lifecycle. Seventy-nine percent of respondents say their organization had aphishing attack in the past year. Of these respondents, only 18 percent were able to prevent this
attack, as shown in Figure 11.
Figure 11. In what phase of the cybersecurity lifecycle were you able to deal with thephishing attack?
35%
30%

30%
25%
20%

20%

20%

18%

15%

12%

10%
5%
0%
Prevention

Detection

Ponemon Institute© Research Report

Containment

RecoveryRemediation

Page 12

Very few organizations are able to deal with a zero-day attack. Fifty-two percent ofrespondents say their organization had a zero-day attack. As shown in Figure 12, only 12 percent
of respondents say they were able to prevent the attack.
Figure 12. In what phase of the cybersecurity lifecycle were you able to deal with the zeroday attack?
45%

42%

40%
35%
30%
25%

21%

20%
15%

15%
12%

10%

10%
5%
0%
Prevention

Detection

Containment

RecoveryRemediation

Prevention is more effective in the case of a spyware attack. Thirty-seven percent ofrespondents say their organizations had a spyware attack in the past year. Twenty-six percent ofthese respondents say their organizations were able to prevent a spyware attack, as shown in
Figure 13. Only 20 percent of respondents say the spyware attack was dealt with in thecontainment phase.
Figure 13. In what phase of the cybersecurity lifecycle were you able to deal with the
spyware attack?
35%
29%

30%
26%
25%

20%

20%
15%

13%

12%

10%
5%
0%
Prevention

Detection

Ponemon Institute© Research Report

Containment

RecoveryRemediation

Page 13

Very few organizations are able to prevent a ransomware attack. Twenty-three percent ofrespondents say their organization had a ransomware attack. According to Figure 14, only 10
percent of respondents were able to prevent a ransomware attack. Thirty-five percent ofrespondents say it was dealt with in the containment phase.
Figure 14. In what phase of the cybersecurity lifecycle were you able to deal with theransomware attack?
40%
35%

35%
30%
25%

23%

20%

17%

15%
10%

15%

10%

5%
0%
Prevention

Detection

Containment

RecoveryRemediation

Nation-state attacks are few but difficult to prevent. Eighteen percent of respondents say theirorganization had a nation-state attack in the past year. As shown in Figure 15, only 9 percent ofrespondents say they were able to prevent a nation-state attack.
Figure 15. In what phase of the cybersecurity lifecycle were you able to deal with thenation-state attack?
35%
29%

30%
25%

23%
20%

19%

20%
15%
10%

9%

5%
0%
Prevention

Detection

Ponemon Institute© Research Report

Containment

RecoveryRemediation

Page 14

Prevention of attacks can reduce the cost of an attack significantly. To determine theeconomic value of prevention, respondents were first asked to estimate the cost of one of thefollowing five types of attacks: phishing, zero-day, spyware, nation-state and ransomware. They
were then asked to estimate what percentage of the cost is spent on each phase of thecybersecurity lifecycle, including prevention.
Because there are fixed costs associated with the prevention phase of the cybersecurity lifecycle,
such as in-house expertise and investments in technologies, there will be a cost even if the attack
is stopped before doing damage. For example, as shown in the Table below, the average total
cost of a phishing attack is $832,500 and of that 82 percent is spent on detection, containment,
recovery and remediation. Respondents estimate 18 percent is spent on prevention. Thus, if theattack is prevented the total cost saved would be $682,650 (82 percent of $832,500). If
organizations experienced all attacks the average total cost is $4.7 million and if prevented could
save the organization an average of $4 million.
“If we could quantify the cost savings of the prevention of attacks, we would be able toincrease our IT security budget and debunk the C-suite’s myth that AI is a gimmick.
I believe AI is critical to preventing attacks ”
CISO, financial services industry.
Nation-state attacks are the costliest attacks to respond to in the cybersecurity lifecycle ($1.5
million). If organizations are able to prevent these attacks, the cost savings could be an averageof approximately $1.4 million per attack. A zero-day attack can cost an average of $1.2 million
and if prevented could save $1.1 million if it was prevented
Percent of total cost
spent on preventing an
attack1

Average cost savings
resulting from the ability
to prevent an attack*Type of attack

Average total cost of an
attackPhishing$

832,500

18%$

682,650

Zero-day$

1,238,000

12%$

1,089,440

Spyware$691,500

26%$

511,710Nation-state$

1,501,500

9%$1,366,365

Ransomware$

440,75010%$

396,675

Total/Average$

4,704,250

15%$

4,046,840*Average total cost X (1 – percentage to cost relating to prevention)

1

The average percent of costs related to the four phases of the cybersecurity lifecycle (detection,
containment, recovery and remediation) are as follows: phishing (82 percent of the total cost), zero-day (88percent of total cost), spyware (74 percent of total cost), nation-state (91 percent of the total cost),
ransomware (90 percent of total cost).

Ponemon Institute© Research Report

Page 15

With the exception of the exploitation phase of the kill chain, zero-day attacks are very
difficult to prevent in the cyber kill chain. The cyber kill chain is a way to understand thesequence of events involved in an external attack on an organization’s IT environment.
Understanding the cyber kill chain model is considered helpful in putting the strategies andtechnologies in place to “kill” or contain the attack at various stages and better protect the IT
ecosystem. Following are the 7 steps in the cyber kill chain:
1.
2.
3.
4.
5.
6.

Reconnaissance: the intruder picks a target, researches it and looks for vulnerabilities
Weaponization: the intruder develops malware designed to exploit the vulnerability
Delivery: the intruder transmits the malware via a phishing email or another medium
Exploitation: the malware begins executing on the target system
Installation: the malware installs a backdoor or other ingress accessible to the attacker
Command and Control (C2): the intruder gains persistent access to the organization’s
systems/network
7. Actions on Objective: the Intruder initiates end goal actions, such as data theft, data
corruption or data destruction
Respondents were asked to rate the difficulty in preventing a zero-day attack in every phase of
the cyber kill chain on a scale of 1 = not difficult to 10 = very difficult. Figure 16 presents the very
difficult responses (7+ on the 10-point scale). The most difficult phase to prevent the zero-day
attack is the command and control phase (80 percent) in which the intruder gains persistentaccess to the organization’s systems/network followed by the delivery phase of the kill chain (78percent).
“We are optimistic that AI when properly deployed will make a huge difference in our ability toprevent attacks. The problem is finding the right people who can make AI work.”
SOC analyst, consumer goods industry.

Figure 16. How difficult is it to prevent a zero-day attack during each phase of cyber killchain?
On a scale of 1 = not difficult to 10 = very difficult, 7+ responses presented
Actions on Objectives phase of the kill chain

76%

C2 phase of the kill chain

80%

Installation phase of the kill chain
Exploitation phase of the kill chain
Delivery phase of the kill chain
Weaponization phase of the kill chain
Reconnaissance phase of the kill chain

73%
44%
78%
74%
71%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90%

Ponemon Institute© Research Report

Page 16

Artificial intelligence, automation and deep learning are reshaping IT security
In the context of this research, automation refers to enabling security technologies that augment
or replace human intervention in the identification and containment of cyber exploits or breaches.
Such technologies depend upon artificial intelligence (AI), machine learning and orchestration. AI
refers to the development of computer systems that are able to perform tasks normally requiring
human intelligence.
As shown in Figure 17, 60 percent of respondents say their organizations either currently deploy
AI (37 percent of respondents) or plan to deploy AI for cybersecurity within the next 12 months(23 percent of respondents).
Figure 17. Does your organization presently or plan to deploy AI-based security
technologies?

Yes, AI for cybersecurity is currently deployedwithin my company

37%

Yes, we plan to deploy AI for cybersecurity within
the next 12 months.

23%

We do not have a plan to deploy AI for
cybersecurity

40%

0%

Ponemon Institute© Research Report

5% 10% 15% 20% 25% 30% 35% 40% 45%

Page 17

Perceptions that AI could just be a gimmick is the number one challenge to investing in AIbased technologies. Figure 18 lists the various challenges to the adoption of AI. Fifty percent ofrespondents say when trying to gain support for the adoption of AI there is internal resistancebecause it is considered a gimmick. This is followed by the inability to recruit personnel with thenecessary expertise (49 percent of respondents) and the lack of time to integrate AI-based
technologies into security workflows.
Figure 18. What are the challenges to successfully deploying AI-based technologies?
Three responses permitted
There is internal resistance to the adoption of AI
because it is considered a gimmick50%

We can’t recruit personnel experienced in AIbased technologies

49%

There is not enough time to integrate AI-based
technologies into security workflows

45%

It requires too much staff to implement andmaintain AI-based technologies

42%

We don’t have the internal expertise to validate
vendors’ claims

35%

There is insufficient supervision and oversight ofAI learning and decision-making

26%

AI-based solutions create too many false alerts
and false positives

26%

There is insufficient budget for AI-based
technologies

25%

Other

2%
0%

Ponemon Institute© Research Report

10%

20%

30%

40%

50%

60%

Page 18

Automation and advanced technologies increase the ability to prevent cyberattacks.
According to Figure 19, 67 percent of respondents (30 percent + 37 percent) believes the use of
automation and advanced technologies would increase their organizations’ ability to prevent
cyberattacks. Further, 67 percent of respondents say their organizations expect to increase theirinvestment in these technologies as they mature.
Features that make automation desirable are the simplification of the process that detects andresponds to application security threats and vulnerabilities (65 percent of respondents) andeffectiveness in reducing false positives and alerts (61 percent of respondents). The challenges
with artificial intelligence are the difficulty in integrating AI-based security technologies with legacy
systems (53 percent of respondents) and the need to simplify and streamline their organizations
security architecture to obtain maximum value from AI-based security technologies (51 percent ofrespondents).
Figure 19. Perceptions about automation
Our organization’s investment in AI-based
security technologies is likely to increase as
these technologies become more mature

33%

34%

The use of automation and advanced
technologies would increase our ability to prevent
cyberattacks

30%

37%

The deployment of AI-based security
technologies simplifies the process of detecting
and responding to application security threats
and vulnerabilities

31%

34%

AI is effective in reducing false positives andfalse alerts

31%

30%

It is difficult to integrate AI-based security
technologies with legacy systems

28%

25%

Our organization needs to simplify andstreamline its security architecture to obtainmaximum value from AI-based security
technologies

25%

26%

AI-based security technologies are too immature
to provide maximum value for our SecOps team

19%

23%

Automation and advanced technologies will
decrease our reliance on its cybersecurity staff

18%

22%

0%

10% 20% 30% 40% 50% 60% 70% 80%

Strongly agree

Ponemon Institute© Research Report

Agree

Page 19

Deep learning is a form of AI and is inspired by the brain’s ability to learn. In the context of
this research, deep learning is defined as follows: once a human brain learns to identify an object,
its identification becomes second nature. Deep learning’s artificial brains consist of complex
neural networks and can process high amounts of data to get a profound and highly accurate
understanding of the data analyzed.
When asked what is the number one reason to adopt deep learning, respondents say it is tolower false positive rates (26 percent), increase detection rates (24 percent) and prevent
unknown firs-seen cyberattack (21 percent), as shown in Figure 20.
Figure 20. What would be your organization’s number one reason for incorporating a
deep-learning-based solution?
Only one response permitted
Lower false positive rates

26%

Increase detection rates

24%

Prevent unknown first-seen cyberattacks

21%

Increase automation capability

20%

Reduce IT security personnel

8%

Other

1%
0%

Ponemon Institute© Research Report

5%

10%

15%

20%

25%

30%

Page 20

Budget and investments in the cybersecurity lifecycle
Organizations are making investments in technology that do not strengthen theircybersecurity posture. According to Figure 21, 50 percent of respondents say theirorganizations are wasting limited budgets on investments that don’t improve their cybersecurity
posture.
Only 40 percent of respondents have sufficient budget to achieve a strong cybersecurity posture.
Thus, 60 percent are unsure or disagree that their organizations have enough resources toachieve a strong cybersecurity budget. As a consequence, an inadequate budget is preventing
organizations from having the in-house expertise to achieve a strong cybersecurity posture.
The average total IT budget is $94.3 million and of this 14 percent or approximately $13 million isallocated to IT security. Nineteen percent or approximately $2.5 million will be allocated toinvestments in enabling security technologies such as AI, machine learning, orchestration,
automation, blockchain and more.
Figure 21. Perceptions about budget and investment
Strongly agree and agree responses combined
My organization makes investments intechnologies that don’t improve its cybersecurity
posture25%

My organization has the in-house expertise toachieve a strong cybersecurity posture

20%

My organization has sufficient budget to achievea strong cybersecurity posture

17%

0%

10%

25%

21%

23%

20%

Strongly agree

Ponemon Institute© Research Report

30%

40%

50%

60%

Agree

Page 21More funding will be allocated to cybersecurity budgets over the next two years. As shownin Figure 22, 21 percent of respondents say their organizations increased the cybersecurity
budget significantly over the past two years. Funding will significantly increase over the next two
years, according to 31 percent of respondents.
Figure 22. How has your cybersecurity budget or spending levels changed in the past two
years and over the next two years?
35%

33%

31%

30%
25%

21%

24% 23%

23%

20%
15%

15%

17%

10%

7%

6%

5%
0%
Significant
increase (> 20%)

Increase

No change

Budget changes over the past two years

Decrease

Significant
decrease (< 20%)

Budget changes over the next two years

Organizations are relying upon return on investment (ROI) to justify investments followed by adecrease in false positive rates. Only 26 percent of respondents use the increased prevention
rate.
Figure 23. What metrics are most important to the cybersecurity technology investment?
Two responses permitted
Return on Investment (ROI)

45%

Decreased false positive rate

31%

Met compliance/regulatory mandates

29%

Increased detection rate

26%

Increased prevention rate

26%

Decreased security risk

17%

Decreased false negative rate

13%

Total Cost of Ownership (TCO)

13%
0%

Ponemon Institute© Research Report5%

10% 15% 20% 25% 30% 35% 40% 45% 50%

Page 22

Most often it is the IT and IT security function that owns and participates in determining
the cybersecurity budget. According to Figure 24, 59 percent of respondents say it is the
CIO/CTO who owns the cybersecurity budget followed by 45 percent of respondents who say it is
the IT security leader (CISO).
Figure 24. Who owns the cybersecurity budget?
Three responses permitted
CIO/CTO59%

IT security leader (CISO)

45%

Business unit leader

41%

SOC leader

37%

No one role has overall responsibility

34%

Incident response leader

26%

Security leader (CSO)

19%

Compliance

12%

Procurement

12%

Facilities or data center management5%

Law department

5%

COO/CFO

2%

Other

3%
0%

10%

20%

30%

40%

50%

60%

70%

According to Figure 25, 27 percent of respondents say the budget is a set percentage of the total
IT budget and 26 percent of respondents say it is based on an assessment of their organizations’security risks.
Figure 25. How does your organization determine its cybersecurity budget?
The budget is a set percentage of the total IT
budget27%

The budget is based on an assessment of ourorganization’s security risks

26%

Senior management determines the budget

24%

The budget is based on what the organization
feels is the right amount21%

Ponemon Institute© Research Report

23%

22%

23%

24%

25%

26%

27%

28%

Page 23

While the ability to prevent cyberattacks is believed to improve the cybersecurity posture oforganizations and reduce the cost of incurred because of cyberattacks, only 21 percent of thebudget is allocated to prevention. The greatest percentage of the budget is allocated tocontainment, as shown in Figure 26.
Figure 26. How does your organization allocate its budget for the five phases of thecybersecurity lifecycle?
35%
30%

29%
26%

25%
21%
20%
14%

15%

10%

10%
5%
0%
Containment

Detection

Ponemon Institute© Research Report

Prevention

RecoveryRemediation

Page 24Complexity and lack of in-house expertise are the primary reasons investments do notmeet expectations. As discussed previously, organizations are making investments intechnologies that are not strengthening their organizations’ cybersecurity posture. As shown in
Figure 27, system complexity issues, lack of in-house expertise and vendor support issues are
the primary reasons.
Figure 27. Why investments in technology do not meet expectations
More than one response permitted
System complexity issues

50%

Personnel issues (lack of in-house expertise)48%

Vendor support issues

45%

Higher than expected installation costs

44%

Interoperability issues

36%

Higher than expected licensing cost

36%

Higher than expected maintenance cost

31%

System performance issues (degradation)

29%

System effectiveness issues (high false positive)

27%

Other

2%

All investments met our organization’s
expectations

28%
0%

Ponemon Institute© Research Report

10%

20%

30%

40%

50%

60%

Page 25

Part 3. Methods
A sampling frame of 16,771 IT and IT security professionals who are knowledgeable about theirorganizations’ cybersecurity technologies and processes were selected as participants in thissurvey. Table 2 shows 701 total returns. Screening and reliability checks required the removal of
67 surveys. Our final sample consisted of 634 surveys, or a 3.8 percent response rate.
Table 2. Sample response
Sampling frame
Total returns
Rejected or screened surveys
Final sample

FY202016,771
701
67
634

Pct%
100.0%
4.2%
0.4%
3.8%

The following pie chart summarizes the position level of qualified respondents. At 33 percent, thelargest segment contains those who are rank-and-file level employees (e.g., technicians or
analysts). The smallest segment (1 percent) includes contractors. More than half (61 percent) ofrespondents are at or above the supervisory level.
Pie Chart 1. Position level of respondents
5% 1%3%

5%
Senior Executive
17%

Vice President
Director

33%

ManagerSupervisor
Technician
21%

Staff / Analyst
Contractor

15%

Ponemon Institute© Research Report

Page 26

As shown in Pie Chart 2, 24 percent of respondents described their primary role as IT
management, 21 percent of respondents are in SOC management, 13 percent of respondents
are in security engineering and 12 percent of respondents identified their role as application
security.
Pie Chart 2. Primary role within the organization
2%

6%
6%

IT management

24%

SOC management
8%

Security engineering
Application security
Security architecture

8%

Risk management
Quality assurance
21%

12%

Compliance/audit
Other

13%

Pie Chart 3 shows the percentage distribution of respondents’ companies across 14 industries.
Financial services represents the largest industry sector (at 18 percent of respondents), which
includes banking, insurance, brokerage, investment management and payment processing. Other
large verticals include public services, health and pharma, industrial and manufacturing, andservices.
Pie Chart 3. Primary industry sector of respondents’ companies
2% 3%
2%2%
3%

18%

6%
7%

11%

8%
10%
8%
10%

10%

Ponemon Institute© Research Report

Financial services
Public sector
Health & pharmaceuticals
Industrial & manufacturing
Services
RetailTechnology & software
Energy & utilities
Consumer goods
Communications
Entertainment & media
Hospitality
Transportation
Other

Page 27

Pie Chart 4 summarizes the total worldwide headcount of respondents’ companies. In the context
of this study, headcount serves as an indicator of size. At 20 percent, the largest segment
contains larger-sized organizations with 5,001 to 25,000 full-time equivalent employees. The
smallest segment (8 percent) includes larger-sized organizations with 75,000 or more employees.
More than half of respondents are from organizations with a global headcount greater than 1,000
employees.
Pie Chart 4. Global headcount of respondents’ organization

11%

8%
More than 75,000 employees

10%

18%

25,001 to 75,000 employees
5,001 to 25,000 employees
1,001 to 5,000 employees

15%

501 to 1,000 employees
18%

100 to 500 employees
Less than 100 employees

20%Part 4. Caveats to this study
There are inherent limitations to survey research that need to be carefully considered before
drawing inferences from findings. The following items are specific limitations that are germane tomost Web-based surveys.
<<<

Non-response bias: The current findings are based on a sample of survey returns. We sent
surveys to a representative sample of individuals, resulting in a large number of usable
returned responses. Despite non-response tests, it is always possible that individuals who did
not participate are substantially different in terms of underlying beliefs from those whocompleted the instrument.
Sampling-frame bias: The accuracy is based on contact information and the degree to which
the list is representative of individuals who are knowledgeable about their organizations’cybersecurity technologies and processes. Because we used a Web-based collection
method, it is possible that non-Web responses by mailed survey or telephone call would
result in a different pattern of findings.
Self-reported results: The quality of survey research is based on the integrity of confidential
responses received from subjects. While certain checks and balances can be incorporated
into the survey process, the possibility remains that a subject did not provide accurate
responses.

Ponemon Institute© Research Report

Page 28

Appendix: Detailed Survey Results
The following tables provide the frequency or percentage frequency of responses to all survey
questions contained in this study. All survey responses were captured between December 11,
2019 to December 23, 2019.
Survey Response
Total sampling frame
Total returns
Rejected surveys
Final sample

Freq
16771
701
67
634

Pct%
100.0%
4.2%
0.4%
3.8%

Part 1. Screening questions
S1. What best describes your knowledge of cybersecurity technologies
and processes deployed in your organization?
Very knowledgeable
Knowledgeable
Some knowledge
No knowledge (stop)
Total
S2. What best describes your role within your organization’s
cybersecurity function? Please select all that apply.
Defining strategy
Setting standards
Obtaining resources
Hunting for threats
Educating personnel
Conducting assessments
Testing controls
Operating the SOC
Leading security teams
Evaluating performance
Securing the IT infrastructure
Implementing security technologies
Maintaining security technologies
Communicating with c-level and/or board
None of the above (stop)
Total

Ponemon Institute© Research Report

Pct%
41%
44%
15%
0%
100%

Pct%
38%
35%
41%
55%
29%
58%
50%
43%
57%
34%
48%
60%
63%
21%
0%
632%

Page 29

S3. What percentage of your job is dedicated to cybersecurity
activities?
Less than 20% (stop)
20% to 40%
41% to 60%
61% to 80%
81% to 99%
100% fully dedicated
Total

Pct%
0%
15%
13%
24%
17%
31%
100%

Part 2. BackgroundQ1a. How effective is your organization’s ability to prevent acyberattack on a scale of 1 = not effective to 10 = highly effective?

Pct%

1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

8%
19%
27%
26%
20%
100%
6.12

Q1b. How difficult is it to prevent a cyberattack on a scale of 1 = notdifficult to 10 = highly difficult?

Pct%

1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

0%
1%
19%
33%
47%
100%
8.02

Q2a.How effective is your organization’s ability to detect a cyberattack
on a scale of 1 = not effective to 10 = highly effective?

Pct%

1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

11%
9%
31%
25%
24%
100%
6.34

Ponemon Institute© Research Report

Page 30

Q2b.How difficult is it to detect a cyberattack on a scale of 1 = notdifficult to 10 = highly effective?
1 or 2Pct%

3 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

2%
4%
18%
32%
44%
100%
7.74

Q3a. How effective is your organization’s ability to contain acyberattack on a scale of 1 = not effective to 10 = highly effective?

Pct%

1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

11%
9%
25%
29%
26%
100%
6.50

Q3b. How difficult is it to contain a cyberattack on a scale of 1 = notdifficult to 10 = very difficult?

Pct%

1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

6%
8%
10%
36%
40%
100%
7.42

Q4a. How effective is your organization’s ability to recover from acyberattack on a scale of 1 = not effective to 10 = highly effective?

Pct%

1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Ponemon Institute© Research Report

9%
16%
29%
25%
21%
100%
6.16

Page 31

Q4b. How difficult is it to recover from a cyberattack on a scale of 1 =not difficult to 10 = Very difficult?
1 or 2Pct%

3 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

2%
7%
12%
34%
45%
100%
7.76

Q5a. How effective is your organization’s ability to remediate after acyberattack on a scale of 1 = not effective to 10 = highly effective?

Pct%

1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

13%
12%
29%
24%
22%
100%
6.10

Q5b. How difficult is it to remediate after a cyberattack on a scale of 1
= not difficult to 10 = very difficult?

Pct%

1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

2%
5%
18%
32%
43%
100%
7.68

Ponemon Institute© Research Report

Page 32

Attributions: Please rate each one of the following statements using
the scale provided below each item. Strongly agree and Agreeresponse combined.
Q6a. My organization has sufficient budget to achieve a strong
cybersecurity posture.

Strongly agree

Agree

17%

23%

20%

21%

40%

36%

32%

33%

34%

36%

Q6f. The use of automation and advanced technologies would
increase our organization’s ability to prevent cyberattacks.

30%

37%

Q6g. Automation and advanced technologies will decrease ourorganization’s reliance on its cybersecurity staff.

18%

22%

Q6h. My organization makes investments in technologies that don’t
improve its cybersecurity posture.

25%

25%

Q6b. My organization has the in-house expertise to achieve a strong
cybersecurity posture.
Q6c. My organization focuses on the detection of cyberattacks because
prevention is perceived to be too difficult to achieve.
Q6d. My organization believes the prevention of attacks is impossible toachieve.
Q6e. The ability to prevent cyberattacks would strengthen our
cybersecurity posture.

Q7. What best describes the maturity level of your organization’s
cybersecurity program or activities?

Pct%

Early stage – many cybersecurity program activities have not as yet
been planned or deployed20%

Middle stage – cybersecurity program activities are planned but only
partially deployed30%

Late-middle stage – many cybersecurity program activities are mostly
deployed across the organization

29%

Mature stage – most cybersecurity program activities are successfully
deployed, maintained and/or refined across the organization.
Total
Q8. What are the top security threats affecting your organization?
Please select your top three choices.
Phishing attacks
System failures
Active adversaries
Web-based attacks
Ransomware
Fileless attacks
DNS-based attacks
Denial of service attacks
Electronic agents (viruses, bots and more)
Nation-state, terrorist or criminal syndicate sponsored attacks
Other (please specify)
Total

Ponemon Institute© Research Report

21%
100%

Pct%
47%
15%
25%
26%
32%
22%
40%
34%
35%
21%
3%
300%

Page 33

Q9. What are the top security vulnerabilities affecting yourorganization? Please select your top two choices.
Negligent insiders
System failures
Social engineering
Insecure applications
Insecure endpoints
Insecure cloud platform
Third-party error
Other (please specify)
Total
Q10a. Does your organization presently deploy, or plan to deploy, AIbased security technologies?
Yes, AI for cybersecurity is currently deployed within my company
Yes, we plan to deploy AI for cybersecurity within the next 12 months.
We do not have a plan to deploy AI for cybersecurity (please skip to
Q11)
Total
Q10b. If yes, what are the challenges to successfully deploying AIbased security technologies within your organization? Please selectyour top three choices.
It requires too much staff to implement and maintain AI-based
technologies
AI-based solutions create too many false alerts and false positives

Pct%
40%
25%
19%
24%
35%
18%
36%
3%
200%

Pct%
37%
23%
40%
100%

Pct%
42%
26%

There is not enough time to integrate AI-based technologies into
security workflows
We can’t recruit personnel experienced in AI-based technologies
We don’t have the internal expertise to validate vendors’ claims
There is insufficient budget for AI-based technologies
There is insufficient supervision and oversight of AI learning anddecision-making
There is internal resistance to the adoption of AI because it isconsidered a gimmick
Other (please specify)
Total
Q10c. If yes, is it possible to have a high detection rate without affecting
the productivity of your organization’s IT security team?
Yes
No
UnsureTotal

Ponemon Institute© Research Report

45%
49%
35%
25%
26%
50%
2%
300%

Pct%
48%
49%
3%
100%

Page 34

Q11. What would be your organization’s number one reason forincorporating a deep learning-based solution?
Prevent unknown first-seen cyberattacks
Increase automation capability
Reduce IT security personnel
Increase detection rates
Lower false positive rates
Other (please specify)
Total
Attributions: Please rate each one of the following statements using
the scale provided below each item. Strongly agree and Agreeresponses
Q12a. The deployment of AI-based security technologies simplifies theprocess of detecting and responding to application security threats andvulnerabilities.
Q12b. Our organization needs to simplify and streamline its security
architecture to obtain maximum value from AI-based security
technologies.
Q12c. AI-based security technologies are too immature to provide
maximum value for our SecOps team.

Pct%
21%
20%
8%
24%
26%
1%
100%

Strongly agree

Q12d. It is difficult to integrate AI-based security technologies withlegacy systems.
Q12e. Our organization’s investment in AI-based security technologies
is likely to increase as these technologies become more mature.
Q12f. AI is effective in reducing false positives and false alerts.

Agree

31%

34%

25%

26%

19%

23%

28%

25%

33%
31%

34%
30%

Part 3. Cybersecurity budget
Q13. What metrics are most important to the security technology
investment decision? Please select the top two.
Return on Investment (ROI)
Total Cost of Ownership (TCO)
Decreased security risk
Increased prevention rate
Increased detection rate
Decreased false positive rate
Decreased false negative rate
Met compliance/regulatory mandates
Other (please specify)
Total

Ponemon Institute© Research Report

Pct%
45%
13%
17%
26%
26%
31%
13%
29%
0%
200%

Page 35

Q14. Who within your organization “owns” the cybersecurity budget?
Please select the top three choices.
CEO
COO/CFO
CIO/CTO
Procurement
IT security leader (CISO)
Security leader (CSO)
Compliance
Law department
Business unit leader
SOC leader
Incident response leader
Facilities or data center management
No one role has overall responsibility
Other (please specify)
Total
Q15. What best describes your organization’s approach to determining
the cybersecurity budget? Please select the one best choice.
The budget is a set percentage of the total IT budget
The budget is based on an assessment of our organization’s security
risks
Senior management determines the budget
The budget is based on what the organization feels is the right amount
Total
Q16. What is your organization’s total IT budget?
Less than $100,000$100,00 to $500,000$500,001 to $1,000,000$1,000,000 to $5,000,000$5,000,001 to $10,000,000$10,000,001 to $50,000,000$50,000,001 to $100,000,000$100,000,001 to $250,000,000$250,000,001 to $500,000,000
More than $500,000,000
Total
Extrapolated value

Ponemon Institute© Research Report

Pct%
0%
2%
59%
12%
45%
19%
12%
5%
41%
37%
26%
5%
34%
3%
300%

Pct%
27%
26%
24%
23%
100%
Pct%
0%
0%
2%
7%
19%
23%
25%
15%
5%
4%
100%
$ 94,300,000

Page 36

Q17. Approximately, what percentage of the current year’s IT budget
will go to IT security activities?
Less than 1%
1% to 2%
3% to 5%
6% to 10%
11% to 15%
16% to 20%
21% to 30%
31% to 40%
41% to 50%
More than 50%
Total
Extrapolated value
Q18. Approximately, what percentage of the current year’s IT security
budget will be invested in enabling security technologies such as AI,
machine learning, orchestration, automation, blockchain and more?
Less than 1%
1% to 2%
3% to 5%
6% to 10%
11% to 15%
16% to 20%
21% to 30%
31% to 40%
41% to 50%
More than 50%
Total
Extrapolated value
Q19. The following table lists the five phases of the cybersecurity life
cycle. Please allocate all 100 points to describe how your organization
currently spends budgeted resources for the five phases.
Prevention
Detection
Containment
RecoveryRemediation
Total (sum to 100 points)

Ponemon Institute© Research Report

Pct%
2%
6%
14%
19%
21%
19%
11%
5%
3%
0%
100%
14%

Pct%
0%
0%
9%
16%
19%
22%
18%
8%
5%
3%
100%
19%

Points
21
26
29
14
10
100

Page 37

Q20a. How has your organization’s cybersecurity budget or spending
levels changed over the past two years?
Significant increase (> 20%)
Increase
No change
Decrease
Significant decrease (< 20%)Total
Q20b. In your opinion, how will your organization’s cybersecurity
budget or spending levels change over the next two years?
Significant increase (> 20%)
Increase
No change
Decrease
Significant decrease (< 20%)
Total
Q21. Did your organization make any investments in security
technologies that fell below your expectations (i.e. regrets) for any of
the following reasons? Please check all that apply.
Higher than expected licensing cost
Higher than expected maintenance cost
Higher than expected installation costs
System performance issues (degradation)
System effectiveness issues (high false positive)
System complexity issues
Personnel issues (lack of in-house expertise)Interoperability issues
Vendor support issues
Other (please specify)
All investments met our organization’s expectations
Total

Ponemon Institute© Research Report

Pct%
21%
24%
33%
15%
7%
100%

Pct%
31%
23%
23%
17%
6%
100%

Pct%
36%
31%
44%
29%
27%
50%
48%
36%
45%
2%
28%
376%

Page 38

Q22. Please indicate the impact of each technology on yourorganization’s ability to prevent cyber attacks using the following 5point scale: 5 = very high impact, 4 = high impact, 3 = moderate
impact, 2 = low impact and 1 = very low impact
Access governance systems
Anti-malware
Anti-DDoS
Automated code review or debugger
Analytics for security modellingContent aware firewalls (NGFW or UTM)
Data loss prevention (DLP)
Database activity monitoring
Database scanning
Digital certificate management
Encryption of data at rest
Encryption of data in motion
Endpoint detection & response (EDR)
Hardware security modules (HSM)
Identity & access management systems
Incident & event management (SIEM)
Intrusion detection / prevention
Network traffic intelligence
Location surveillance systems
Privileged access management (PAM)
Public key infrastructure (PKI)
Sandbox or isolation capabilities
User behavior activity monitoring
Virtual private network (VPN)
Web & email content filtering
Web application firewalls (WAF)
Average

Impact score
4.1
2.8
2.4
1.0
1.9
2.1
2.7
3.0
3.2
3.6
3.2
2.9
3.0
1.9
3.5
4.4
4.6
4.2
1.4
3.9
3.9
3.1
4.1
1.8
2.0
3.8
3.0

Part 4. Mobile security
Q23a. Does your organization allow the use of personal mobile devices
in the workplace (e.g. BYOD)?
Yes
No (skip to Q26)
Total
Q23b. If yes, what type of mobile device is allowed? Please select onlyone.
Personal mobile device (e.g. BYOD)
Corporate office sanctioned device
A combination of both
Total

Ponemon Institute© Research Report

Pct%
54%
46%
100%

Pct%
44%
35%
21%
100%

Page 39

Q24. What percentage of employees use their mobile device for work?
Less than 10 percent
10 percent to 25 percent
26 percent to 50 percent
51 percent to 75 percent
76 percent to 100 percent
Total
Extrapolated value
Q25a. Does your organization take steps to protect its information
assets on employees’ mobile phones?
Yes
No
Total
Q25b. If yes, how does your organization secure mobile devices usedby employees in the workplace? Please select all that apply.
Active sync only
Encryption of stored or transmitted data
Mobile hypervisors
Secure containers
Mobile device management
Enterprise mobility management platform
Other (please specify)
Total

Pct%
14%
21%
32%
19%
14%
100%
41%

Pct%
39%
61%
100%

Pct%
37%
41%
25%
32%
37%
40%
2%
214%

Part 5. Attacks in the cybersecurity lifecycle
Q26. Currently, what percentage of all attacks can your organization
prevent pre-execution?
Less than 1%
1% to 2%
3% to 5%
6% to 10%
11% to 15%
16% to 20%
21% to 30%
31% to 40%
41% to 50%
More than 50%
Total
Extrapolated value

Ponemon Institute© Research Report

Pct%
0%
0%
3%
7%
8%
11%
12%
12%
26%
21%
100%
0.34

Page 40

Q27. Currently what percentage of all attacks can your organization
detect and respond on execution/post infection?
Less than 1%

Pct%

1% to 2%
3% to 5%
6% to 10%
11% to 15%
16% to 20%
21% to 30%
31% to 40%
41% to 50%
More than 50%
Total
Extrapolated value

2%
0%
3%
7%
5%
4%
11%
8%
27%
33%
100%
0.38

Q28. What are the barriers to preventing a cyberattack? Please checkall that apply.

Pct%

Lack of in-house expertise
Technologies are outdated or insufficient
Takes too long to identify an attack
Our devices are not connected to the network or Internet
The false positive rate is too high
Other (please specify)
Total
Q29. What is the average Mean Time to Contain (MTTC) a cyberattack
Less than 1 week
1 to 2 weeks
3 to 4 weeks
5 to 6 weeks
7 to 8 weeks
9 to 10 weeks
More than 10 weeks
Total
Extrapolated value (weeks)
Q30. What solutions do you currently use to prevent cyberattacks?
Please select your top two choices.
Signature-based antivirus
Machine learning anti-virus
Endpoint detection and response
Encryption
Hardening
Isolation
Other (please specify)
Total

Ponemon Institute© Research Report

55%
59%
63%
29%
49%
4%
259%
Pct%
2%
6%
8%
12%
20%
27%
25%
100%
8.11

Pct%
37%
28%
44%
37%
20%
31%
3%
200%

Page 41

Q31. What technology features are important in the prevention of
cyberattacks? Please select all that apply.

Pct%

Ability to be predictive

54%
71%
64%
60%
49%
61%

Ability to prevent attacks in real-time
Ability to prevent attacks based on different types of files
Ability to prevent fileless attacks
Cross-operating system protection (not just Windows)
Minimize false positives
Domain agnostic and can be inserted on mobile devices, endpoints andservers
Ability to prevent zero-day attacks
Other (please specify)
Total

60%
62%
5%
486%

Q32a. Did your organization have a phishing attack in the past year?
Yes

Pct%
79%
21%
100%

No (Skip to 33a)
Total
Q32b. If yes, in what stage of the cybersecurity lifecycle were you able
to deal with the attack?

Pct%

Prevention
Detection
Containment
RecoveryRemediation
Total

18%
20%
30%
20%
12%
100%

Q32c. Please estimate the total cost incurred by your company as aresult of this phishing attack.
Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,000 to $5,000,000$5,000,001 to $10,000,000
More than $10,000,000
Total
Extrapolated value

Ponemon Institute© Research Report

Pct%
12%
30%
34%
12%
9%
3%
1%
101%
$

832,500

Page 42Q32d. Please estimate the cost savings if your organization prevented
the phishing attack.

Pct%

Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,001 to $5,000,000
More than $5,000,000
Total
Extrapolated value

31%
36%
18%
15%
0%
0%
100%
$

Q33a. Did your organization have a zero-day attack in the past year?
Yes
No (skip to Q34a)
Total

Pct%
52%
48%
100%

Q33b. If yes, in what stage of the cybersecurity lifecycle were you able
to deal with the zero-day attack?

Pct%

Prevention
Detection
Containment
RecoveryRemediation
Total

12%
15%
42%
21%
10%
100%

Q33c. Please estimate the total cost incurred by your company as aresult of this zero-day attack.
Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,000 to $5,000,000$5,000,001 to $10,000,000
More than $10,000,000
Total
Extrapolated value

Pct%
5%
17%
23%
32%
19%
3%
1%
100%
$

Q33d. Please estimate the cost savings if your organization prevented
the zero-day attack.
Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,001 to $5,000,000
More than $5,000,000
Total
Extrapolated value

Ponemon Institute© Research Report

201,250

1,238,000

Pct%
13%
23%
29%
25%
4%
6%
100%
$

775,000

Page 43

Q34a. Did your organization have a spyware attack in the past year?
Yes
No (skip to Q35a)
Total

Pct%
37%
63%
100%

Q34b. If yes, in what stage of the cybersecurity lifecycle were you able
to deal with the spyware attack?

Pct%

Prevention
Detection
Containment
RecoveryRemediation
Total

26%
29%
20%
13%
12%
100%

Q34c. Please estimate the total cost incurred by your company as aresult of this spyware attack.
Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,000 to $5,000,000$5,000,001 to $10,000,000
More than $10,000,000
Total
Extrapolated value

Pct%
18%
30%
29%
11%
9%
3%
0%
100%
$

Q34d. Please estimate the cost savings if your organization prevented
the spyware attack.
Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,001 to $5,000,000
More than $5,000,000
Total
Extrapolated value
Q35a. Did your organization have a ransomware attack in the past
year?
Yes
No (skip to 36a)
Total

Ponemon Institute© Research Report

691,500

Pct%
21%
40%
33%
6%
0%
0%
100%
$

179,250

Pct%
23%
77%
100%

Page 44

Q35b. If yes, in what stage of the cybersecurity lifecycle were you able
to deal with the ransomware attack?

Pct%

Prevention

10%
23%
35%
17%
15%
100%

Detection
Containment
RecoveryRemediation
Total
Q35c. Please estimate the total cost incurred by your company as aresult of this attack.
Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,000 to $5,000,000$5,000,001 to $10,000,000
More than $10,000,000
Total
Extrapolated value

Pct%
20%
25%
34%
16%
4%
1%
0%
100%
$

Q35d. Please estimate the cost savings if your organization prevented
the ransomware attack.
Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,001 to $5,000,000
More than $5,000,000
Total
Extrapolated value
Q36a. Did your organization have a nation-state attack in the past
year?
Yes
No (skip to Q37)
Total
Q36b. If yes, in what stage of the cybersecurity lifecycle were you able
to deal with the nation-state attack?
Prevention
Detection
Containment
RecoveryRemediation
Total

Ponemon Institute© Research Report

440,750

Pct%
19%
42%
31%
8%
0%
0%
100%
$

189,250

Pct%
18%
82%
100%

Pct%
9%
19%
29%
23%
20%
100%

Page 45

Q36c. Please estimate the total cost incurred by your company as aresult of this nation-state attack.

Pct%

Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,000 to $5,000,000$5,000,001 to $10,000,000
More than $10,000,000
Total
Extrapolated value

0%
8%
21%
41%
26%
3%
1%
100%
$

Q36d. Please estimate the cost savings if your organization prevented
the ransomware attack.
Less than $50,000$50,000 to $100,000$100,001 to $500,000$500,001 to $1,000,000$1,000,001 to $5,000,000
More than $5,000,000
Total
Extrapolated value
Part 5. The Cyber Kill Chain and zero-day attacks
Q37. How familiar are you with the term Cyber Kill Chain?
Very familiar
Familiar
Not familiar
No knowledge (Skip to Part 6)
Total
Q38a. How important is the Cyber Kill Chain framework for preventing azero-day attack? 1 = not important to 10 = very important.
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Ponemon Institute© Research Report

1,501,500

Pct%
2%
14%
37%
26%
18%
3%
100%
$

1,037,000

Pct%
32%
36%
17%
15%
100%

Pct%
5%
9%
18%
33%
35%
100%
7.18

Page 46

Q38b. In your opinion, how difficult is it to prevent a zero-day attack
during the Reconnaissance phase of the kill chain? 1 = not difficult to
10 = very difficult.
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q38c. In your opinion, how difficult is it to prevent a zero-day attack in
the Weaponization phase of the kill chain? 1 = not difficult to 10 = very
difficult1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q38d. In your opinion, how difficult is it to prevent a zero-day attack
during the Delivery phase of the kill chain? 1 = not difficult to 10 = very
difficult1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q38e. In your opinion, how difficult is it to prevent a zero-day attack
during the Exploitation phase of the kill chain? 1 = not difficult to 10 =very difficult
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

Ponemon Institute© Research Report

Pct%
5%
6%
18%
31%
40%
100%
7.40

Pct%
3%
6%
17%
30%
44%
100%
7.62

Pct%
1%
5%
16%
37%
41%
100%
7.74

Pct%
7%
8%
12%
29%
44%
100%
7.40

Page 47

Q38f. In your opinion, how difficult is it to prevent a zero-day attack
cyberattacks during the Installation phase of the kill chain? 1 = notdifficult to 10 = very difficult
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q38g. In your opinion, how difficult is it to prevent a zero-day attack
during the C2 phase of the kill chain? 1 = not difficult to 10 = very
difficult1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Q38h. In your opinion, how difficult is it to prevent a zero-day attack
during the Actions on Objectives phase of the kill chain? 1 = not difficult
to 10 = very difficult
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value
Part 6. Demographics
D1. What organizational level best describes your current position?
Senior Executive
Vice President
Director
ManagerSupervisor
Technician
Staff / Analyst
Contractor
Other
Total

Ponemon Institute© Research Report

Pct%
4%
11%
12%
29%
44%
100%
7.46

Pct%
3%
5%
12%
41%
39%
100%
7.66

Pct%
2%
6%
16%
30%
46%
100%
7.74

Pct%
3%
5%
17%
21%
15%
33%
5%
1%
0%
100%

Page 48

D2. What best describes your primary role in the organization?
Application security
Security architecture
IT management
SOC management
Quality assurance
Compliance/audit
Risk management
Security engineering
Other
Total

Pct%

D3. What industry best describes your organization’s industry focus?
Agriculture & food services
Communications
Consumer goods
Defense & aerospace
Energy & utilities
Entertainment & media
Financial services
Health & pharmaceuticals
Hospitality
Industrial & manufacturing
Public sector
RetailServicesTechnology & software
Transportation
Other
Total

Pct%

D4. What is the worldwide headcount of your organization?
Less than 100 employees
100 to 500 employees
501 to 1,000 employees
1,001 to 5,000 employees
5,001 to 25,000 employees
25,001 to 75,000 employees
More than 75,000 employees
Total

Pct%

Ponemon Institute© Research Report

12%
8%
24%
21%
6%
6%
8%
13%
2%
100%

1%
3%
6%
1%
7%
2%
18%
10%
2%
10%
11%
8%
10%
8%
2%
1%
100%

11%
10%
15%
20%
18%
18%
8%
100%

Page 49

For more information about this study, please contact Ponemon Institute by sending anemail to research@ponemon.org or call at 1.800.887.3118.

Ponemon Institute
Advancing Responsible Information Management
Ponemon Institute is dedicated to independent research and education that advances responsible
information and privacy management practices within business and government. Our mission is to conduct
high quality, empirical studies on critical issues affecting the management and security of sensitive
information about people and organizations.
We uphold strict data confidentiality, privacy and ethical research standards. We do not collect any
personally identifiable information from individuals (or company identifiable information in our businessresearch). Furthermore, we have strict quality standards to ensure that subjects are not asked extraneous,
irrelevant or improper questions.

Ponemon Institute© Research Report

Page 50