November 20182018 State of Cybersecurity in
Small & Medium Size Businesses
Sponsored by Keeper Security, Inc.
Independently conducted by Ponemon Institute LLC

Ponemon Institute © 2018 Research Report2018 State of Cybersecurity in Small & Medium Size Businesses (SMBs)
Ponemon Institute, November 2018
Part 1. Executive summary
Small businesses increasingly face the same cybersecurity risks as larger companies, but only 28
percent of the companies represented in this study rate their ability to mitigate threats,vulnerabilities and attacks as highly effective. Most participants in this research say attacks
against their companies are targeted andsophisticated with severe financial
Figure 1. Our company experienced a cyber attack andconsequences. According to this study’s
data breach in the past 12 months
findings, the weakest link in theseYes responses
companies’ security posture is thenegligent insider or contractor as they
are considered the number one reason acompany can have a data breach,phishing attack or a ransomware attack.
Ponemon Institute is pleased to present
the results of The 2018 State ofCybersecurity in Small and Medium SizeBusinesses sponsored by Keeper
Security. The goal of this study is to track
how small and medium size companies
address the same threats faced by larger
companies. This report features thefindings from 2018 and 2017.
This research’s sample included approximately 1,045 individuals from companies in the UnitedStates and the United Kingdom; these companies had head counts ranging from less than 100 to
1,000. In this report, we present the consolidated findings for 2017 and 2018.
As Figure 1 illustrates, cyber attacks on SMBs have increased from 61 percent of respondents in2017 to 67 percent of respondents in 2018. The occurrence of data breaches involving customer
and employee information over 12 months also increased from 54 percent of respondents to 58
percent of respondents.
In the aftermath of these incidents, the respondents’ companies spent an average of $1.43
million, a 33 percent increase from $1.03 million in 2017, because of the damage or theft of IT
assets. In addition, disruption to normal operations cost an average of $1.56 million, a 25 percent
increase from $1.21 million in 2017.
Following are the most salient findings of this research.
§

Phishing attacks and advanced malware/zero day attacks are increasing. Respondents
reported phishing/social engineering attacks increased from 48 percent in 2017 to 52 percent
in 2018 and advanced malware/zero day attacks increased from 16 percent to 24 percent.

§

The risk of negligent employees and contractors causing a data breach or ransomware isgetting worse. Sixty percent of respondents in companies that had a data breach say the root
cause of the data breach was a negligent employee or contractor, an increase from 54
percent in 2017. Sixty-one percent of respondents say negligent employees put theircompany at risk for a ransomware attack, an increase from 58 percent of respondents in2017.

Ponemon Institute© Research Report

Page 1§More companies are affected by exploits and malware that evaded their intrusion detection
system (72 percent of respondents) or anti-virus solution (82 percent of respondents).

§

Mobile devices are the most vulnerable endpoints or entry points to networks and enterprisesystems, according to 55 percent of respondents. Almost half (49 percent) of respondents
say the use of mobile devices to access business-critical applications and IT infrastructure
affects their companies’ security posture.

§

More companies have experienced ransomware attacks (61 percent of respondents vs. 52
percent of respondents in 2017) and 70 percent of respondents in these companies reportthat the ransom was paid. The average payment in these cases was $1,466.

§

To strengthen their cybersecurity postures, companies need more in-house expertise andbudget. However, almost half (47 percent) of respondents say they have no understanding of
how to protect their companies against cyber attacks.

§

Responsibility for determining IT security priorities is dispersed throughout the company. As aresult, the ability to have effective leadership in the IT security function is missing in mostcompanies. In fact, 35 percent of respondents say no one function determines IT security
priorities.

§

Passwords are often compromised or stolen because employees use weak passwords. Forty
percent of respondents say their companies experienced an attack involving the compromiseof employees’ passwords; the average cost of each attack was $383,365.

§

A lack of visibility into employees’ password practices is exacerbating the likelihood of attacks
involving passwords. Protection of passwords mostly involves human memory (53 percent ofrespondents) and spreadsheets (51 percent of respondents). Only 18 percent of respondents
say their organizations rely upon browser extensions.

§

More companies are using single sign-on (SSO) to simplify and increase the security of user
access to their companies’ applications and data.

Ponemon Institute© Research Report

Page 2

Part 2. Key findings
•
•
•
•
•

Trends in SMB cyber attacks and data breaches
Ransomware attacks continue to increase
Password practices and policies
Cybersecurity posture and governanceTechnologies in place to address the threat

Trends in SMB cyber attacks and data breaches
Cyber attacks and data breaches target SMBs. As discussed, most businesses represented inthis study experienced a cyber attack or a data breach with severe financial consequences (67percent and 58 percent, respectively). As shown in Figure 2, phishing/social engineeringcontinues to be the number one attack SMBs experience (52 percent of respondents). Other
frequent attacks are web-based attacks and general malware (47 percent and 37 percent ofrespondents, respectively). The type of attack that increased the most is advanced malware/zero
day attacks (from 16 percent of respondents in 2017 to 24 percent of respondents in 2018).
Figure 2. What types of attacks did your business experience?
More than one choice allowed

48%
52%

Phishing/social engineering

43%
47%

Web-based attack
36%
37%

General malware

30%
34%

Compromised/stolen devices

26%
26%

Denial of services
16%

Advanced malware/zero day attacks
SQL injection

20%

24%

11%
12%

Malicious insider

10%
9%

Cross-site scripting
3%
4%

Other
0%

Ponemon Institute© Research Report

24%

10%

20%

FY 2017

FY 2018

30%

40%

50%

60%

Page 3

Businesses are losing more records in a data breach. Companies represented in thisresearch lost an average of 10,848 individual records over the past 12 months as a result of thedata breach, an increase from an average of 9,350 in last year’s study.
As shown in Figure 3, of the 58 percent of respondents who say their company had a data
breach, they cite the root cause as negligent employees or contractors (60 percent ofrespondents), which increased from 54 percent in 2017. This is followed by third party mistakes(43 percent of respondents) and external (hacker) attacks (37 percent of respondents). However,almost a third of respondents (31 percent) say their companies could not determine the cause of
the incident.
Figure 3. What was the root cause of the data breaches your business experienced?
More than one choice allowed

54%

Negligent employee or contractor
43%
43%

Third party mistakes
33%
37%

External (hacker) attacks

34%
30%

Error in system or operating process
7%
7%

Malicious insider

32%
31%

Don’t know
2%
1%

Other
0%

10%
FY 2017

Ponemon Institute© Research Report

60%

20%

30%

40%

50%

60%

70%

FY 2018

Page 4

Businesses are most concerned about protecting customer records and intellectual
property. When asked what information cyber attackers are most likely to target, 57 percent ofrespondents say customer records are their biggest concern. More than half of respondents (51percent) say they worry about the protection of their intellectual property.
Figure 4. What types of information are you most concerned about protecting from cyberattackers?
Two choices allowed

Customer records

57%

63%

48%
51%

Intellectual property
37%
40%

Customer credit or debit card information
26%
28%

Financial information
16%
15%

Employee records
8%
8%Business correspondence
1%
1%

Other
0%

10%

FY 2017

20%

30%

40%

50%

60%

70%

FY 2018

Cyber attacks against SMBs are not diminishing. Most respondents say cyber attacks against
their companies are targeted, severe and sophisticated (62 percent, 60 percent and 59 percent,respectively); these values have not changed significantly since 2017, as shown in Figure 5.
Figure 5. Perceptions about cyber attacks against their companies
Strongly Agree and Agree responses combined60%

Cyber attacks are becoming more targeted

62%

Cyber attacks experienced are becoming more
severe in terms of negative consequences (suchas financial impact)

59%
60%

59%

Cyber attacks are becoming more sophisticated59%
0%

FY 2017

Ponemon Institute© Research Report

10%

20%

30%

40%

50%

60%

70%

FY 2018

Page 5

Businesses are vulnerable to exploits and malware. Only 40 percent of respondents say thetechnologies currently used by their organization can detect and block most cyber attacks. As
discussed previously, SMBs have experienced more advanced malware and zero day attacks in2018.
Figure 6 reveals that 72 percent of respondents (an increase from 66 percent in the previous
study) say exploits and malware evaded intrusion detection systems moreover, 82 percent ofrespondents (an increase from 81 percent last year) say they have evaded their anti-virus
solutions.
Figure 6. Has your business experienced situations when exploits and malware haveevaded their intrusion detection system or anti-virus solutions?
Yes responses presented

90%

81%

82%

80%
66%

70%

72%

60%
50%
40%
30%
20%
10%
0%
Anti-virus solutions

Intrusion detection system
FY 2017

Ponemon Institute© Research Report

FY 2018

Page 6

Mobile devices are the most vulnerable endpoints or entry points to networks andenterprise systems. As shown in Figure 7, mobile devices are considered, by far, the mostvulnerable endpoint or entry point to respondents’ companies’ networks and enterprise systems.
However, laptops and intranet servers have increased in their vulnerability. For the first time, IoT
devices were included and 41 percent say they are a very vulnerable entry point.
Figure 7. What are the most vulnerable endpoints or entry points to your organization’s
networks and enterprise systems?
Three choices allowed

56%
55%

Mobile devices
Laptops43%

Cloud systems

38%
42%

Intranet server

36%

49%

42%

IoT devices*

41%

Smart phones

39%
40%
30%
33%

Web server
Tablets

20%
19%

Desktops

21%
19%

Portable storage devices (including USBs)

8%
7%

Routers

6%
6%
2%
1%

Other
0%

10%

FY 2017

20%

30%

40%

50%

60%

FY 2018* Not a response in FY 2017

Ponemon Institute© Research Report

Page 7More mobile devices will be used to access business-critical applications and IT
infrastructure. Currently, an average of 45 percent of business-critical applications are accessedfrom mobile devices such as smartphones and tablets. As shown in Figure 8, nearly half (49percent) of respondents say these devices diminish their companies’ security posture.
Figure 8. How does the use of mobile devices to access business-critical applications andIT infrastructure affect your organization’s security posture?
60%
48%

50%

49%

40%

35%

33%

30%
20%
11%
10%

6%

12%

6%

0%
Improves security
postureDiminishes security
postureFY 2017

Ponemon Institute© Research Report

No affect on security
postureCannot determine

FY 2018

Page 8

Ransomware attacks continue to increase
The weakest link in a company’s ability to stop a ransomware attack is the negligent
employee. In the context of this research, ransomware is defined as a sophisticated piece of
malware that blocks victims’ access to their files.
Sixty-one percent of respondents say negligent employees put their company at risk for aransomware attack and 56 percent of respondents say these attacks can have serious financial
consequences, as shown in Figure 9. Less than half (48 percent) of respondents are confident
that their current anti-virus software will protect their company from ransomware.
Figure 9. Perceptions regarding ransomware
Strongly agree and Agree responses combined

Negligent employees put our company at risk fora ransomware attack

58%

A ransomware attack would have serious
financial consequences for our company

58%

61%

56%

My company believes it is too small to be thetarget of ransomware

51%

My company would never pay ransom even if welost the data49%

We are confident our current antivirus software
will protect our company from ransomware

48%

54%

51%

48%
0%

FY 2017

Ponemon Institute© Research Report

10%

20%

30%

40%

50%

60%

70%

FY 2018

Page 9Ransomware attacks increase significantly since last year. Sixty-one percent of respondents
say their company experienced either unsuccessful or successful ransomware attacks within thepast three months (11 percent), within the past 6 months (17 percent), within the past 12 months(19 percent) or more than 12 months ago (14 percent). In 2017, 52 percent of respondents said
they experienced a ransomware attack.
As shown in Figure 10, the ransomware experienced by companies in this study was mainly
unleashed via phishing/social engineering attacks (79 percent of respondents) followed by an
insecure or spoofed website (29 percent of respondents). This finding coincides with both theincrease in phishing/social engineering and the increase in negligent employees as the root
cause of a data breach.
Figure 10. How was the ransomware unleashed?
More than one choice allowed

90%
80%

79% 79%

70%
60%
50%
40%

27% 29%30%

14% 13%20%

14% 12%
4%

10%

3%

0%
Phishing/social
engineering

Insecure or
spoofed website

Malvertisements

FY 2017

Ponemon Institute© Research ReportSocial media

Other

FY 2018

Page 10

The devices considered the most vulnerable as a point of entry are the ones most often
attacked. As shown in Figure 11, the devices most often compromised by ransomware weredesktop/laptop (82 percent) and mobile device (41 percent), as shown in Figure 11.
Figure 11. What type of device(s) was compromised by ransomware?
More than one choice allowed

90%
80%

78%

82%

70%
60%
50%
37%

40%

41%
34%

33%

30%
20%
10%

4%

3%

0%
Desktop/laptop

Mobile device
FY 2017ServerOther

FY 2018

For successful ransomware attacks, more companies are paying the ransom. The averageransom was $1,466, and 70 percent of respondents say their companies paid the ransom. Last
year, 60 percent of respondents said they paid the ransom. As shown in Figure 12, companies
that did not pay the ransom attributed the decision to having a full backup (73 percent ofrespondents) or not trusting the criminals to provide the decryption cypher (49 percent ofrespondents).
Figure 12. Why did your company not pay the ransom?
More than one choice allowed

67%
73%

We had a full backup
We did not believe the bad guys would provide
the decryption cypher

52%
49%
29%
32%

Company policy is not to pay ransom
Compromised data was not critical for ourbusiness

21%
20%
9%
10%

Law enforcement told us not to pay it
3%
3%

Other
0%
FY 2017

Ponemon Institute© Research Report

10% 20% 30% 40% 50% 60% 70% 80%
FY 2018

Page 11

Cybersecurity posture and governance
SMBs continue to struggle with insufficient personnel and money. Figure 13 lists thechallenges companies face when trying to create a stronger security posture.
The biggest problem is not having the personnel to mitigate cyber risks, vulnerabilities andattacks (74 percent of respondents). The next biggest challenges are insufficient budget (55percent of respondents) and no understanding of how to protect against cyber attacks (47 percent
of respondents).
Figure 13. What challenges keep your IT security posture from being fully effective?
Three choices allowed

73%
74%

Insufficient personnel
56%
55%

Insufficient budget (money)
No understanding how to protect against cyberattacks

47%
47%
43%
38%

Insufficient enabling security technologies

39%
37%

Lack of in-house expertise22%
23%

Not a priority issue

11%
17%

Lack of collaboration with other functions
Lack of clear leadership5%
5%Management does not see cyber attacks as asignificant risk

5%
4%
0%

FY 2017

Ponemon Institute© Research Report

10% 20% 30% 40% 50% 60% 70% 80%
FY 2018

Page 12

As Figure 14 shows, 63 percent of respondents say their companies do not have an adequate
budget to achieve a strong cybersecurity posture. Fifty-nine percent of respondents say theircompanies do not have adequate in-house expertise to achieve a strong cybersecurity posture.
Figure 14. Does your organization have an adequate budget and in-house expertise toachieve a strong cybersecurity posture?
No and Unsure responses combined

70%

63%

63%

62%

60%

59%

50%
40%
30%
20%
10%
0%
Adequate budget

In-house expertise
FY 2017

FY 2018

Leadership is lacking when determining IT security priorities. As shown in Figure 15, 35
percent of respondents say no one person is responsible for determining IT security priorities, anincrease from 30 percent of respondents in last year’s research. According to the findings,
responsibility for companies’ IT security strategy is dispersed throughout the company.
Figure 15. Who determines IT security priorities?
Two choices allowed30%

No one function determines IT security priorities

35%
33%
31%
34%
31%
33%
30%

Chief information officer (CIO)
Chief executive
Head of operations
24%
23%

Business owners
9%Lines of business

14%
11%
10%
9%
9%
8%
7%
6%
7%
4%
3%

Chief information security officer (CISO)
Board of directors
Chief technology officer (CTO)
Compliance officer
General counsel
0%
1%

Other
0%

FY 2017

Ponemon Institute© Research Report5%

10% 15% 20% 25% 30% 35% 40%

FY 2018

Page 13More SMBs are engaging managed security services providers (MSSPs) to support the IT
security function. On average, 29 percent of a company’s IT security operations are supported
by MSSPs, this is an increase from 21 percent in last year’s study.
According to Figure 16, 66 percent of respondents say their MSSP monitors or manages firewalls
or intrusion prevention systems (IPS). Forty-three percent say they use MSSPs to monitor or
manage intrusion detection systems (IDSs).
Figure 16. What services are provided by MSSPs to support your IT security posture?
More than one choice permitted

68%
66%

Monitored or managed firewalls or intrusion
prevention systems (IPSs)
50%

Monitored or managed intrusion detection
systems (IDSs)

43%

Managed or monitored security gateways formessaging or Web traffic

43%
39%
40%
36%

Managed vulnerability scanning of networks,
servers, databases or applications

28%
30%

Monitored or managed multifunction firewalls
Identity and access management *

22%
20%
20%

Security analysis and reporting of events
collected from IT infrastructure logs

17%
17%

Reporting associated with monitored/managed
devices and incident response
Privileged access management *

17%
13%
14%

Distributed denial of service (DDoS) protection

10%
11%

Monitoring and/or management of advanced
threat defense technologies
Monitoring or management of customerdeployed security information and event
management (SIEM) technologies

8%
8%
0%

FY 2017

10% 20% 30% 40% 50% 60% 70% 80%
FY 2018*Not a response in FY 2017

Ponemon Institute© Research Report

Page 14

Compliance with the new General Data Protection Regulation (GDPR) is a burden for SMBs
already challenged with not having an adequate IT security budget. The GDPR took effecton May 25, 2018. It establishes new requirements related to the export of personal data outside
the European Union. In last year’s research, respondents were asked to predict if the GDPR
would require significant changes to their companies’ privacy and security strategies.
As Figure 17 shows, last year 92 percent of respondents said the new regulations would requirechanges to their privacy and security strategy. Similarly, in 2018, 93 percent of respondents say
the new regulation did require significant changes. Only 19 percent of respondents say they haveachieved a high level of compliance with GDPR.
Figure 17. Will the GDPR require significant changes in your privacy and security
strategy?
45%
40%

41%

41%
37%

37%

35%
30%
25%
18%

20%
15%

11%
8%

10%

7%

5%
0%
Yes, significant change

Yes, some change
FY 2017

Ponemon Institute© Research Report

Yes, nominal change

No change

FY 2018

Page 15More SMBs are adopting IT security guidelines or standards. Figure 18 presents the leading
IT security guidelines and standards. Forty-six percent of respondents say they comply with PCI
DSS. Thirty-one percent of respondents say they do not comply with any of the standards, asignificant decline from 41 percent of respondents in the 2017 study.
Figure 18. Which IT security guidelines or standards does your company comply with?
More than one choice permitted

43%
46%

PCI DSSSOX 404

17%
18%

NIST

17%
17%

SOC 2/3

15%
17%

COBIT

10%
9%

HIPAA/HiTECH

10%
8%
6%
6%

ISO 27001/2
None of the above

41%

31%
6%
6%

Other
0%

5%

10%

15%

20%

FY 2017

Ponemon Institute© Research Report

25%

30%

35%

40%

45%

50%

FY 2018

Page 16

Password practices and policies
Strong passwords and biometrics are an essential part of a company’s security defense.
Forty percent of respondents say their companies had an attack involving the compromise of
employees’ passwords in the past year, and the average cost of each attack was $383,365.
Similar to last year’s findings, 62 percent of respondents say they rely upon strong passwords
and/or biometrics to reduce the risk of attack. In 2017, 60 percent of respondents agreed with thisrisk mitigation strategy.
However, as Figure 19 demonstrates, 54 percent of respondents say they do not have, or are
unsure if they have, visibility into employees’ password practices such as the use of unique orstrong passwords and sharing passwords with others. Fifty-four percent of respondents do not
have, or are unsure their company has, a policy pertaining to employees’ use of passwords
and/or biometrics, such as a fingerprint.
Figure 19. Does your organization have visibility into employees’ password practices anda password policy?
No and Unsure responses combined

70%
60%

59%

57%

54%

54%

50%
40%
30%
20%
10%
0%
Visibility into employees’ password practices
FY 2017

Ponemon Institute© Research Report

Password policy
FY 2018

Page 17

The ability to determine employees’ password practices is not effective. Of the 45 percent
of respondents who say they have visibility into employees’ password practices, less than half of
respondents say they are able to determine if employees are making periodic changes topasswords (47 percent), using unique or strong passwords (46 percent) and determining thenumber of passwords each employee has (46 percent). Only 24 percent of respondents say they
are able to determine if employees are sharing passwords.
Figure 20. Is your company able to determine employees’ password practices?
More than one choice allowed

Making periodic changes to passwords

47%

Using unique or strong passwords

46%

The number of passwords each employee has

46%

Sharing passwords with others

24%

0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

Human memory and spreadsheets are used to protect passwords. Only 22 percent ofrespondents say their companies require employees to use a password manager. Of the 74
percent of respondents who say password managers are not required, 53 percent of respondents
say their companies rely upon human memory and 51 percent of respondents say they use
spreadsheets.
Figure 21. What does your organization use to manage and protect its passwords?
More than one choice allowed

Human memory

53%

Spreadsheets

51%

Manually write them down on paper or sticky
notes

30%

18%

Browser extension

Other

4%
0%

Ponemon Institute© Research Report

10%

20%

30%

40%

50%

60%

Page 18

Employees’ use of weak passwords leads to stolen or otherwise compromised passwords.
Figure 22 lists what respondents think are the biggest pain points in managing employees’
passwords. As shown, 68 percent of respondents say having to deal with passwords being stolenor compromised followed by employees using weak passwords (67 percent of respondents).
Figure 22. What is your biggest pain point about employees and their passwords?
Two choices allowed

Employee passwords being stolen orcompromised

68%

Employees using weak passwords

67%

58%

Time spent resetting passwords
Changing passwords when an employee leaves
his job46%

38%

Employee adoption of best practices0%

Ponemon Institute© Research Report

10% 20% 30% 40% 50% 60% 70% 80%

Page 19

Biometrics or voice recognition are most often used to protect passwords. Figure 23 lists
possible measures companies can take to safeguard employees’ passwords. The top choices areto have an alternative to keyboard entry (46 percent of respondents), mandate periodic password
changes (44 percent of respondents), require more than one authentication system such as 2FA(40 percent of respondents) and monitor third-party sites where compromised passwords areshared (40 percent of respondents).
Figure 23. Does your organization take any of the following steps to safeguard
passwords?
More than one choice allowed

Provide an alternative to keyboard entry (e.g.,
voice recognition, biometrics)

46%

Periodic password changes

44%

Require more than one authentication systemsuch as 2FA

40%

Monitor third-party sites where compromised
passwords are shared

40%

Prohibit employees from reusing the same
password on internal systems

34%
32%

Require minimum password lengths
Assign randomly chosen passwords

30%
22%

None of the above
Other

1%
0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

Ponemon Institute© Research Report

Page 20

More respondents in this year’s research say their companies have implemented SSO
either fully (31 percent) or partially implemented (27 percent). SSO is defined as a propertyof access control of multiple related, yet independent, software systems. A user logs in with asingle ID and password to gain access to a connected system or systems without using different
usernames or passwords; or, in some configurations, seamlessly sign on at each system.
As can be seen in Figure 24, these respondents largely believe SSO increases the security ofuser access to their companies’ applications and data (73 percent).
Figure 24. Does SSO simplify and increase the security of user access to yourorganization’s applications and data?
80%
70%

73%

69%

60%
50%
40%
26%

30%

22%

20%
6%

5%

10%
0%
Yes

No
FY 2017

Ponemon Institute© Research Report

UnsureFY 2018

Page 21

Password protection and management has increased in importance. According to Figure 25,
almost all (95 percent) respondents believe anti-malware is critical. Nearly as many say client
firewalls (88 percent of respondents) are important. Password protection and management has
increased significantly in importance since 2017 (from 52 percent of respondents to 62 percent ofrespondents). Also increasing are automated patch management systems (49 percent ofrespondents to 55 percent of respondents) and privileged user access management (from 36
percent of respondents to 42 percent of respondents).
Figure 25. Security technologies considered essential and very importantMore than one choice allowed

96%
95%

Anti-malware

89%
88%

Client firewalls
Intrusion detection and prevention

62%
64%

VPN and other secure web gateways

62%
63%

Password protection / management

52%
62%
49%
55%

Automated patch management systems
Privileged user access management

36%
42%

Identity & access management

39%
41%

Anti-denial of services

41%
38%

Encryption technologies

41%
38%

Web application firewalls (WAF)

36%
36%

Security incident & event management (SIEM)

30%
33%

Artificial intelligence/machine learning

27%
31%

Endpoint management

28%
29%

Mobile device management (MDM)

27%
28%

Next generation firewalls (NGFW)

29%
28%

Data loss prevention (DLP)

25%
25%

Network traffic intelligence

22%
21%

Big data analytics

22%
20%

Tokenization

14%
14%

Unified threat management (UTM)

12%
13%
2%
1%

Other
0%

FY 2017

Ponemon Institute© Research Report

20%

40%

60%

80%

100%

120%

FY 2018

Page 22

The best practices of high-performing companies
In this section, we present a special analysis of the 115 respondents from high-performing
companies. These respondents say their companies are highly effective at mitigating risks,vulnerabilities and attacks across the enterprise. We compare their responses to the overall
sample of respondents to learn the best practices of companies that are highly effective in
mitigating the risk of data breaches and cyber attacks.
High-performing companies have higher budgets and in-house expertise. As shown in
Figure 26, more than half of respondents (51 percent) in high-performing companies vs. 37
percent of respondents in the overall sample say their budget is adequate for achieving a strong
IT security posture. High-performing companies are also allocating a higher percentage of the IT
budget to IT security (15 percent vs. 12 percent).
A larger budget is helpful in staffing the IT security function with experts. Fifty-one percent ofrespondents say their companies have the necessary in-house expertise for achieving a strong
security posture. An average of 41 percent of the IT staff support IT security operations. In
contrast, an average of only 36 percent of the IT staff supports IT security operations in theoverall sample.
Figure 26. Differences in perceptions about budget and in-house expertiseYes responses presented

60%
51%

51%

50%
41%
40%

37%

30%
20%
10%
0%
Adequate budget

In-house expertise
OverallPonemon Institute© Research Report

High-performer

Page 23

High-performing companies are less likely to experience a cyber attack. As shown in Figure27, 67 percent of respondents in the overall sample had a cyber attack in the past 12 months as
opposed to 56 percent of respondents in high-performing companies.
Figure 27. Has your organization experienced a cyber attack in the past 12 months?
80%
70%

67%
56%

60%
50%

36%

40%
30%

22%

20%

11%

8%

10%
0%
Yes

No
Overall

UnsureHigh-performer

As shown in Figure 28, high-performing companies are less likely to experience exploits where
malware evaded intrusion detection systems and anti-virus solutions.
Figure 28. Has your organization experienced exploits where malware evaded intrusion
detection systems and anti-virus solutions?
Yes responses presented

90%

82%

80%

72%

68%

70%

59%

60%
50%
40%
30%
20%
10%
0%
Anti-virus solutions

Intrusion detection system
OverallPonemon Institute© Research Report

High-performer

Page 24

High-performing companies are more likely to require the use of strong passwords and/or
biometrics. According to Figure 29, 71 percent of respondents from high-performing companies
vs. 62 percent of respondents in the overall sample say the use of strong passwords and/or
biometrics is an essential part of their organization’s security defense. Respondents in highperforming companies are less likely to agree that negligent employees put their companies atrisk for a ransomware attack, that their companies are too small to be a target of ransomware.
They are also less confident that their current antivirus software will protect their companies fromransomware.
Figure 29. Perceptions about password security and ransomware
Strongly agree and Agree responses combined

The use of strong passwords and/or biometrics
is an essential part of my organization’s security
defense62%

Negligent employees put our company at risk fora ransomware attack

61%

71%

49%
54%

My company believes it is too small to be thetarget of ransomware

38%
48%

We are confident our current antivirus software
will protect our company from ransomware

39%0%Overall

10% 20% 30% 40% 50% 60% 70% 80%

High-performer

High-performing companies are more likely to have an incident response plan. According to
Figure 30, 85 percent of respondents from high-performing companies have an incident response
plan vs. 60 percent of the overall sample of respondents say they have such a plan.
Figure 30. Does your company have an incident response plan?
85%

90%
80%
70%

60%

60%
50%

39%

40%
30%

15%

20%
10%

1%

0%

0%
Yes

No
OverallPonemon Institute© Research Report

UnsureHigh-performer

Page 25

More high-performing companies have password policies for employees. As shown in
Figure 31, 60 percent of respondents from high-performing companies say their companies havea password policy vs. 40 percent of respondents in the overall sample.
Figure 31. Does your company have a password policy for employees?
70%
60%
60%

55%

50%
40%
40%

34%

30%
20%
10%

6%

5%

0%
Yes

No
Overall

UnsureHigh-performer

High-performing companies are most likely to believe mobile devices are the mostvulnerable endpoints. These companies are also most likely to say IoT devices and cloudsystems are vulnerable entry points and less likely to consider laptops and Intranet servers to bevulnerable entry points.
Figure 32. What are the most vulnerable endpoints or entry points to your companies’
networks and enterprise systems?
More than one response permitted

55%

Mobile devices
Laptops

49%

39%
42%

Cloud systems
Intranet server

48%

42%

32%

41%

IoT devices

40%

Smart phones
0%

10%

20%
OverallPonemon Institute© Research Report

30%

62%

40%

50%

45%
50%

60%

70%

High-performer

Page 26

The financial consequences following a security incident are much less severe for highperforming companies. According to Figure 33, the benefit of having a more effective security
strategy is a lower cost of the compromises companies experienced. The biggest difference
between the two groups of respondents is the cost from disruption to normal operations.
Figure 33. The cost of compromises
Extrapolated values (US$)$1,562,124

Cost from disruption to normal operations$1,055,025$1,426,422

Cost from damage or theft of IT assets andinfrastructure$1,093,975$383,365

Cost per attack$294,900$0OverallPonemon Institute© Research Report$400,000 $800,000 $1,200,000$1,600,000
High-performer

Page 27

Part 3. Methods
The survey’s sampling frame comprised of 28,919 IT practitioners and IT security practitioners
from companies in the United States and United Kingdom; these companies had headcounts
ranging from less than 100 to 1,000. Table 1 shows that there were 1,149 returned surveys. Afterscreening and reliability checks, we removed 104 surveys. Thus, the final sample consisted of
1,045 surveys (a 3.6 percent response rate).
Table 1. Sample response
Sampling frame
Total returns
Rejected or screened surveys
Final sample

Freq28,919
1,149
104
1,045

Pct%
100.0%
4.0%
0.4%
3.6%

Pie Chart 1 reports the respondents’ organizational level within their companies. By design, 72
percent of respondents are at or above the supervisory levels.
Pie Chart 1. Position level within the organization
5% 1%

10%
Business owner
12%

23%

C-level executive/VP
Director
ManagerSupervisor

17%

Staff/technician
Administrative

13%

Consultant/contractor
20%

Ponemon Institute© Research Report

Page 28

As shown in Pie Chart 2, 23 percent of respondents report directly to their company’s CIO or
head of corporate IT, 16 percent report to the company’s COO or head of operations, 15 percent
report to the company’s business unit leader or general manager, 12 percent report to thebusiness owner or board, and 11 percent of respondents report to the company’s head of IT
security.
Pie Chart 2. The commands reported to in your current role

5%

4%

3%
23%

CIO or head of corporate IT
COO or head of operations

10%

Business unit leader or general manager
Business owner / board
Head of IT security
CEO/executive committee

11%

16%

Head of risk management
Head of compliance or internal audit
CFO, controller or head of finance

12%

15%

Pie Chart 3 provides the industries of the respondents’ companies. Financial services (16 percent
of respondents) is the largest segment, followed by retail (12 percent of respondents), services(10 percent of respondents), and industry (9 percent of respondents) and the public sector (also 9
percent of respondents).
Pie Chart 3. Primary industry focus
2% 4%
2%
2%
3%
3%

16%

Financial services
Retailing

6%Services
12%

7%

Industrial
Public sector
Technology & software

8%

10%
8%

Manufacturing
Healthcare

9%

Ponemon Institute© Research Report

9%Page 29

Part 4. Caveats to this study
There are inherent limitations to survey research that need to be carefully considered before
drawing inferences from findings. The following items are specific limitations that are germane tomost Web-based surveys.
<<<

Non-response bias: The current findings are based on a sample of survey returns. We sent
surveys to a representative sample of individuals, resulting in a large number of usable
returned responses. Despite non-response tests, it is always possible that individuals who did
not participate are substantially different in terms of underlying beliefs from those whocompleted the instrument.
Sampling-frame bias: The accuracy is based on contact information and the degree to which
the list is representative of individuals who are IT or IT security practitioners. We also
acknowledge that the results may be biased by external events such as media coverage.
Finally, because we used a Web-based collection method, it is possible that non-Web
responses by mailed survey or telephone call would result in a different pattern of findings.
Self-reported results: The quality of survey research is based on the integrity of confidential
responses received from subjects. While certain checks and balances can be incorporated
into the survey process, there is always the possibility that a subject did not provide accurate
responses.

Ponemon Institute© Research Report

Page 30

Appendix: Detailed Survey Results
The following tables provide the frequency or percentage frequency of responses to all survey
questions contained in this study. All survey responses were captured from July 19 2018 to July
31, 2018.
Survey response
Total sampling frame
Total returns
Rejected surveys
Final sample
Response rate
Sample weight

FY 2018
28,919
1,149
104
1,045
3.6%
1.00

FY 2017
29,988
1,152
112
1,040
3.5%
1.00

S1. What range best describes the full-time employee headcount of
your organization?
Less than 100
100 to 250
251 to 500
501 to 750
751 to 1,000
More than 1,000 [STOP]
Total

FY 2018
157
160
229
245
254
1,045

FY 2017

S2. What best describes your role in managing the IT security functionor activities within your organization? Check all that apply.
Setting IT security priorities
Managing IT security budgets
Selecting vendors and contractors
Determining IT security strategy
Evaluating program performance
None of the above [STOP]
Total

FY 2018
66%
57%
46%
45%
44%
0%
259%

FY 2017
62%
57%
49%
46%
44%
0%
257%

S3. How do you rate your level of involvement in the evaluation,
selection, and/or implementation of IT security products or services inyour organization?
Very high level of involvement
High level of involvement
Moderate level of involvement
Low level of involvement
Not involved [STOP]
Total

FY 2018
33%
43%
19%
5%
0%
100%

FY 2017
34%
43%
19%
5%
0%
100%

Part 1. Screening Questions

Ponemon Institute© Research Report

168
172
209
252
239
1,040

Page 31

Part 2: Security PostureQ1. How would you describe your organization’s IT security posture (interms of its effectiveness at mitigating risks, vulnerabilities and attacks
across the enterprise)? 1 = not effective to 10 = very effective
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

FY 2018
9%
34%
28%
17%
11%
100%
5.24

FY 2017
11%
38%
30%
14%
7%
100%
4.87

Q2. What challenges keep your organization’s IT security posture frombeing fully effective? Please choose the top three challenges.
Insufficient budget (money)
Insufficient personnel
Lack of in-house expertise
Lack of clear leadership
Insufficient enabling security technologies
No understanding how to protect against cyber attacks
Management does not see cyber attacks as a significant risk
Lack of collaboration with other functions
Not a priority issue
Other
Total

FY 2018
55%
74%
37%
5%
38%
47%
4%
17%
23%
0%
300%

FY 2017
56%
73%
39%
5%
43%
47%
5%
11%
22%
0%
300%

Q3. What types of information are you most concerned about protectingfrom cyber attackers? Please choose two top choices.
Customer credit or debit card information
Financial information
Intellectual property
Customer records
Employee records
Business correspondence
Other (please specify)
Total

FY 2018
40%
28%
51%
57%
15%
8%
1%
200%

FY 2017
37%
26%
48%
63%
16%
8%
1%
200%

Q4. Who determines IT security priorities in your organization? Top two
choices.
Business owners
Board of directors
Chief executive
Head of operations
Chief information officer (CIO)
Chief technology officer (CTO)
Chief information security officer (CISO)
Compliance officer
General counsel
Lines of businessNo one function determines IT security priorities
Other (please specify)
Total

FY 2018
23%
9%
31%
30%
31%
7%
10%
7%
3%
14%
35%
1%
200%

FY 2017
24%
9%
34%
33%
33%
8%
11%
6%
4%
9%
30%
0%
200%

Ponemon Institute© Research Report

Page 32

Q5. Is your organization’s budget adequate for achieving a strong IT
security posture?
Yes
No
UnsureTotal

FY 2018
37%
52%
11%
100%

FY 2017
37%
52%
11%
100%

Q6. What percentage of your organization’s IT budget is dedicated to IT
security activities?
Less than 5%
5 to 10%11 to 15%
16 to 20%
21 to 25%
26 to 30%
31 to 40%
41 to 50%More than 50%
Total
Extrapolated value

FY 2018
16%
31%
23%
18%
6%
3%
3%
0%
0%
100%
12.1%

FY 2017
19%
27%
25%
19%
6%
3%
1%
0%
0%
100%
11.6%

Q7. Does your organization have the in-house expertise necessary forachieving a strong IT security posture?
Yes
No
UnsureTotal

FY 2018
41%
48%
11%
100%

FY 2017
38%
52%
10%
100%

Q8. What percentage of your organization’s IT personnel support IT
security operations?
Less than 5%
5 to 10%11 to 15%
16 to 20%
21 to 25%
26 to 30%
31 to 40%
41 to 50%More than 50%
Total
Extrapolated value

FY 2018
0%
4%
7%
10%
14%
10%
8%
11%
35%
100%
36%

FY 2017

Ponemon Institute© Research Report

0%
5%
8%
12%
15%
11%
8%
8%
33%
100%
36%

Page 33

Q9a. What percentage of your organization’s IT security operations aresupported by managed security service providers (MSSPs)?
None [Skip Q10]
Less than 10%
10% to 25%
26% to 50%
51% to 75%
76% to 100%
Total
Extrapolated value

FY 2018
41%
9%
8%
11%
18%
14%
100%
29%

FY 2017
47%
10%
12%
11%
9%
10%
100%
21%

Q9b. Following are core services typically provided by MSSPs. Pleasecheck all services provided by MSSPs to support your organization’s IT
security posture. *not a response in 2017

FY 2018

FY 2017

Monitored or managed firewalls or intrusion prevention systems (IPSs)
Monitored or managed intrusion detection systems (IDSs)
Monitored or managed multifunction firewalls

66%
43%
30%

68%
50%
28%

Managed or monitored security gateways for messaging or Web traffic

39%

43%

Security analysis and reporting of events collected from IT
infrastructure logs

20%

20%

Reporting associated with monitored/managed devices and incident
response17%

17%Managed vulnerability scanning of networks, servers, databases orapplications
Distributed denial of service (DDoS) protection

36%
14%

40%
13%

Monitoring or management of customer-deployed security informationand event management (SIEM) technologies

8%

8%

11%
22%
17%
323%

10%

298%

FY 2018
46%
6%
17%
9%
18%
17%
8%
31%
6%
158%

FY 2017
43%
6%
15%
10%
17%
17%
10%
41%
6%
165%

Monitoring and/or management of advanced threat defense
technologies
Identity and access management *Privileged access management *Total
Q10. Does your organization strive to comply with leading IT security
guidelines or standards? Please check the standards that yourorganization attempts to comply with.
PCI DSSISO 27001/2
SOC 2/3
COBIT
SOX 404NIST
HIPAA/HiTECH
None of the above
Other (please specify)
Total

Ponemon Institute© Research Report

Page 34

Q11. What percent of your organization’s business-critical applications
are accessed from mobile devices such as smart phones, tablets andothers? Your best guess is welcome.
ZeroLess than 10%
11 to 25%
36 to 50%
51 to 75%
76 to 100%
Total
Extrapolated value

FY 2018
0%
5%
17%
37%
30%
11%
100%
45%

Part 3: Cyber Attacks
Q12a. Has your organization experienced a cyber attack in the past 12
months?
Yes
No
UnsureTotal

FY 2018
67%
22%
11%
100%

FY 2017
61%
24%
14%
100%

Q12b. If yes, what best describes the type of attacks experienced byyour organization? Please select all that apply.
Advanced malware / zero day attacks
Phishing / social engineering
SQL injection
Cross-site scripting
Denial of services
Compromised / stolen devices
Malicious insider
General malware
Web-based attack
Other (please specify)
Total

FY 2018
24%
52%
20%
9%
26%
34%
12%
37%
47%
4%
266%

FY 2017
16%
48%
24%
10%
26%
30%
11%
36%
43%
3%
248%

Q13a. Has your organization ever experienced situations when exploits
and malware have evaded your intrusion detection system?
Yes
No
UnsureTotal

FY 2018
72%
20%
8%
100%

FY 2017
66%
22%
12%
100%

Q13b. Has your organization ever experienced situations when exploits
and malware have evaded your anti-virus solutions?
Yes
No
UnsureTotal

FY 2018
82%
12%
6%
100%

FY 2017
81%
13%
5%
100%

Ponemon Institute© Research Report

Page 35

Please rate the following statements using the five-point scale provided
below each item.
Q14a. Cyber attacks experienced by my organization are becoming
more targeted.
Strongly agree
Agree
UnsureDisagreeStrongly disagree
Total

FY 2018
28%
34%
16%
13%
9%
100%

FY 2017
27%
33%
19%
13%
9%
100%

Q14b. Cyber attacks experienced by my organization are becoming
more sophisticated.
Strongly agree
Agree
UnsureDisagreeStrongly disagree
Total

FY 2018
23%
36%
21%
13%
8%
100%

FY 2017
26%
33%
21%
12%
8%
100%

Q14c. Cyber attacks experienced by my organization are becoming
more severe in terms of negative consequences (such as financial
impact).
Strongly agree
Agree
UnsureDisagreeStrongly disagree
Total

FY 2018
26%
34%
22%
12%
5%
100%

FY 2017
27%
32%
24%
12%
5%
100%

Q14d. The use of strong passwords and/or biometrics is an essential
part of my organization’s security defense.
Strongly agree
Agree
UnsureDisagreeStrongly disagree
Total

FY 2018
31%
31%
20%
12%
7%
100%

FY 2017
28%
32%
19%
13%
7%
100%

Q15a. My company believes it is too small to be the target of
ransomware.
Strongly agree
Agree
UnsureDisagreeStrongly disagree
Total

FY 2018
22%
32%
15%
22%
10%
100%

FY 2017
20%
31%
15%
23%
11%
100%

Ponemon Institute© Research Report

Page 36

Q15b. My company would never pay ransom even if we lost the data.
Strongly agree
Agree
UnsureDisagreeStrongly disagree
Total

FY 2018
25%
26%
26%
16%
7%
100%

FY 2017
22%
27%
26%
17%
8%
100%

Q15c. Negligent employees put our company at risk for a ransomware
attack.
Strongly agree
Agree
UnsureDisagreeStrongly disagree
Total

FY 2018
24%
37%
14%
18%
7%
100%

FY 2017
24%
34%
15%
18%
8%
100%

Q15d. A ransomware attack would have serious financial
consequences for our company.
Strongly agree
Agree
UnsureDisagreeStrongly disagree
Total

FY 2018
25%
31%
21%
18%
5%
100%

FY 2017
23%
35%
21%
16%
6%
100%

Q15e. We are confident our current antivirus software will protect ourcompany from ransomware.
Strongly agree
Agree
UnsureDisagreeStrongly disagree
Total

FY 2018
22%
26%
20%
24%
9%
100%

FY 2017
22%
26%
19%
24%
9%
100%

Q16. Have you or your company experienced ransomware?
Yes, within the past 3 months
Yes, within the past 6 months
Yes, within the past 12 months
Yes, more than 12 months ago
No (Skip to Part 4)
Total

FY 2018
11%
17%
19%
14%
39%
100%

FY 2017
10%
14%
18%
9%
48%
100%

Q17. How many ransomware incidents have you or your company
experienced?
1
2 to 56 to 10
Greater than 10
Total

FY 2018
44%
36%
15%
5%
100%

FY 2017
47%
31%
17%
5%
100%

Ponemon Institute© Research Report

Page 37

Q18. How was the ransomware unleashed? Please select all that
apply.
Phishing/social engineering
Insecure or spoofed website
Social media
Malvertisements
Other
Total

FY 2018
79%
29%
12%
13%
3%
135%

FY 2017
79%
27%
14%
14%
4%
139%

Q19. What type of device was compromised by ransomware? Please
select all that apply.
Desktop/laptop
Mobile device
ServerOther
Total

FY 2018
82%
41%
33%
3%
160%

FY 2017
78%
37%
34%
4%
152%

Q20. How much was the ransom?
Less than $100
$100 to $500
$501 to $1,000$1,001 to $5,000$5,001 to $10,000
More than $10,000
Total
Extrapolated value (US$)*UK amount was converted from GBP to dollars

FY 2018
10%
26%
30%
12%
10%
12%
100%
1,466

FY 2017
13%
30%
30%
13%
7%
8%
100%
$941

Q21a. Did your company pay the ransom?
Yes
No
Total

FY 2018
70%
30%
100%

FY 2017
60%
40%
100%

Q21b. If you did not pay a ransom, why not?
We had a full backup
Company policy is not to pay ransom
Law enforcement told us not to pay it

FY 2018
73%
32%
10%

FY 2017
67%
29%
9%

49%
20%
3%
186%

52%
21%
3%
182%

FY 2018
58%
42%
100%

FY 2017
54%
46%
100%

We did not believe the bad guys would provide the decryption cypher
Compromised data was not critical for our business
Other
Total
Part 4. Data breach experienceQ22a. Has your organization experienced an incident involving the loss
or theft of sensitive information about customers, target customers or
employees (a.k.a. data breach) in the past 12 months?
Yes
No [skip to Part 5]
Total

Ponemon Institute© Research Report

Page 38

Q22b. If yes, with respect to your organization’s largest breach over the
past 12 months, how many individual records were lost or stolen?
Less than 100
100 to 500
501 to 1,000
1,001 to 10,000
10,001 to 50,000
50,001 to 100,000
100,001 to 1,000,000
More than 1,000,000
Total
Extrapolated value

FY 2018
33%
23%
15%
14%
8%
6%
1%
0%
100%
10,848FY 2017
33%
26%
15%
14%
7%
4%
1%
0%
100%
9,350

Q22c. If yes, what were the root causes of the data breaches
experienced by your organization? Please select that apply.
Malicious insider
External (hacker) attacks
Negligent employee or contractor
Error in system or operating process
Third party mistakes
Other (please specify)
Don’t know
Total

FY 2018
7%
37%
60%
30%
43%
1%
31%
209%

FY 2017

Q23. Does your organization have an incident response plan forresponding to cyber attacks and data breaches?
Yes
No
UnsureTotal

FY 2018
60%
39%
1%
100%

FY 2017
55%
44%
1%
100%

FY 2018
45%
50%
4%
100%

FY 2017
41%
52%
7%
100%

7%
33%
54%
34%
43%
2%
32%
206%

Part 5. Password practices and policies
Q24a. Does your organization have visibility into employees’
password practices?
Yes
No
UnsureTotal
Q24b. If yes, are you able to determine the following steps taken by
employees? Please select all that apply.
Using unique or strong passwords
Making periodic changes to passwords
Sharing passwords with others
The number of passwords each employee has
Total

Ponemon Institute© Research Report

FY 2018
46%
47%
24%
46%
163%

Page 39

Q25a. Does your organization have a policy pertaining to employees’
use of passwords?
Yes
No
UnsureTotal

FY 2018
47%
49%
5%
100%

FY 2017
43%
52%
5%
100%

Q25b. If yes, does your organization strictly enforce this policy?
Yes
No
UnsureTotal

FY 2018
32%
64%
4%
100%

FY 2017
32%
63%
5%
100%

Q26a. Does your organization require employees to use a password
manager?
Yes
No
UnsureTotal
Q26b. If no, what does your organization use to manage and protect its
passwords?
Spreadsheets
Manually write them down on paper or sticky notes
Human memory
Browser extension
Other (please specify)
Total
Q27. What is your biggest pain point about employees and theirpasswords? Please select your top two choices.

FY 2018
22%
74%
4%
100%

FY 2018
51%
30%
53%
18%
4%
157%

Total

FY 2018
58%
46%
67%
68%
38%
277%

Q28. Does your organization take any of the following steps? Please
select all that apply.
Periodic password changes
Assign randomly chosen passwords
Require minimum password lengths

FY 2018
44%
30%
32%

Time spent resetting passwords
Changing passwords when an employee leaves his job
Employees using weak passwords
Employee passwords being stolen or compromised
Employee adoption of best practices

Prohibit employees from reusing the same password on internal
systems
Provide an alternative to keyboard entry (i.e., voice recognition,
biometrics)
Require more than one authentication system such as 2FA
Monitor third-party sites where compromised passwords are shared
None of the above
Other (please specify)
Total

Ponemon Institute© Research Report

34%
46%
40%
40%
22%
1%
289%

Page 40

Q29. What would prevent your organization from adopting biometrics?
Too costly
Difficult to enforce
Too risky if biometric information was lost
Still need passwords as backup
Total

FY 2018
43%
48%
43%
39%
172%

Single sign-on (SSO) is a property of access control of multiple
related, yet independent, software systems. With this property, auser logs in with a single ID and password to gain access to aconnected system or systems without using different usernames or
passwords, or in some configurations seamlessly sign on at eachsystem.
Q30. Does your organization use SSO?
Yes, fully implemented across the enterpriseYes, partially implemented across the enterprise
No (skip to Q32)
Total

FY 2018
31%
27%
42%
100%

FY 2017
27%
24%
50%
100%

Q31. Do you believe that SSO increases the security of user access toyour organization’s applications and data?
Yes
No
UnsureTotal

FY 2018
73%
22%
6%
101%

FY 2017
69%
26%
5%
100%

Q32. In your opinion, how does the use of mobile devices such astablets and smart phones to access business-critical applications andIT infrastructure affect your organization’s security posture?
Improves security posture
Diminishes security posture
No affect on security posture
Cannot determine
Total

FY 2018
6%
49%
33%
12%
100%

FY 2017

FY 2018
40%
60%
100%

FY 2017
39%
61%
100%

6%
48%
35%
11%
100%

Part 6. Enabling Security Technologies
Q33. Do the security technologies currently used by your organization
detect and block most cyber attacks?
Yes
No
Total

Ponemon Institute© Research Report

Page 41

Q34. How important are each of the following security technologies
used your organization today? Please use the following importancescale for each technology listed. Leave blank if a given technology is
not deployed by your organization. % Essential and Very Important
responses combined.
Anti-malware
Anti-denial of services
Artificial intelligence/machine learning
Privileged user access management
Automated patch management systems
Password protection / management
Big data analytics
Data loss prevention (DLP)
Encryption technologies
Tokenization
Endpoint management
Mobile device management (MDM)
Client firewalls
Identity & access management
Intrusion detection and prevention
Network traffic intelligence
Next generation firewalls (NGFW)
VPN and other secure web gateways
Security incident & event management (SIEM)
Unified threat management (UTM)
Web application firewalls (WAF)
Other
Total

FY 2018
95%
38%
31%
42%
55%
62%
20%
25%
38%
14%
29%
28%
88%
41%
64%
21%
28%
63%
33%
13%
36%
1%
864%

FY 2017
96%
41%
27%
36%
49%
52%
22%
25%
41%
14%
28%
27%
89%
39%
62%
22%
29%
62%
30%
12%
36%
2%
842%

Q35. In your opinion, what are the most vulnerable endpoints or entry
points to your organization’s networks and enterprise systems?
Desktops
Laptops
Tablets
Smart phones
Web server
Intranet server
Routers
Portable storage devices (including USBs)
Cloud systems
Mobile devices
IoT devices*
Other (please specify)
Total

FY 2018
19%
49%
19%
40%
33%
42%
6%
7%
42%
55%
41%
1%
356%

FY 2017
21%
43%
20%
39%
30%
36%
6%
8%
38%
56%
2%
300%

*Internet of things

Ponemon Institute© Research Report

Page 42

Part 7. The cost of compromises
Q36a. Approximately, how much did damage or theft of IT assets andinfrastructure cost your organization over the past 12 months?
We had no compromises
Less than $5,000$5,001 to $10,000$10,001 to $50,000$50,001 to $100,000$100,001 to $250,000$250,001 to $500,000$500,001 to $999,999$1 million to $5 million$5 million to $10 million
More than $10 million
Total
Extrapolated value (US$)*UK amount was converted from GBP to dollars
Q36b. Approximately, how much did disruption to normal operations
cost your organization over the past 12 months?
We had no compromises
Less than $5,000$5,001 to $10,000$10,001 to $50,000$50,001 to $100,000$100,001 to $250,000$250,001 to $500,000$500,001 to $999,999$1 million to $5 million$5 million to $10 million
More than $10 million
Total
Extrapolated value (US$)
Q37a. Have you had an attack involving the compromise of employees’
passwords in the past year?
Yes
No
UnsureTotal
Q37b. If yes, how much did each attack cost your organization?
Less than $10,000$10,001 to $50,000$50,001 to $100,000$100,001 to $250,000$250,001 to $500,000$500,001 to $1,000,000
More than $1,000,000
Total
Extrapolated value (US$)

Ponemon Institute© Research Report

FY 2018
32%
8%
2%
5%
5%
7%
9%
8%
11%
11%
2%
100%

FY 2017
34%
8%
2%
6%
6%
8%
8%
9%
10%
6%
1%
99%

$1,426,422$1,027,053

FY 2018
32%
8%
2%
6%
4%
7%
9%
8%
10%
7%
5%
100%

FY 2017
33%
8%
2%
6%
4%
10%
9%
9%
9%
6%
3%
100%

$1,562,124$1,207,965

FY 2018
40%
52%
8%
100%
FY 2018
3%
7%
14%
29%
22%
13%
12%
100%
$383,365

Page 43

Part 8. General Data Protection Regulation (GDPR)
Q38. Is your organization required to comply with GDPR?
Yes
No [Skip to Part 9]
Unsure [Skip to Part 9]
Total

FY 2018
72%
19%
9%
100%

Q39. If yes, did compliance require significant changes in your privacy
and security strategies?
Yes, significant change
Yes, some change
Yes, nominal change
No change
Total

FY 2018
41%
41%
11%
7%
100%

Q40. Using the following 10-point scale, please rate your organization’slevel of compliance with the GDPR. 1 = not ready and 10 = ready.
1 or 23 or 45 or 6
7 or 89 or 10
Total
Extrapolated value

FY 2018
18%
23%
20%
21%
19%
100%
5.48

FY 2017
37%
37%
18%
8%
100%

Part 9. Role & Organizational Characteristics
D1. What best describes your position level within the organization?
Business owner
C-level executive/VP
Director
ManagerSupervisor
Staff/technician
Administrative
Consultant/contractor
Total

FY 2018
10%
12%
17%
20%
13%
23%
5%
1%
100%

FY 2017
10%
11%
17%
21%
12%
24%
4%
1%
100%

D2. Which of the following commands do you report to in your current
role?
Business owner / board
CEO/executive committee
COO or head of operations
CFO, controller or head of finance
CIO or head of corporate IT
Business unit leader or general manager
Head of compliance or internal audit
Head of risk management
Head of IT security
Total

FY 2018
12%
10%
16%
3%
23%
15%
4%
5%
11%
100%

FY 2017
12%
9%
16%
3%
27%
13%
4%
5%
11%
100%

Ponemon Institute© Research Report

Page 44

D3. What best describes your organization’s primary industry
classification?
Aerospace & defense
Agriculture & food services
Communications
Construction and real estateConsumer goods
Education & researchEntertainment, media and publishing
Financial services
Healthcare
Industrial
Logistics and distribution
Manufacturing
Pharmaceuticals
Public sector
Retailing
ServicesTechnology & software
Transportation
Total

FY 2018
1%
1%
2%
3%
6%
2%
1%
16%
7%
9%
1%
8%
2%
9%
12%
10%
8%
3%
100%

FY 2017
1%
2%
2%
3%
6%
2%
3%
14%
7%
9%
1%
8%
3%
9%
12%
9%
7%
2%
100%

Please contact research@ponemon.org or call us at 800.887.3118 if you have any questions.

Ponemon Institute
Advancing Responsible Information Management
Ponemon Institute is dedicated to independent research and education that advances responsible
information and privacy management practices within business and government. Our mission is to conduct
high quality, empirical studies on critical issues affecting the management and security of sensitive
information about people and companies.
We uphold strict data confidentiality, privacy and ethical research standards. We do not collect any
personally identifiable information from individuals (or company identifiable information in our businessresearch). Furthermore, we have strict quality standards to ensure that subjects are not asked extraneous,
irrelevant or improper questions.

About Keeper Security, Inc.
Keeper Security, Inc. (“Keeper”) is transforming the way organizations and individuals protect
their passwords and sensitive digital assets to significantly reduce cyber theft. Keeper is theleading provider of zero-knowledge security and encryption software covering password
management, cybersecurity, dark web monitoring, digital file storage and messaging. Keeper istrusted by millions of people and thousands of businesses to protect their digital assets and help
mitigate the risk of a data breach. Keeper is SOC-2 Certified and is also certified for use by theFederal government through the System for Award Management (SAM) and the General
Services Administration (GSA). Keeper protects businesses of all sizes across every majorindustry sector.

Ponemon Institute© Research Report

Page 45