T H E S TAT E O F D ATA S E C U R I T Y

Measuring your

DATA’S RISKCONTENTS

INTRODUCTION

03

DATA AND METHODOLOGY

04

Is Your Data at

14

RISK FROM ATTACKERS?
Is There

19

RISK IN YOUR DATA?
How Bad28

WILL IT BE?
Recovery37

TO RESET

Resetting

DATA RISK41

ACKNOWLEDGEMENTS

48

The State of Data Security: Measuring Your Data’s Risk|

2

This is a story about

DATA
The data types you own, how data changes,
and a pragmatic view of data threats.
It’s also a story about risk. How we measure it, our ability
to plan for it, how it changes, and its never-ending presence.
But first, let’s explain how we got here.

The State of Data Security: Measuring Your Data’s Risk|

3

DATA AND METHODOLOGYThe State of Data Security: Measuring Your Data’s Risk|

4

Rubrik Zero Labs strives to deliver actionable, vendor-agnostic insights to reduce data security risks.
To that end, we incorporated findings from four primary sources.

RUBRIK TELEMETRY = u

WAKEFIELD RESEARCH = s

RUBRIK PARTNERS = l

We utilized Rubrik
telemetry in an effort
to understand atypical organization’s
data estate and therisk realities.

Perspectives from1,600+ IT andsecurity leaders

Research andguidance from
two Rubrik partnerorganizations

RUBRIK TELEMETRY

CONTRIBUTINGORGANIZATIONS = n
Research fromrespected
cybersecurity
organizations
and institutionsu

Rubrik Zero Labs believes if organizations trust us with theirdata, we must be transparent about what their data tells
us. Speaking of transparency, here’s what makes up ourtelemetry and how it influences our perspective.
Note: This study contains the first use of Laminar-derived data.
Laminar is a leading data security posture management platform
acquired by Rubrik in 2023.

RUBRIK TELEMETRY INCLUDES:

6,000+
68
42 EB

Total volume of data secured:• 42 exabytes of logical storage• 963 backend petabytes (BEPB) of
physical storage

clients
38.4+ billion sensitive data records

countries

secured with 38.4+ billion
sensitive data records
Data covers 1 Jan 2023 through 31 Dec 2023

The State of Data Security: Measuring Your Data’s Risk|

5

EB vs. BEPB

How much is 42 EB?

A reminder from the data nerds: When most of the worldhears “data,” they think of logical storage, also known
as frontend storage. Those of us in the data businessfocus on backend storage. Rubrik takes the entirety of anorganization’s data and performs a number of different
techniques—including deduplication and compression—to
reduce the amount of frontend data to backend storage.
We’ll use backend storage throughout this report.

Think about your healthcare record with all the forms,
images (x-rays, MRIs, etc.), notes, and other data. If you’relike most people, your healthcare record is about 80MB.

WAKEFIELD RESEARCH
We partnered with Wakefield Research to conduct a study
that gathered additional insights from both IT and security
leaders. This data supplements our Rubrik telemetry to give
us insight into both the leaders’ point of view and what
they see on the ground. No Rubrik clients are included inthis dataset to be as objective as possible.

1,600+
1050%+

IT and security leaderscountries

CIO or CISOs

If Rubrik’s 42 EB of protected data consisted of nothing
but healthcare records, it would be the equivalent of five
healthcare records for every one of the 117 billion people
who lived on earth for all of humanity’s history. It’s like… a lot.

s

1,625
decision-makers at companies with at least 500
employees across 10 countries (United States,
UK, France, Germany, Italy, Netherlands, Japan,
Australia, Singapore, India) in three regions(Americas, EMEA, and APAC)

50%

50%

50%

50%

CIOs or CISOs

Directors or VPs

IT decision-makers

Security decision-makers

The State of Data Security: Measuring Your Data’s Risk|

6

RUBRIK PARTNERSl

We leveraged datasets and received guidance from two Rubrik partners in ongoing efforts to improvedata resiliency.

Microsoft provided data from the 2023 Microsoft Digital
Defense Report1, specifically data exfiltration rates andresiliency recommendations.

Aon provided data from the 2023 Aon Cyber Resilience
Report2, specifically data backup realities and post-intrusion
outcomes.

CONTRIBUTING ORGANIZATIONSn

Rubrik included key data from various organizations with unique visibility comparedto Rubrik telemetry in an effort to provide as objective a view as possible.

1
2
3

Mandiant provided dwell times
observed in its incident response/MDR
events across 20233.

Palo Alto Networks Unit 42 provided
findings on ransomware demands
and payments from their incident
response/MDR events across 2023.

Recorded Future provided publicly
reported ransomware trends
across 20235.

The University of Minnesota Twin Cities - School of Public Health provided
ransomware impacts on public health institutions based on their research“Hacked to Pieces? The Effects of Ransomware Attacks on Hospitals andPatients6,” which is published and currently undergoing final peer review.

https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023
https://www.aon.com/2023-cyber-resilience-report/
https://www.mandiant.com/m-trends

456

Proofpoint provided
information on cloud targeting
based on their 2023 Human
Factors Threat Report4.

https://www.proofpoint.com/us/resources/threat-reports/human-factor
https://therecord.media/ransomware-tracker-the-latest-figures
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4579292

The State of Data Security: Measuring Your Data’s Risk|

7

LET’S TALK ABOUT RISK
Let’s set the ground rules for how
this study approached risk.

FIRST
We’re going to make the “risk math” easy:
What is thelikelihood yourdata will beaffected by an
external entity

What is therisk resident
in your data
today

The impact
that’s likely
to produceYourdecisions in
response to
the impacts

Risk MathIN YOUR FACE BIG MATH!

The State of Data Security: Measuring Your Data’s Risk|

8

SECOND
We’re going to focus on data.
As a data security company, our strongest
insights involve an organization’s data—
as opposed to its infrastructure orarchitecture—so we focus on risks inand to your data.
Specific Focus Areas
Let’s be honest. You’re busy. None of us
have time for a full deep-dive on every
aspect of data security. We intentionally
narrowed this study to a few key topics:

Cloud
The existence of commercially available clouds can
now be measured in decades. Yet, confusion aboutcloud data security remains. The cloud is targetedwith more frequency—and more success—than its
on-premises counterparts. It also contains blind
spots making it difficult to defend.
Ransomware
Not too long ago, experts predicted ransomware’s
decline. It didn’t really happen, and ransomware
continues to wreak havoc on organizations of
all kinds.
Healthcare
With few exceptions, healthcare organizations
produce and store more sensitive data and are
subject to more regulatory scrutiny than otherindustries. A fringe benefit of the regulatory
pressures on healthcare is more publicly available
data to study.

THIRD

Who is this study for?

Intelligence should inform theright decision-maker, and risk
decisions typically happen at
the senior-leader level.

Our goal is to inform andaid these senior-leader
discussions across business,cybersecurity, andIT functions.

By giving these decisionmakers a common place tostart from, they’ll be better
prepared to tackle
risk together.

The State of Data Security: Measuring Your Data’s Risk|

9

NOW LET’S TALK A LITTLE BIT ABOUT
HOW PEOPLE PERCEIVE RISK.
Humans don’t deal with uncertainty well.
When faced with the possibility of something
happening, we like to think either:“YES, THIS MOST
DEFINITELYWILL HAPPEN.”

IN REALITY,
THINGS ARE A
BIT MORE SQUISHY“NO, THIS
DEFINITELY WON’T
HAPPEN.”The State of Data Security: Measuring Your Data’s Risk|

10

If a meteorologist tells you there’s a 52% chance of rain inyour area, they’re not telling you definitively,“Yes, it will rain,” or “No, it won’t.”

The State of Data Security: Measuring Your Data’s Risk|

11

Then there’s the details we really want:
How much rain? Is it a sprinkling or adeluge? Do I just stay home? Because I
didn’t want to go to the office anyway.
These decisions are yours andyours alone.

It would be nice if you only had to makethese decisions once.
But … it just doesn’t work that way.

The State of Data Security: Measuring Your Data’s Risk|

12

Today’s reaction to rain impacts how we think
about tomorrow’s weather report and also provides
lessons learned in dealing with the rain.
These factors combine to set new conditions thenext time we have to tackle the storm. That’s true ofthe rain, and it’s true of cyber risk.
Let’s start with the external
threats you should consider.

The State of Data Security: Measuring Your Data’s Risk|

13

Is Your Data at

RISK FROM ATTACKERS?

The State of Data Security: Measuring Your Data’s Risk|

14

Let’s start with a basic question:

Are attackers likely to target my data?

Is Your Internet-Connected
Fridge Trying to Kill You?

Ransomware Shifting
to ESXi is a Massive
Evolution

HOW MUCH OF YOUR
NEWSFEED IS REALVERSUS FUD?

How Attackers areReally Using AI

The Mother of All Data
Breaches: Biggest Data
Loss Ever(Fear, Uncertainty, Doubt)

Is This the Next
Solarwinds?

Why Strawberry Tempest
is Worse than Lapsus$

Nobody can tell you with 100% certainty if you’ll
be hit with a cyberattack, but we can tell you
what happened to your peers last year.

The State of Data Security: Measuring Your Data’s Risk|

15

Almost all your peers dealt with cyberattacks about every other week.
Here’s what last year looked like across IT and security leaders: s

94%

of IT and security leaders reported theirorganization experienced a significant
cyberattack last year.

30

The average frequency was 30 malicious
events brought to senior leaders’ attention
across 2023.

93%

of external organizations conducted aformal data loss notification to a governingorganization.

Cyberattacks are far more likely than physical theft or fire.
To put the likelihood of cyberattacks into perspective,
a European insurance company1 compared cyberattacks
to traditional threats in the same timeframe and found:

67%
5x
20%

Organizations are 67% more likely to experiencea cyberattack than physical theft.

Organizations are five times more likely
to experience a cyberattack than a fire.

of organizations do not know what actions
to take in the event of a cyberattack.

1	https://www.aviva.com/newsroom/news-releases/2023/12/One-in-five-businesses-have-been-victims-ofcyber-attack-in-the-last-year/

The State of Data Security: Measuring Your Data’s Risk|

16

Attackers are comfortable targeting hybrid environments.
So if you’re likely to be targeted, it’s useful to understand where
and what is likely to happen. Of the 94% of external organizations
victimized in a cyberattack, many were attacked across multiple
environment types: s

67% 66% 51%
SaaS

Cloud

On-Premises

And here’s some perspective on the two most common
types of attacks in these environments: s

38%of these organizations had at least
one data breach from a cyberattack.

33%of these victims endured atleast one ransomware attack.

Almost all cloud tenants were targeted,and 2 out of 3 were compromised in 2023.
We didn’t just find this in our own research. Proofpoint reported1: n

94%
62%
1	https://www.proofpoint.com/us/resources/threat-reports/human-factor

of cloud tenants were targeted
every month last year.

of targeted cloud tenants weresuccessfully compromised.

The State of Data Security: Measuring Your Data’s Risk|

17

Attackers have access to your data for days before being foundMandiant measures dwell time1 as the number of days an attacker
is present in a victim’s environment before detection.n

10 DAYS

5 DAYSTHE GOOD NEWS:THE BAD NEWS:

These are the shortest dwell
times ever observed by
Mandiant.

This still represents a significant
length of time for malicious actors
to accomplish their goals.

The global median dwell
time for a ransomware event
is 5 days.

The global median dwell
time across all events was
10 days last year.

YOU’RE NOT IMAGINING IT. THERE’S MORE RANSOMWARE (70% MORE).

n

Recorded Future tracked a significant increase in publicly reported ransomware attacks last year:

358 reported ransomware attacks against
healthcare (46% increase YoY).

4,399 reported attacks across allindustries (70% increase YoY).

Now let’s shift our focus and look at your data.
1

https://www.mandiant.com/m-trends

The State of Data Security: Measuring Your Data’s Risk|

18

Is There

RISK IN YOUR DATA?

The State of Data Security: Measuring Your Data’s Risk|

19

If you know the odds of an attack (and let’s face it, they aren’t great), it
makes sense to do everything you can to minimize your risk by reducing:

THE LIKELIHOOD OF AN
ATTACK SUCCEEDINGTHE
FROM AN ATTACK
At the end of the day, what we’re trying to do is deceptively
simple (on paper). We’re trying to protect:

THIS(our data)

FROM

THAT

(threats)

We must examine both sides of that equation.
Let’s take a look at what our operations expect
our defenders to secure.

The State of Data Security: Measuring Your Data’s Risk|

20

is growing rapidly and expanding
the defensive boundaries.

Healthcare defenders are responsible for securing
a larger data surface area, with more sensitive data,
and that is growing faster than the global average. u

Healthcare organizations secure 22%
more data than the global average.

WHAT’S A BETB AGAIN?
EB vs BEBP
A reminder from the data nerds:
When most of the world hears “data,”
they think of logical storage, also
known as frontend storage. Thoseof us in the data business focus onbackend storage. Rubrik takes theentirety of an organization’s dataand performs a number of different
techniques—including deduplicationand compression—to reduce theamount of frontend data to backend
storage. We’ll use backend storage
throughout this report.

The State of Data Security: Measuring Your Data’s Risk|

21

The typical healthcare organization saw their data estategrow by 27% last year (23% for a global organization).

A typical healthcare organization has 50% moresensitive data than the global average.

The State of Data Security: Measuring Your Data’s Risk|

22

Sensitive data records in healthcare grew by more than
63% in 2023—far surpassing any other industry andmore than five times the global average (13%).

ORGANIZATIONS HAD A RECORD-SETTINGNUMBER OF ISSUES TO TACKLE LAST YEAR.
Vulnerabilities are not a perfect exposure measure, but they do provide
a solid view on the scope and scale of inherited risk from vendors.

2022 was a record-setting
vulnerability year with the highest
reported amount ever:

25,083vulnerabilities discovered

2023 set a new record,
a 16% increase over theprevious record.

29,065vulnerabilities discovered

The State of Data Security: Measuring Your Data’s Risk|

23

ORGANIZATIONS ARE BECOMING MORE
DEPENDENT ON CLOUD AND SAASu

Demands on a modern business necessitate an increased focus on the cloud.
We see the nature of hybrid environments consistently moving towards
cloud and SaaS while deprioritizing on-premises architecture growth.

2022:

2023:

The State of Data Security: Measuring Your Data’s Risk|

24

THE CLOUD CONTAINSSECURITY BLIND SPOTS
Cloud Data Security

Cloud Data Security

Cloud Data Security

70% of all data in a typical cloudinstance is object storage. u

88% of all data in object storage iseither text files or semi-structured
files, such as CSV, JSON, and XML. u

More than 25% of all object storescontain data covered by regulatoryor legal requirements, such as protected health information (PHI) andpersonally identifiable information(PII). u

BLIND SPOT #1:
Object storage represents a common
blind spot for most security appliances
because it’s typically not machinereadable by these same technologies.

BLIND SPOT #2:
So let’s assume your tooling andprocesses can see inside object
storage. Here’s another issue:
Unstructured data (such as text files)
and semi-structured data represent
another blind spot for security because
these data types vary wildly in beingmachine readable and/or covered byprominent security technologies
and services.

BLIND SPOT #3:

Put simply, the cloud comes with
inherent risk because organizations
need it to function, but it also stores
regulated data with fewer security
capabilities and less visibility thanon-premises assets.

The State of Data Security: Measuring Your Data’s Risk|

25

MOST BACKUP SOLUTIONS ARENOT UP TO THE TASK.
Backup and recovery technologies are critical components for virtually all organizations.
They’ve been used for disaster recovery and business compliance for decades.
However, most organizations struggle getting these solutions to actually work.

1
2

99%

93%+

Rubrik Zero Labs previously stated1 morethan 99% of external organizations reported
having an existing backup solution. u

However more than 93% of theseorganizations encountered significant issues
with their existing solution. u

70%

40%

Aon reported2 70% of organizations do notstore backups offsite or their backups are
not immutable. l

Almost 40% of Rubrik-observed
organizations have not set compliancepolicies for their data backups. u

https://www.rubrik.com/zero-labs/2023-springhttps://www.aon.com/2023-cyber-resilience-report/

The State of Data Security: Measuring Your Data’s Risk|

26

BAD NEWS:
Cybercriminals are hip to the backup gameand routinely target backups.
Attackers almost universally attempted to remove backup and recovery options from defenders.
External organizations that reported a successful attack observed: s

96%

Attackers tried to affect the backups in 96% of these attacks.

74%

And were at least partially successful in 74% of those attempts.

Cybercriminals are taking out insurance policies
against effective restores
Attackers are evolving their approach to ransomware based on defender actions. Instead of simply encrypting data,
cybercriminals also steal data and threaten to publish it. If their target can thwart the encryption event with a swift recovery,
ransomware actors have another way to drive a payout.

2x

12%

93%

Microsoft determined the numberof times threat actors potentiallyexfiltrated data after an initial
compromise has doubled sinceNovember 2022. ●Aon assessed data breaches
have a 12% higher overall
impact on organizations thanransomware alone. ●93% of external organizations that
endured a successful ransomware
attack reported paying a ransom
demand with 58% of these payments
motivated by threats to leak stolen
data. ▲

Now that we know the likelihood,
let’s take a look at the impact.
The State of Data Security: Measuring Your Data’s Risk|

27

How Bad

WILL IT BE?

The State of Data Security: Measuring Your Data’s Risk|

28

The State of Data Security: Measuring Your Data’s Risk|

29

Going back to our weather forecast example,
the story of your day doesn’t end when it rains.
You still have to live your life. But now you need to adjust
to the conditions. How are you going to stay dry? Does
the dog get walked in the rain? What happens when
you inevitably get rained on?

Likewise, a cyberattack sets off a whole slew
of remediation, recovery, and reporting efforts.
How painful these efforts are depends on how well you
prepared for these outcomes in the first place.
Let’s look at the fallout from cyberattacks, specificallyransomware, against healthcare organizations last year.

THIS IS WHAT HAPPENS AFTER THE CYBERATTACK.
Approximately 1 in 3 Americans
had their personal records
compromised during healthcare
intrusions last year1.

people (on average) were affected during asingle cyberattack against healthcare last year.

1

https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

The State of Data Security: Measuring Your Data’s Risk|

30

Ransomware attacks on healthcare organizations impact
almost five times more sensitive data than the global average. u
Rubrik measures both the ransomware encryption blast radius and the sensitive data impacted
by this blast radius. Impacted files include encrypted files, deleted files, and exfiltrated files.

Here’s the impacted data for a typical healthcare ransomware encryption event in a production environment:

Healthcare organizations:

16.8M

total impacted files
per encryption event.

8.4M
20%

sensitive data records withinthese impacted files.

of a typical healthcare organization’s
total sensitive data holdings impacted
every time there is a successful
ransomware encryption event.

The average global organization at large typically experiences a much smaller impact to its sensitive data.

1.7M
6%

million sensitive data records
affected per encryption eventof an organization’s total
sensitive data

The State of Data Security: Measuring Your Data’s Risk|

31

Virtualization really matters for healthcare and ransomware. u
Now let’s examine where ransomware encryption happens.

97%

of healthcare encrypted
data is within virtualizedarchitecture.

83%

of all industries’ encrypted
data is within virtualizedarchitecture.

This is likely driven by two factors.

1:
2:

Virtualized architectures typically have less security coveragecompared to traditional endpoints. This creates security deadspots and simultaneously allows attackers unfettered access.
Once attackers gain access to virtualization control panels,
they can often move at speed and scale using only
compromised credentials.

The State of Data Security: Measuring Your Data’s Risk|

32

RANSOM PAYMENTS VARY WILDLY.
Initial ransom demands are often higher than the actual payouts. Palo Alto Networks Unit 42 noted
the following trends in ransom payments across last year: n

ALL INDUSTRIES:HEALTHCARE:Median demand$800,000$200,O00

Median payment$275,000$100,000Median of Top Five Largest Payments$25,000.000$297,000

Backups and data theft greatly affect a victim’s likelihood to pay a ransom.
The University of Twente1 studied factors that caused victims to pay a ransom and separately what impacted
the size of an actual ransom payment. Their findings indicated:
Organizations with recoverable backups were1

https://databreaches.net/university-of-twente-maps-decision-making-process-for-ransomware-victims/#:~:text=for%20the%20best-,article,-.

The State of Data Security: Measuring Your Data’s Risk|

33

Data exfiltration led to a higher likelihood of paying aransom and higher ransom payment amounts.

40%
25%
5.5x

Paid the ransom with data exfiltration.

Paid the ransom without data exfiltration.

larger ransom payments were made when data exfiltration
was involved, compared to encryption-only events.

Storage overload: The recovery blindside nobody sees coming
When it rains, it pours. Few organizations are prepared forthe data deluge caused by ransomware.
If a single healthcare ransomware event encrypts or modifies
16.8 million files, it essentially means the encryption event
created 16.8 million “new” files for the victim (compared to13.7 million new files for a typical global organization). u
These files are backed up as new files, which consumes
vast amounts of storage capacity at the moment of theencryption event.

The State of Data Security: Measuring Your Data’s Risk|

34

If a victim’s pre-ransomware storage is over 70% capacity,
this “new” data could max out an organization’s recovery
capacity within one to two weeks. u

encryption event

To make this problem more profound, ransomware
victims often need to create more “new data,” suchas: forensic images for analysis and immutable copies
for legal purposes. In many cases, response/recovery
workflows also require duplicate data. Put simply, a
victim must create even more new data as part of
the response process immediately after the attacker
created a large amount of new data.

In the 200+ recovery operations in the Rubrik Ransomware
Response Team’s history, this issue typically leads to one
of two outcomes. The organization either needs to:1:

Rapidly increase data capacity,which requires financial investments
and workforce pressures.

2:

Degrade recovery capabilities to slow data
growth, which in turn limits recovery options
in critical timeframes.

The State of Data Security: Measuring Your Data’s Risk|

35

RANSOMWARE FALLOUT DIRECTLYCONTRIBUTED TO AT LEAST 42 US DEATHS.
In any ransomware event, there’s the data impact. The
real risks–particularly for healthcare–are also measured inoperational impacts and lives. n
The University of Minnesota Twin Cities - School of Public
Health studied real-world impacts to hospitals and patientcare caused by ransomware events between 2016 and20211.They found:

1 in 4
While only 5% of US hospitals were directly affected byransomware during the study’s timeframe, an additional
20% of hospitals suffered ripple effects when patientswere transferred or diverted from the victim hospitals
to surrounding hospitals.

0.5-1%

20%

Patient care throughput dropped by 20%
across the first week of a ransomware attack.

These attacks aren’t just affecting
data, businesses, or individual
privacy anymore. There’s direct
evidence cyberattacks are a lifeand death issue.

12

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4579292
https://www.statnews.com/2023/11/17/hospital-ransomware-attack-patient-deaths-study/

A typical hospital lost between 0.5 and 1% of their total annual
revenue as a direct result of a single ransomware attack.

2-3 wks
Hospitals averaged two to three weeks for a return totypical patient care levels following a ransomware attack.

42-67 deaths
The fallout from ransomware attacks directly contributed
to the deaths of between 42 and 67 patients2.

The State of Data Security: Measuring Your Data’s Risk|

36

Recovery

TO RESETThe State of Data Security: Measuring Your Data’s Risk|

37

After the initial response is done and organizations
return to relatively normal operations, the fallout from aransomware attack continues producing risk impacts.

THERE’S BAD NEWS AND
GOOD NEWS HERE FOR US.
Cyberattacks impact our organizations and people.
Aon reported a major cyberincident resulted in a: l

9%External organizations
reported the following
direct impacts fromcyberattacks: sdecrease in shareholder value
per event.

44%

96% of senior IT andsecurity leaders reportedchanges to their emotional
and/or psychological state
as a direct result ofa cyberattack: s

Leadership forced to change

43%
Negative press and/or
reputational damage

37%
Lost revenue

36%
Customer Loss

53%
Increased anxiety pertaining
to current role

41%
Loss of trust amongst
colleagues and team members

38%
Worry over job security

33%
Loss of sleep or trouble sleeping

The State of Data Security: Measuring Your Data’s Risk|

38

Executives will need to be convinced theirorganizations can recover from the next attack.
of IT and security leaders are
extremely or very concerned
about their organization’s ability
to maintain business continuity
during a cyberattack. s

60%
28%

of external organizations believe their
Board of Directors or C-suite has little tono confidence in the organization’s ability
to recover critical data and applications
in a cyberattack. s

CYBERATTACKS PRODUCE PREDICTABLE PROBLEMS TO SOLVE.
Here are the most frequently identified problems during acyberattack and the most common changes organizations should
prepare to encounter after a cyberattack:External organizations provided the single biggest limitations they faced during a cyberattack: s

19%

18%

18%

17%

16%

Issues working
across a hybrid
environment

Lack ofalignment
across teams

Ineffective
backupand recovery
solutions

Lack ofleadership
involvement

Visibility
challenges

These are the most common changes external organizations encountered because of a cyberattack: s

24%

20%

19%

19%

18%

Increased seniorleader scrutiny

Changes incybersecurity
technology

Reworkingcybersecurity
plans andprocedures

Increasedaccountability
enforcement

Drop in morale
among IT or
cybersecurity
teams

The State of Data Security: Measuring Your Data’s Risk|

39

Cyberattacks can drive
positive outcomes.

Organizations prepared to capitalize on thesecrisis moments can reshape their future.

Aon reported companies that successfully
navigated a cyberattack saw an

18% shareholder

value increase compared to their peers. l

After a cyberattack, external organizations reported s

55%
Increased spending on newtechnologies or services

42%

37%

Switched vendors
or third party relationships

Hired additional
staff

You cannot eliminate risk, but you can influence
the risk cycle and affect your new risk baseline.
The State of Data Security: Measuring Your Data’s Risk|

40

Resetting

DATA RISKThe State of Data Security: Measuring Your Data’s Risk|

41

We’d love to tell
everyone those final
outcomes end the story,

but in truth it’s the
beginning of anotherchapter.

The State of Data Security: Measuring Your Data’s Risk|

42

JUST BECAUSE YOU WEATHEREDONE STORM DOESN’T MEAN IT’LL
BE THE LAST ONE YOU FACE.
In fact, you’ll almost certainly encounter another one
and that storm will bring new, perhaps unforeseen risks,with the potential to catch you off-guard.

We’d also love to tell you there are options
to change the risk factors controlled by
the attackers, but unfortunately our
analysis tells us that pursuit is almost as
futile as trying to control the weather.
Like most things in life, you cannot control
what happens to you, but the good news
is you can control the risk reset andsubsequent impacts.
Let’s dig into the data on how to successfully
navigate the risk reset. Each of the risk
recommendations is derived from findings
about the cyberattacks, the data impacts,or the expected outcomes.
The State of Data Security: Measuring Your Data’s Risk|

43

WHAT ACTUALLY IMPACTS YOUR NEW DATA RISK?
Here are the most impactful levers you canpull to significantly improve your data risk:

Prepare to challenge attackers
across all aspects of a hybrid
environment. Attackers are
already working successfully inhybrid environments, and ourorganizations are moving that way.

Increase your data visibility,
specifically:• Expand your view across all aspectsof hybrid environments.
• Know where your sensitive data is
located and what type of regulatory
aspects apply to specific data elements.
• Prepare to address new leader
scrutiny and demonstrate how
recent investments will lead toanticipated outcomes.

Anticipate increased leadership
scrutiny and proactively
communicate your efforts
following a cyberattack.

Prepare to recover, and prepare forattackers to contest your recovery.
This includes:• Ensure backups are fully immutable and available
during a cyberattack.
• Automate as much of the recovery process as
possible.
• Test recovery outcomes across hybrid environments.
• Leverage existing security services and technologies
to test the immutability and integration of backup
technologies.

The State of Data Security: Measuring Your Data’s Risk|

44

Know your data (especially your sensitive data)
is growing. Learn to control that growth andprioritize the defense of critical data.

Prepare to answer regulatory and legal questions in
the middle of a ransomware event with an actively
encrypted environment and attackers threatening
to leak stolen data.

Know that cyberattacks often lead to newtechnology, increased staff, and switching vendors
or partners. Be prepared to capitalize on thesechange periods to make the most impact.

Communicate plans and outcomes regularly
across your entire organization to address
dropping morale from cyberattacks and re-instill
confidence across teams.

Find ways to unify different
teams before, during, and after
a cyberattack.
This includes:• Create combined playbooks and perform tabletop
exercises.
• Determine which team is best suited for specific risk
decisions.
• Establish the best way to get the right data to theassigned risk owner.
• Ensure all teams have the same data viewpoint
to enable faster decisions and decrease potential
resistance from competing viewpoints.

The State of Data Security: Measuring Your Data’s Risk|

45

ANOTHERPERSPECTIVE

Admittedly, Rubrik Zero Labs approaches risk
from a data-driven perspective. Let’s expand ourview to include key resiliency recommendations
from Microsoft’s 2023 Digital Defense Report1.
Microsoft’s vantage point is decidedly different
from Rubrik’s, which in turn, we hope,strengthens risk reduction efforts.

99%

Microsoft assesses basic security hygiene fordata will protect against 99% of all attacks.lSpecific recommendations are: l• Enable multi-factor authentication• Apply zero trust principles especially for assets securing
critical data and functions• Use extended detection and antimalware to cover criticalparts of hybrid environments• Keep up to date on patching key systems and applications• Protect your data by understanding what data is critical, whereis it located, and implementing appropriate defensive measures
for these enclaves

If we dive one level deeper to Microsoft’s view on ransomware, they advocate for“The Foundational Five” as the best path to eliminate ransomware impacts: l

1 2 3 4 5Modernauthentications
with phish-resistantcredentials

1

Least privileged
access applied
to the entire
technology stackThreat and risk-freeenvironments

https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023

Posture management
for compliance andthe health of devices,
services, and assets

Automatic cloud
backup and filesyncing for user
and businesscritical data

The State of Data Security: Measuring Your Data’s Risk|

46

We started this report by simplifying our risk math:We need to defend THIS from THAT.
In practice, risk is an incredibly complex topic

WHERE
ANOTHERONE MASSIVELYCOLLIDES EQUALLY NUANCED AND
COMPLICATED SURFACE WITHCONSTANTLY CHANGINGAREA (YOUR DATA)THREAT SURFACE AREA.

RISK

Because of the literal millions of variables involved, you’ll never
be able to fully pin down your risk—or completely eliminate it.
What you can do is get a handle on the most impactful levers,
work to address predictable outcomes, and take distinct actions
to change the risk calculus in your favor.
We hope this study provided some insight on data risk reduction
and prepares you for the evolving risk cycle.

The State of Data Security: Measuring Your Data’s Risk|

47

ACKNOWLEDGEMENTS
Rubrik would like to extend our appreciation to the organizations providing their hard-earned data
knowledge to this study.
• Our partners at Microsoft and Aon provided both
strategic direction and supporting data.
• The following organizations allowed us to use theiranalysis and provided clarifying material to ensure
appropriate categorizations:- Proofpoint- Recorded Future (Allan “Ransomware
Sommelier” Liska)- Mandiant (Kirstie “Swiftie” Failey)- Palo Alto Networks Unit 42 (Ingrid Parker)• The University of Minnesota Twin Cities School of
Public Health (Hannah Neprash, Claire McGlave,and Sayeh Nikpay) allowed us to leverage theirfindings, provided a deepdive into their research,
and worked with Rubrik Zero Labs to ensure theiracademic research aligned with Rubrik Zero Labs
industry research.

As with all things Rubrik Zero Labs, it takes a village to pull off these studies. Wakefield Research provided external data to makethis research as objective as possible. Shaped By found a way to take the data and bring it to life. Finally, many Rubrikans worked
hard to provide capability, context, and guidance. We’d like to extend a specific appreciation to Amanda “Danger” O’Callaghan,
Linda “Taskmaster” Nguyen, Lynda “Go Niners” Hall, Ben Long, Peter “I’m the Law” Chang, Ajay Kumar Gaddam, Ryan Goss, Derek
Morefield, Josh Burns, Gunakar Goswami, Prasath Mani, Ethan Hagan, Kevin Nguyen, Caleb “Social King” Tolin, Kelly Cooper, Hannah
Battillo, Sindhu Nagendra, Caitlin “Plz stop letting Steve talk to reporters” O’Malley, and Fareed Fityan.