A recent survey by the Ponemon Institute entitled, “Cyber Security Incident Response: Are We as Prepared as We Think?,” suggests that many companies lack the mechanisms to meaningfully address cyber risk. Among the survey’s findings:

• Although companies recognize that better incident response capabilities would mitigate the harm cyber attacks cause, most companies devote less than 10 percent of their security budget to incident response and this percentage has remained static over the past 24 months.
• Most organizations do not track the time to identify and respond to incidents or the effectiveness of the response. As a result, organizations have no means to measure the actual time and costs involved in managing cyber risk.
• Companies are overly optimistic about the time to identify intrusions and address any damage the attack caused. Many respondents estimated that attacks could be identified in hours. As breaches at Target and Verizon have shown, identifying a cyber attack can take months or even years and fixing the problem could take just as long.
• Organizations can reduce reputational harm by promptly and credibly communicating with the public about data breaches. Yet only 23% of the companies have a public relations plan in place in the event of a security breach. 
• Executive management and boards are seldom engaged in cyber issues and thus remain in the dark about the real nature of the threat.

A growing number of companies have recognized the need for cyber risk insurance. Yet for this market to continue to grow, perceptions about cyber threats must shift. Companies cannot appreciate the need for insurance without better understanding the actual costs involved in responding to cyber attacks.       

To learn more about the Ponemon survey, click here.