2018 U.S.

State of Cybercrime
www.CSOonline.com
The 2018 U.S. State of Cybercrime Survey, in partnership with CSO, U.S. Secret Service, CERT Division of Software Engineering Institute at Carnegie Mellon University, and KnowBe4 2
Security Budgets On the Rise

2018 59% 38% 3% AVERAGE BUDGET

CHANGE

9.5%
increase
from 2017
2017 48% 46% 6%

Increased Remained the Same Decreased

Q. Compared with the fiscal year 2017 security budget, how did your organization’s fiscal year 2018 security budget change?

The 2018 U.S. State of Cybercrime Survey, in partnership with CSO, U.S. Secret Service, CERT Division of Software Engineering Institute at Carnegie Mellon University, and KnowBe4 3
Sophisticated Hackers Delay Threat Detection

92.2
108.5
Days days 35%
80.6 Days indicate it takes
Days longer than a month
Enterprise: 151.4 days to identify intrusions
SMB: 56.6 days on their network
UP FROM 28%
LAST YEAR

2016 2017 2018

Q. On average, how much time passed between the date you believe an intrusion began and the date it was discovered?

The 2018 U.S. State of Cybercrime Survey, in partnership with CSO, U.S. Secret Service, CERT Division of Software Engineering Institute at Carnegie Mellon University, and KnowBe4 4
Who’s Causing these Cyberattacks?

Insiders
25% 36%
of security attacks
Outsiders attributed to an
75% insider are said to
be unintentional/
Financial
Services: 84%
accidental

Q. You indicated that your organization experienced at least one cyber security event the past 12 months. What percentage of these events are known or suspected to have been caused
by: AND Of the security incidents you know you experienced and for which you were able to attribute to an insider, what do you believe was the motivation behind the attacks?

The 2018 U.S. State of Cybercrime Survey, in partnership with CSO, U.S. Secret Service, CERT Division of Software Engineering Institute at Carnegie Mellon University, and KnowBe4 5
Organizations Hope to Derail Attacks by…

Adding new technologies 46%

Conducting audits & assessments 34%

Adding new skills & capabilities 32%

Redesigning our cybersecurity system 24%

Redesigning processes 18%

Participating in knowledge sharing 11%

Q. To address cyber-risks, are your investments and spend focused on:

The 2018 U.S. State of Cybercrime Survey, in partnership with CSO, U.S. Secret Service, CERT Division of Software Engineering Institute at Carnegie Mellon University, and KnowBe4 6
Ability to Respond to a Security Incident

Yes
Yes 65%
Enterprise: 78%
Yes, and we test it
44% SMB: 53%

85%
at least once per year

Yes, but we do not test

it at least once per year 21%
of financial
No
No 26% organizations have
a formal incident
No plan currently, but intend to have
one within the next 12 months 16% response plan
No plans at this time
69% test it at least
or in the near future 10% once per year

Don’tDon't
know know 9%

Q. Does your organization have a formal incident response plan?

The 2018 U.S. State of Cybercrime Survey, in partnership with CSO, U.S. Secret Service, CERT Division of Software Engineering Institute at Carnegie Mellon University, and KnowBe4 7
Majority of Employees Receive Security Training at Least Once a Year

29%

6%
of employees
are only trained
when hired
15% 15% 15% are never trained

7%
5%
2%

Less than Once per Twice per Quarterly Monthly Weekly Continually
annually year year

Q. How frequently are your employees trained on security awareness?

The 2018 U.S. State of Cybercrime Survey, in partnership with CSO, U.S. Secret Service, CERT Division of Software Engineering Institute at Carnegie Mellon University, and KnowBe4 8
Conclusions

• Cyberthreats continue to be top of mind, as 66% report they are most concerned about cybersecurity
threats this year than they were in 2017.

• The average number of cybersecurity events decreased this year to 107.2 – however this increased to
195.9 for enterprise organizations.

• The majority of attacks continue to come from outsiders, and these also prove to be the most costly for
39% of organizations.

• 66% of organizations have a methodology in place that helps you determine the effectiveness of your
organization's security programs based on clear measures.

• Security awareness training should be a top priority, as 29% of security decision-makers report that their
employees are only trained once a year.

The 2018 U.S. State of Cybercrime Survey, in partnership with CSO, U.S. Secret Service, CERT Division of Software Engineering Institute at Carnegie Mellon University, and KnowBe4 9