[go: up one dir, main page]
Menu
Stats, Trends, and Quotes
Trend Federal agencies disclosed 32,211 cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) in FY2023, marking a 9.9% surge from the 29,319 incidents reported in FY2022Stat According to FISMA, 38% of cyber incidents in FY2023, totaling more than 12,000 cases, stemmed from improper usage, indicating violations of acceptable use policiesTrend Email phishing emerged as the second most prevalent cybersecurity attack vector against Federal agencies, with a more than 50% increase in 2023 compared to the previous yearStat 60% of agencies operated an effective information security program from FY2020 to FY2023. Additionally, all cybersecurity function areas – except for identity – increased in overall maturity governmentwideQuote “If you’re building a home, you’re going to build from the ground up. If you’re going to build zero trust, you’re going to build it around the base infrastructure – users, devices, and networks – before you focus on apps and data” – Bo Berlas, Chief Information Security Officer, General Services Administration (GSA)Trend 90% of Federal OT leaders report an increase in their agency’s prioritization of OT cybersecurity in the past two yearsStat Two-thirds (68%) of federal OT leaders say their agency experienced an OT-related cyber incident in the past year, and only half feel confident they could detect and mitigate additional threatsQuote "More secure software is our best hope to protect against the seemingly never-ending scourge of cyberattacks facing our nation" – Jen Easterly, Director, Cybersecurity and Infrastructure Security Agency (CISA) Stat 55% of Federal IT leaders share concerns that their organization may not be able to detect a data breach in time to protect data and two-thirds (66%) are concerned that their data infrastructure may not be resilient enough to recover all data if they were faced with a ransomware attackTrend The percentage of cyber attacks involving vulnerability exploitation as the critical path to initiate a breach nearly tripled (180% increase) from 2023 to 2024 Stat 35% of Federal cyber leaders say their agency is using AI for cybersecurity today; another 58% are actively working toward adoption Stat Less than 1 in 3 Federal cyber leaders fully trust AI to automate cybersecurity decisionsStat 81% of Federal cyber leaders say accelerating AI adoption is critical to their agency’s resilience against evolving threats Trend As technology evolves, 86% of Federal cyber leaders feel human-AI collaboration will become the cornerstone of effective cyber strategies Stat 55% of Federal agencies implementing or utilizing AI for cybersecurity have successfully detected a vulnerability, 53% have gained information on the threat landscape, and 51% have proactively responded to a threatStat The Defense Information Systems Agency (DISA) expects to roll out its Thunderdome program to 60 sites in fiscal year (FY) 2024 – thus far the agency has deployed the zero trust program to 23 sitesQuote "You can build, you can operate, you can maintain, but if you’re not securing, at the end of the day you’re not going to be able to operate effectively" – Jen Easterly, Director, Cybersecurity and Infrastructure Security Agency (CISA) Stat 83% of TMF investments awarded since 2021 have been focused on cybersecurityQuote "Zero trust integration offers the most robust and reliable approach to cybersecurity, ensuring that our systems are resilient against evolving threats, while safeguarding our nation’s interests " – David McKeown, Deputy Chief Information Officer (CIO), Department of DefenseQuote “If you look at our funding, and if you look at our cyber investments we’re making and the time we’re spending, zero trust is first and foremost among what we’re doing" – John Sherman, Chief Information Officer (CIO), Department of Defense Stat President Biden's proposed FY25 budget allocates $13 billion in cybersecurity funding across the Federal government. This includes $103 million for the Cybersecurity and Infrastructure Security AgencyQuote “A greater emphasis is needed on human-centered approaches to cybersecurity where people’s needs, motivations, behaviors, and abilities are at the forefront of determining the design, operation, and security of information technology systems” – Federal Cybersecurity Research and Development (R&D) Strategic PlanQuote "If your agency is inching towards zero trust now, you probably want to look at accelerating that greatly to try to best keep up with the pace at which AI can start influencing" – Ken Bailey, Acting Deputy Branch Chief of Cyber Defense Coordination and Threat Hunting, Cybersecurity and Infrastructure Security Agency (CISA)Stat GAO reports that 15 of 23 inspectors general (IGs) from CFO Act agencies found their current FISMA programs to be ineffective. Going forward, the agencies and IGs said they want metrics that are directly tied to performance goals, account for workforce issues and agency size, and incorporate riskStat HHS has found a 93% increase in large breaches reported to the HHS Office for Civil Rights (OCR) from 2018 to 2022 – with a 278% increase in large breaches involving ransomwareQuote “The healthcare sector is experiencing a significant rise in cyberattacks, putting patient safety at risk. These attacks expose vulnerabilities in our health care system, degrade patient trust, and ultimately endanger patient safety ... HHS takes these threats very seriously, and we are taking steps that will ensure our hospitals, patients, and communities impacted by cyberattacks are better prepared and more secure" – Andrea Palm, Deputy Secretary, Department of Health and Human ServicesQuote "Ten to 15 years ago, the Federal government’s cybersecurity posture was largely reactive. We’ve gone from blindly trusting networks that have hardened outer defenses – and that may be connected to other similarly architected networks and environments – to a much more fluid, borderless way of interconnecting our enterprise information technology" –Sean Connelly, Senior Cybersecurity Architect, Cybersecurity and Infrastructure Security Agency (CISA)Stat One out of three Federal IT decision-makers say their agency is not advancing its identity security practices fast enough to address zero trust and cloud initiativesStat 87% of Federal IT decision makers believe modern identity at scale has moved beyond human capacityQuote “As we focus on the emergence of these new technologies [like AI, blockchain, or quantum computing] … we’re going to have to increase [identity] services to be able to continue to really protect and validate the authentic from the artificial” – anonymous Federal agency cybersecurity lead Stat The FBI found that adults ages 60 and older lost nearly $1.1 billion to scams involving cryptocurrency in 2022, a reported increase of nearly 350 percent from 2021Quote “As artificial intelligence technology becomes more prevalent, it presents opportunities to protect consumers but it can also pose privacy and safety challenges" – The Federal Communications Commission (FCC)Stat The global cybersecurity workforce gap has grown by 13% since 2022, indicating the need to fill an additional four million cybersecurity jobsStat 84% of U.S. executives plan to prioritize generative AI cybersecurity solutions over conventional cybersecurity solutionsQuote "Over the past seven years, the cybersecurity landscape has changed dramatically, and our doctrine around cyber incident response and coordination must evolve as well” – Eric Goldstein, Executive Assistant Director, Cybersecurity and Infrastructure Security Agency (CISA)Stat Nearly 96% of global CISOs claim they fell victim to a ransomware attack within the past year, and 83% paid the ransom demand. Of those who paid, over 50% paid more than $100,000, and 9% paid $1 million or moreStat 70% of global security leaders say AI benefits attackers more than defenders. The most anticipated use cases are faster and more efficient attacks (36%), voice and image impersonations for social engineering (36%), and an expanded supply chain attack surface (31%)Stat Federal cybersecurity leaders would most like to see their agency build its capabilities in: Developing and implementing advanced threat detection and incident response (65%), implementing proactive security measures for cloud-based infrastructure and services (65%), and enhancing the recruitment and retention of highly skilled cybersecurity professionals (61%)Stat One in three Federal cybersecurity leaders say their agency is not advancing its identity security practices fast enough to address zero trust and cloud initiatives Quote "We’ve got to bring risk down to a manageable level … Nobody is saying that we’re going to one day not have to talk about security. It’s just that we’ve got to get to a point where we can manage these risks and understand them and be able to prioritize effort” – Chris DeRusha, Federal Chief Information and Security Officer (CISO)Stat While just 16% of Federal cybersecurity leaders have implemented attribute-based access control (ABAC) today, another 49% are piloting a proof of concept or working on implementationQuote “Cybersecurity professionals have a long history of using tools and techniques supported by AI to prevent, and respond to, malicious cyber activity. Protecting our nation’s cyber infrastructure requires leveraging all tools at our disposal, including applying AI techniques to improve cybersecurity defenses in organizations of all sizes and technical capacity” – Sens. John Hickenlooper, D-Colo., and Thom Tillis, R-N.C.Quote “We know that foreign adversaries plan and are currently collecting encrypted data from public and private entities with plans to decrypt it later when they have access to a sufficiently developed quantum computer” – Dylan Presman, Director for Budget and Assessment, White House’s Office of the National Cyber Director (ONCD)Quote "When we look at the latest ransomware trends and how people are attacking us, phishing used to reign supreme, but it’s interesting those latest numbers have shifted ... Now, vulnerabilities are the number one attack vector for ransomware, and then the second most common is credential abuse” – Steven Hernandez, Chief Information Security Officer (CISO), U.S. Department of EducationStat 80% of breaches of government agencies and private entities used “compromised identities” to infiltrate and bypass securityQuote “Identity is becoming the quintessential security technology in many ways, if it isn’t already there, and we think that embracing that and modernizing our approach is really an important priority” – Grant Dasher, the Architecture Branch Chief for the Office of the Technical Director for Cybersecurity at CISAQuote “We need to ensure that our cybersecurity workforce looks like America. America’s diversity is indeed our superpower. There’s no other country like ours. And we’ve just begun to tap into the capabilities of our full population” – Kemba Walden, acting National Cyber DirectorQuote “We must support the development of a strong cyber workforce ... That cyber workforce has to meet the demand that we have all heard about in filling hundreds of thousands of cyber jobs vacancies – that’s a national security imperative, an economic imperative, a human security imperative. But it also is an opportunity for good paying jobs – good paying, middle-class jobs” – Camille Stewart Gloster, Deputy National Cyber Director for Technology and Ecosystem SecurityStat 60% of DoD IT decision-makers say that when an operational issue arises, their organization struggles to determine if the root cause is a cyberattack or an equipment maintenance issue Stat 44% of cybersecurity professionals say they’ve seen an increase in exploits targeting their business VPNs over the previous year
  1. 1
  2. 2