By: Luke Secrist, CEO
This year endured a decent dose of cyber-immaturity slaps across the face. According to McKinsey & Company, at the current growth rate, damage from cyberattacks will amount to about $10.5 trillion annually by 2025 – a 300% increase from 2015.
Over the last several years, in the run-up to the new year, threats, attacks, and scams have risen, and that won’t be different in 2023. But the devil is in the details.
Here are five trends we’ve seen and expect to proliferate:
- Increase in Cyber Threats and Malicious Attacks. More criminal organizations will use cyber force to target critical infrastructure and operational technology. The level and breadth will be inconspicuous such as hacking transportation devices (i.e., streetlights) or hospital monitoring systems. With recent upticks in malicious attacks against hospitals and patient care establishments, cybercriminal actions can be especially damaging. Such attacks render trickle-down damage not only to the organization under attack but also to the patients at the mercy of the locked-down IT systems. In one incident, a hospital’s digital tools were taken down by ransomware, causing patient overdoses. In another, our team was able to gain access from an uncredentialed network into the ICU at a leading hospital and took control of their life support systems.
- Risks from Machine Learning Adaptation. Artificial intelligence (AI) and machine learning (ML) will become more of a commodity, and threat actors will leverage both to improve attack scale, success, and effectiveness. We expect an increase in advanced phishing attacks targeting users across applications. Using AI and ML to automate tasks, cybercriminals will build employee maps by “crawling” social networks using algorithms to create automated emails. We•ve deployed sophisticated phishing attacks with over 75% success rate – add AI and ML to automate deployment and the odds of success increase.
- More People on the Internet = More Likelihood of Cyber Threats. Internet dependence is not a new concept but a new reality. By 2025, more than 91% of people in developed countries and 69% in emerging economies will use the Internet. Increased access exposes people and devices to more threats, and when development environments speed up, security often isn’t top of mind. We’ve seen first-hand organizations invest in solid perimeter security appliances and not configure them properly. When we throw threats at a network, it should light up appliances, but we’ve seen zero response.
- Crypto Threats are Growing and Evolving. Phishing attacks with domain spoofing, malicious browser extensions, and malware that scans for crypto wallet passphrase keys have seen success in the last five years. As companies adopt cryptocurrency/payments, scammers will target crypto wallets and personal information. Companies selling NFTs with IPs, that many users want to buy, will put them at increased risk. Web3 has seen many unique attacks, but it is still built on Web2 technology, creating concern about attack surface potential. You cant secure your Web3 infrastructure if Web2 is susceptible.
- Breach Recovery Will Cost More. If cybercrime were measured as an economy, it would be the world’s third-largest after the U.S. and China. Attacks show no signs of slowing down. New tactics to siphon money are trending. Files are stolen from victims before encryption and threats to leak them on the dark web ensue. This “double extortion” method incentivizes victims to pay ransom even with a secure backup. Destruction of data, stolen money, theft of IP, personal and financial data, embezzlement, fraud, post-attack disruption to business, forensic investigation, restoration of hacked data and systems, and reputational harm are only some of the consequences.
Organizations need to consider these trends to improve their cybersecurity posture. But how? It starts by thinking differently.
Bolster your defense with offensive cybersecurity. Defense is one part, offense the other. Start with a conversation about issues and roadblocks. It’s better to uncover and discuss gaps than be breached. A strong defense is important but not enough. Most organizations question spending beyond compliance. Defense-based appliances, MSPs, and blue teams are critical; however, validating that the defenses work is equally necessary. You will never know susceptibility unless you simulate real threats.
Deploy Continuous Threat Simulation with Planned and Unplanned Attacks. Companies testing once a year for compliance are missing the point – it’s not enough. You need a continuous testing model that includes at least a dozen external tests each year, most of which should be unplanned. Hackers don’t work around your schedule. Consider how your organization will do with its guard down.
New threats will persist. Don’t ignore cyber-hygiene or validating your defense through strong offensive threat simulation. It’s like flossing your teeth. We know it’s important, yet most don’t do it. Avoid cyber-gingivitis and preventative care will never look the same.
About Luke Secrist, CEO
After serving in the U.S. Marine Corps and working as a security engineer in defense contracting, Luke wanted to start his own company – one that would transform the offensive cybersecurity landscape within all industries. Fueled by a vision to create something distinct from the rest, Luke envisioned a dynamic organization characterized by its creativity, highly specialized talent, and remarkable culture. Over the years, he’s assembled a top-notch team of engineers, managers, and professional hackers whose collective mission is to help organizations take a proactive approach to test their readiness against malicious adversaries.