Share This Article
Contents
Zero Trust security has come a long way since it was first introduced over 10 years ago. Initially, it took a while for it to gain traction, but the mass shift to remote work in 2020 brought to light the need for more comprehensive security that can account for distributed environments.
This need, combined with significant rises in cybercrime, drove more businesses to shed their traditional perimeter security for a better-fitting Zero Trust security model.
However, Zero Trust is far from universal: the business community seems to be in a transitional phase in terms of its adoption. The merits of Zero Trust are becoming generally accepted, but companies find themselves at different stages in their adoption journeys.
To better understand the current state of Zero Trust, we’ve pulled some of the most important stats that characterize today’s threat landscape, Zero Trust’s role within that landscape, and the resources and tools organizations are using to implement Zero Trust in their environment.
The Zero Trust Threat Landscape
We’ll start by examining today’s threat landscape: what are the top security threats, who is at risk, and what are the costs of being hit by an attack?
1. There were 70% more data breaches in 2022’s Q3 than in Q2.
2. The average cost of a data breach rose from $4.24 million in 2021 to 4.35 million in 2022, representing a 2.6% increase.
3. The gap in attack frequency between small and large businesses is closing.
In 2020, small businesses experienced about half the number of attacks as large enterprises did. In 2021, that number grew to 86%, creating a percent difference of only 15% between attacks on small and large businesses.
4. There were a total of 236.1 million ransomware attacks worldwide during the first half of 2022.
5. The average cost of a ransomware attack is about $4.54 million, not including the cost of the ransom itself.
That’s $380,000 more than a data breach that doesn’t involve ransomware. This cost doesn’t include the cost of the ransom payment, which averages $170,404.
6. Ransomware breaches take 49 days longer than average to identify and contain.
What Are New Ransomware Models?
Bad actors have begun franchising their ransomware attack methods. Paid ransoms in a ransomware attack go to the cybercriminals responsible, who then use the money to fund their next attack.
Because ransomware payouts are usually high, cybercriminal groups can afford to source many fast and skilled workers to plan and execute the next attack.
And because these operations aren’t held to the above-board standards of typical DevOps cycles, they can often work more nimbly than their legitimate counterparts.
This means ransomware often develops faster than the counter methods developed to thwart it, making ransomware security and prevention an uphill battle.
7. Credentials are the top data type involved in a breach.
8. Personal data is the second-most common type of data involved in a breach.
9. 81.4% of SME IT professionals agreed that remote work increased their focus on security.
What the Numbers Say
In the last three years, many businesses turned their sights to mission-critical work and away from security to stay afloat in a newly distributed working world.
This shift in focus led to frequent weak points in distributed infrastructures, which increasingly became targets for hackers as they perfected their techniques for methodically finding and exploiting common vulnerabilities in distributed infrastructures.
What’s more, cybercriminal groups are increasingly exploiting them with ransomware attacks that grow exponentially through exorbitant ransom payouts. Thus, the frequency and cost of breaches are up, making the need for Zero Trust security more critical than ever.
Zero Trust in Organizations Today
In such a treacherous environment, businesses need a security approach that can effectively guard against attacks and mitigate risks, should one occur. Let’s shift our sights to Zero Trust, including how well it stacks up against today’s threats, and how organizations are approaching its adoption.
10. Zero Trust reduces the cost of a data breach by about $1 million.
11. 41% of organizations said they have deployed a zero trust security architecture, while 59% said they haven’t.
12. 58.6% of US and UK SMEs are pursuing, or plan to pursue, a Zero Trust program.
13. Adding layered security so work-from-anywhere models are truly secure was named the number one priority for IT professionals at SMEs in both 2021 and 2022.
What the Numbers Say
Zero Trust is gaining recognition and adoption among SMEs, although SMEs’ Zero Trust adoption seems to lag behind businesses of other sizes and locations. However, SMEs can’t afford to lag behind other sectors: they’re now targeted at almost the same rate as large companies are.
SMEs that consider security a problem for just the large enterprises will fall behind the curve, leaving themselves vulnerable to attack — and attacks are costly and damaging enough to drive an SME out of business.
In a world where security breaches must be considered a when not an if, mitigating the costs of a breach is critical to a business’s survival.
There could be several reasons for slower adoption rates among SMEs. For one, SMEs are generally working with leaner teams and budgets than their larger counterparts. They also tend to grow and pivot quickly, making it more difficult for IT departments to make quick Zero Trust progress.
Another possible explanation for this gap could be SMEs’ lack of familiarity with Zero Trust: in a 2022 JumpCloud survey, 20% of SME IT professionals who responded didn’t know whether their organization was implementing Zero Trust.
SMEs could be implementing Zero Trust principles without tying them to the Zero Trust name; for example, SMEs are still prioritizing Zero Trust-friendly initiatives, like layering security to protect their distributed infrastructures. They also seem to be embracing Zero Trust tools and implementations, which we’ll explore further below.
To dive deeper into this lack of Zero Trust adoption among SMEs, read the blog, Why Haven’t More SMEs Adopted Zero Trust?
Tools and Implementations
14. 45.6% of SMEs are using MFA.
15. 57% of organizations found that the shift to decentralized work made patch management harder.
16. Only 2% of IT workers at enterprise companies felt that their MDM/EMM tools granted them adequate visibility.
17. 59% of IT decision-makers said it was difficult to keep up with securing employee devices while working remotely.
18. About half of IT professionals use more than 25 systems to manage their identities, and 21% use more than 100.
19. Implementing single sign-on (SSO) or unifying identities was ranked 5th on SME IT professionals’ priority list for 2022.
That’s one rank higher than it received in 2021 when SME IT professionals rated it the 6th most important.
20. The average cost of a data breach for critical infrastructure organizations was USD 4.82 million, 1 million more than the average cost for other industries.
What the Numbers Say
IT departments face many challenges, many of which the shift to remote work in 2020 caused or exacerbated. Fortunately, Zero Trust architectures are designed to unify and secure the elements of a decentralized network and can solve the majority of these struggles.
Zero Trust progress varies widely. However, one area where the majority of organizations have made significant progress is multi-factor authentication (MFA), which is highly effective in preventing account compromise and critical to a Zero Trust implementation. MFA meets Zero Trust’s requirements for authentication security where traditional passwords fail.
A true Zero Trust architecture uses MFA everywhere; secure authentication at every access transaction helps prevent lateral movement, minimizing damages in case of a breach.
Again, organizations are making progress here: 45.6% of SMEs have implemented MFA everywhere, and another 43.3% are using it only in certain places.
Expanding a partially implemented MFA is one of the best ways to get a jump-start on your Zero Trust plan. Learn more in our blog, Zero Trust: Where and How to Get Started.
Organizations are not quite as far along on their Zero Trust journeys in other areas. With mobile device management (MDM), for example, the vast majority (98%) of IT professionals at enterprise companies don’t feel their MDM tools grant them the visibility they need, and the majority of SME IT professionals agreed that device management is a top challenge.
In the same vein, patch management has proven difficult for organizations in the face of remote work.
The Need for Tool Unification and Consolidation
The device-related complications that decentralized work environments create can be solved with a robust MDM tool. They help organizations view, secure, and manage all the devices accessing corporate resources — including employee-owned devices.
MDM tools that combine with the organization’s identity and access management (IAM) system provide the best security and usability. Tools that combine MDM and IAM (referred to as UEM) allow organizations to assign devices to users, contextualize policy creation, and manage users and devices more holistically.
Similar to the benefits of combining IAM and MDM, unifying more elements of your stack can lead to better security: as exemplified in the numbers above, higher complexity leads to higher breach costs. This correlation can be attributed to several things.
First, complex systems tend to have more integrations and dependencies, which can become weak points that hackers have learned to look for and exploit.
In addition, complex systems are more likely to have cloudy visibility; the more elements in an infrastructure, the more difficult they are to track without the right tools. And untracked elements are unprotected elements.
The best way to combat these challenges is through tool unification and consolidation. JumpCloud, for example, offers a comprehensive directory that combines IAM, MDM, patch management, MFA, single sign-on (SSO), and more — all with the telemetry and security to keep your infrastructure tracked and protected.
Dive Deeper Into Zero Trust
While businesses vary widely in terms of their security posture, they all have one thing in common: they all have the potential to become the target of a cyberattack. And while no security approach can be 100% foolproof, Zero Trust security is a reliable way to protect businesses against emerging threats and secure decentralized infrastructures.
Many organizations have begun their Zero Trust adoption journey — but implementing Zero Trust can take time, and it can be a confusing process without the right guidance.
It’s not uncommon for organizations to lose their footing with their Zero Trust program rollouts because they’re stuck or unsure how to proceed.
If you’re looking for guidance on adopting Zero Trust, breaking up the journey into manageable pieces, or prioritizing the right elements in your rollout, check out our library of guides and practical advice here.
If you’d like to jump right into action, start here.
