So, what “cyber risks” do organizations actually face? On a macrolevel, according to another recent report — “State of Enterprise Risk Management 2020” by the IT governance association ISACA, the CMMI Institute and Infosecurity Group — organizations report that the biggest threats to cybersecurity include “changes/advances in technology” (64 percent), “changes in the types of threats” (60 percent), “too few security personnel” (52 percent), “missing skills in existing cybersecurity team personnel” (51 percent) and “increased number of threats and/or increased frequency of threat occurrence” (45 percent). 

But the specific lines of attack vary significantly. For example, many cybercriminals exploit frontline employees through social engineering to gain access to an organization’s information systems. Phishing attacks that use phony email to exploit users and steal their login credentials are also common. Another common attack vector is malware (including mobile malware) delivered via email as an image, a PDF or a link to a malicious website. And with many attacks, there’s the added threat that the infiltration may go undetected for an extended period. Median “dwell time,” as it’s known, has decreased, thanks in part to better awareness of cybercrime and new detection technologies, but as any company that has a cybercriminal who has been prowling through its systems unnoticed will attest, a dwell time of any length is far too long.

Once a cybercriminal has access to an organization’s systems, anything could happen next. A company hit with encryption ransomware might find it impossible to access important files unless it pays a substantial fee in cryptocurrency to the attacker. Or the cybercriminal might threaten to publicize sensitive data and expose the company in ways that could damage its reputation. A malware infection on the systems of a major retailer could lead to the exposure of customer credit card accounts, while a similar attack on the financial systems of a university might threaten the private data of faculty and students. A 2019 IDG Research/CDW survey of more than 400 IT professionals and business executives at companies with 250 or more employees asked participants to rank the specific cybersecurity risks that concerned them the most. Malware, viruses and worms were at the top of their list, followed by identify theft, data tampering, and ransomware. Slightly less concerning to those who were polled: a slew of other potentially ruinous cybercrimes, including unauthorized access to corporate financials, network denial of service, and espionage access to trade secrets.

Finally, many within the information security community believe that artificial intelligence is poised to revolutionize how cybercriminals work. Cyberattackers, explained an October 2019 article on the information security website Dark Reading, can use AI and deep learning to create “deepfakes,” for example, where a person’s voice or image is superimposed over another’s to trick the listener or viewer into doing something against their interest. The author cites one instance where a cybercriminal used AI to dupe an energy business executive into wiring $243,000 to a company that didn’t exist.

It’s the potential financial impact of cybercrime, in fact — and the fear that a breach may go uncontained to the point where the damage becomes irreversible — that keeps many IT professionals up at night. According to the Ponemon Institute’s “2019 Cost of a Data Breach Report,” the average data breach lifecycle — the time it took for an organization to identify and contain a breach — rose 4.9 percent between 2018 and 2019 and is now up to 279 days. (That figure is for breaches of all kinds, including those that are criminal in nature and those that occur accidentally. In the case of criminal attacks, which are responsible for more than half of all breaches, the data breach lifecycle is now 314 days.) Longer breach lifecycles, the Ponemon report notes, inevitably lead to higher costs. The average total cost of a breach in 2019 was $3.9 million among organizations worldwide.