The field of cybersecurity continues to evolve at a rapid pace, presenting both opportunities and challenges for organizations worldwide. Today, cyberattacks remain one of the most pressing challenges facing organizations of every size and across all industries. Cybercriminals are evolving their tactics, growing increasingly sophisticated in their methods, and becoming even more relentless in their pursuit of sensitive customer and business information.
For victims, the repercussions of cyberattacks can be severe, potentially resulting in substantial financial losses, irreparable reputational damage, costly business interruptions, and significant legal liabilities. As cyber criminals continue to elevate their tactics, it has become a business imperative for organizations to respond by enhancing their cybersecurity posture.
However, too many organizations today find themselves ill-equipped and under-resourced when it comes to this critical aspect of their business. They may be understaffed and rely on outdated cybersecurity tools and procedures that can leave them vulnerable. With cyberattacks rising in frequency, it is not a matter of if, but when your business will be targeted.
To stay above the cyber risk curve, understanding the evolving nature of individual organizations' threats is paramount. When it comes to cybersecurity, here are the top four trends that all businesses should be monitoring now and in the near future.
1. Ransomware continues to dominate cybercriminal activity
Ransomware attacks, targeting every industry, are poised to increase significantly in both volume and sophistication over the next year. The costs associated with a ransomware attack are also skyrocketing. In 2021, the overall financial impact of ransomware on businesses totaled approximately $20 billion. In 2031, the cost of these attacks is estimated to jump to $265 billion. The frequency of this criminal activity is also rising, with a 73% increase observed in 2023 compared to the previous year.
Financial gains are not the only driver behind the increase in ransomware; geopolitical factors are exacerbating the surge in attacks on U.S.-based businesses. The ongoing Russia-Ukraine conflict and subsequent sanctions imposed on Russia by the U.S. have made U.S.-based businesses even more of a target for ransomware attacks. Tensions between the U.S. and China are also adding to the uptick in attack frequency.
The tactics employed by ransomware attackers are evolving in sophistication, too. Cybercriminals are now utilizing artificial intelligence (AI), deepfakes, burnable infrastructure, zero-day exploits, and double or even triple-extortion tactics. Moreover, there has been a marked shift from large dominant ransomware groups to smaller, more numerous ransomware-as-a-service operations exploiting targets of opportunity. "Big game hunting," where cybercriminals target large, high-profile organizations, is also on the rise. Consequently, businesses of all sizes need to be beefing up their security measures accordingly.
2. Other cybercrime tactics are rising in frequency
While ransomware remains the most notable cyber risk, the frequency of business email compromise (BEC) incidents is rapidly escalating. From 2013 to 2023, BEC resulted in losses of more than $51 billion. Today, BEC constitutes roughly 35% of all cybersecurity incidents.
Phishing incidents are particularly difficult to stop because of the social engineering utilized to execute the attacks. Powered by ChatGPT, deepfake videos, and other AI tools, BEC attackers have become extremely adept at impersonating coworkers, vendors and executives with whom an employee might regularly interact. These attacks are difficult to completely prevent, as they prey on the weakest part of any security program: the human element. To combat this threat, companies should invest the time and energy necessary to establish effective procedures and continuously train employees. These investments pay significant dividends.
3. Continued implementation of artificial intelligence (AI) in cybersecurity
The continued development of AI-powered tools has massive implications for the cyber landscape. The global market for AI-based cybersecurity products is projected to reach $133.8 billion by 2030, fueled in large part by the increase in cyberattacks facing companies across all industries. AI is able to enhance data analysis and filtering software that companies may already have in place. AI-powered solutions can sift through massive amounts of data to identify malicious activity or seek out abnormal behavior. They can also automate many security processes that make it easier for IT departments to optimize their security systems.
However, hackers are also leveraging AI to augment their attacks. With AI, hackers can better identify patterns, weaknesses, and vulnerabilities in a target's security systems. They can create AI-generated phishing emails that have higher open rates compared to manually crafted messages. Hackers can also use AI to create deepfake video or audio messages that are extremely realistic and convincing.
AI in cybersecurity is still in its very early stages, and it's difficult to overstate the impact it will have on the cyber landscape. Its uses are evolving rapidly, and business leaders must keep an eye on this emerging technology.
4. Expanding and evolving regulations
Federal regulators are becoming more involved in establishing rules for businesses, aiming to increase disclosure and prescribe baseline safeguards for sensitive customer and government information. In July 2023, the SEC adopted new rules requiring companies to disclose material information pertaining to their cybersecurity risk management, strategy, and governance, along with reporting any material cybersecurity incidents they experience. All SEC-regulated companies are now required to disclose material cyber incidents within four days of determining the incident to be material.
In parallel, the Federal Trade Commission (FTC) issued changes to the Gramm-Leach-Bliley Act to include more standards around individual data rights, breach notification requirements, heightened security standards, and third-party risk prevention. There are also new standards for organizations that do business with the Department of Defense or handle controlled unclassified information through the Cybersecurity Maturity Model Certification (CMMC) 2.0 program.
As regulators and lawmakers address cybersecurity challenges through rulemaking and legislation, they are imposing multiple requirements on companies, leading to a complex and overlapping regulatory landscape.
A trusted partner in this fast-evolving space
As cybercriminals rapidly advance the tactics they leverage to compromise a company's systems and data, businesses must continuously adapt to keep pace with the threat. Simultaneously, companies need to carefully navigate an ever-changing legal and regulatory landscape. At Buchanan, we're keeping our finger on the pulse of these developments to ensure our clients are informed and ahead of emerging trends. We have extensive experience in cybersecurity and a deep understanding of the legal and regulatory implications associated with breaches. Whether your business is looking to enhance your existing cybersecurity stack, build one from scratch, or respond to a cyber incident, our cybersecurity and data privacy team can help you navigate the process.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
