www.managedITmag.co.uk 33 The worst fears of the CISOs surveyed by Proofpoint (see opposite) are supported by a survey conducted by Kaseya, a provider of AI-powered IT management and cybersecurity software, for its latest Cybersecurity Report. This, too, found that the thing security leaders fear most isn’t a zero‑day attack or nation-state actor but their own employees. In a survey of 1,132 MSPs and IT professionals across more than 60 countries, human error, including social engineering and distraction, emerged as the threat vector respondents are most concerned about over the next 12 months, cited by 68%, well ahead of email in second place with 55%. Among organisations that have experienced an incident in the past three years, four of the top five contributing factors were peoplerelated, led by poor user practices or gullibility (41%) and a lack of end-user cybersecurity training (40%). Commenting on these findings, David Baggett, SVP and GM, Security Suite, Kaseya, said: “People aren’t perfect, and everyone knows it. Yet much of cybersecurity still depends on people making the right decision every time. The path to true cyber resilience isn’t about eliminating mistakes. It’s about building an organisation that can withstand them. Expect mistakes, account for constraints and engineer around them.” Budgets under pressure Another finding that will strike a chord with CISOs surveyed by Proofpoint is the failure of budgets to keep up with the growing security risk. Just 20% of the IT departments surveyed by Kaseya say their budgets are growing in line with risk. More than three quarters (77%) say they are challenged in some way, be it by having flat budgets while threats grow (23%); growing, but too slowly to keep pace with risk (30%); or being under-resourced and feeling the effects (24%). This perception is corroborated by respondents from managed service providers (MSPs), 65% of whom say their clients are underinvested in cybersecurity relative to their risk. Kaseya’s research also suggests that IT departments might have misplaced confidence in their compliance-readiness. Almost twothirds (65%) of respondents believe they could pass a compliance audit today without preparation. However, when asked what could create problems during an audit, 49% pointed to incomplete documentation or policies, followed by security controls that are not fully implemented (34%) and a lack of employee security awareness or training (33%). Five-part playbook To help organisations address these issues, Kaseya’s report includes a five-part playbook for building resilience into daily operations. Guidance covers: building layers of protection for the mistakes you know will happen; making the case for investment before an incident forces the issue; removing friction so secure behaviour is the easy choice; using AI to extend stretched teams; and treating compliance as continuous work rather than a once‑a-year scramble. MSP assessment Kaseya provides both MSPs and IT departments with IT management and cybersecurity software and, addressing the needs of the former, Cybersecurity Report: Building Security That Survives Human Error includes an MSP resilience assessment designed to give MSPs visibility into what high-performing MSPs do differently for their clients. High and low performers were defined by whether they met their revenue and growth goals over the last two quarters. The assessment reveals that high performing MSPs have turned compliance, cyber insurance and AI adoption into competitive advantages, while low-performing MSPs deprioritise those areas. Incident response and backup testing: Almost 30% of highperforming MSPs test their clients’ incident response plans quarterly, compared with 18% of low-performing MSPs. Only 11% of high-performing MSPs report not having an incident response plan, compared with 25% of low-performing MSPs. Across all MSPs, 15% do not have an incident response plan. Compliance as a differentiator: High-performing MSPs are making compliance a more meaningful part of their business. A quarter generate 11-25% of their revenue from compliance services, compared with 15% of low-performing MSPs, suggesting that compliance can be a strong differentiator and revenue opportunity. Tech stack depth: While foundational tools like EDR, MFA, BCDR and email security are near-universal across all MSPs, high performers pull ahead on advanced, proactive layers, including SIEM adoption (48% high vs. 42% all vs. 31% low), NDR (52% high vs. 44% all vs. 27% low) and cloud security/CNAPP (32% high vs. 22% all vs. 13% low). The full Cybersecurity Report is available at https://www.kaseya. com/resource/cybersecurityreport-challenges-security-teams/ Kaseya report describes human error as cybersecurity’s biggest unsolved problem Cybersecurity’s people problem CYBERSECURITY
RkJQdWJsaXNoZXIy NDUxNDM=