Similarly, organizations that have
experienced a cybercrime are more
cautious and exhibit more maturity in
their security practices than those that
have not. We found that 37% of
respondents who had not suffered a
security incident did not know what
groups posed the greatest threat to their
organization, compared with 18% of
those who had experienced an incident.
What’s more, organizations that have
detected attacks are considerably more
likely to employ security capabilities such
as vulnerability management, cyber
threat intelligence analysis, intrusion
detection tools, and Security Information
and Event Management (SIEM)
technologies. They are also more likely to
include cyber risks in the enterprise
risk-management program and to
prioritize security spending based on the
level of risk a threat presents to the
overall business strategy.
The takeaway: Those that demonstrate a
more advanced cybersecurity posture
are not necessarily smarter. They have
simply invested more and have learned
from experience.