Nation-states often target valuable IP, the
theft of which many organizations are
reluctant to report—if, in fact, they are
aware this information has been stolen.
Often there is no legal or regulatory
requirement to do so, and the
consequences of disclosing IP loss may, in
some cases, cripple a business.
It is also quite difficult to quantify the
consequences of IP loss. Unlike payment
card heists, in which the financial losses
are reported quickly and are fairly
straightforward to calculate, victims of
IP theft may not know exactly what has
been stolen. What’s more, trade secrets
often are not monetized by adversaries in
an immediately noticeable way, and the
impact may remain undetected for years.
When it comes to the sources of
cybersecurity incidents, the highest
percentage of respondents (72%) cite
outsiders such as hackers. Other highly
publicized sources of incidents—nationstates
(7%) and organized crime (8%)—
are in fact less likely culprits, although
larger companies are more likely to be
concerned about these threat actors. It’s
worth noting that these types of
incidents are comparatively uncommon,
yet they are often sensational in nature
and generate media attention that is
disproportionate to their frequency. Also
consider that a great deal of uncertainty
exists about incidents: We found that
26% of respondents that had detected a
cybersecurity incident could not identify
the source of the attack.