Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Cyber Risk Management in Transition: Key Findings from ESG’s Cyber Risk Management Survey

A recent ESG report shows the traditional approach to cyber risk management isn’t working anymore, if in fact it ever did. Here, we share four highlights from the report and offer two steps to help improve your organization’s strategy.

To gain insight into how cyber risk management is changing to support organizational missions and initiatives, the Enterprise Strategy Group (ESG) surveyed 340 information security professionals in organizations with over 1,000 employees.

The results show the traditional approach to cyber risk management isn’t working anymore, if in fact it ever did. The vast majority of respondents (72%) state that cyber risk management is more difficult than it was two years ago. Only 5% say it’s significantly easier than it used to be. It’s clear a new way to deal with the flood of vulnerabilities is required. (Watch the video below for a quick synopsis of the findings from ESG's senior principal analyst, Jon Oltsik.)

Top 4 findings from ESG’s Cyber Risk Management Survey

Here are four highlights from the survey results:

  • This was never easy and it keeps getting worse. Cyber risk management is becoming increasingly important – as it tracks to a growing attack surface and an overwhelming number of vulnerabilities.
  • What we have here is a failure to communicate. Organizations are finding it difficult to align cyber risk management with business goals. What the C-suite needs and what security can provide are not in sync. There’s a real language barrier. Security must translate technical jargon into terms everyone can understand and utilize for their own decision processes.
  • It’s time for a change. All too often, vulnerability management is dependent upon antiquated processes and practices. Spreadsheets and intuition aren’t cutting it.
  • What you can’t see CAN hurt you. Clear visibility and knowledge across the entire attack surface is essential. But business pressures are causing organizations to have an ever-expanding attack surface as cloud technologies gain ground and operational technology (OT) devices are integrated with the IT infrastructure.

73% say risk management is more difficult

Why cyber risk management is getting harder – and what you can do about it

As for what’s making things more difficult, the challenges are coming from all sides. There’s a daunting combination of more vulnerabilities, greater business pressure and, last but not least, more advanced adversaries.

Here’s what ESG survey respondents say they are facing in their environments:

  • 43%: More workloads to public cloud infrastructure services
  • 42%: More software vulnerabilities
  • 42%: More advanced adversaries
  • 41%: More sensitive data
  • 30%: More exec-level analysis and reporting requirements

So, what can a beleaguered infosec professional do?

Step 1: Continuous visibility

Only 38% of ESG survey respondents continuously scan their environments. This results in blind spots and gives attackers a leg up on discovering your vulnerabilities. Instituting continuous visibility is your first line of defense.

Step 2: Prioritization of vulnerabilities

The volume of vulnerabilities is overwhelming for 70% of respondents. But only a small fraction of vulnerabilities are ever exploited. The key is finding the dangerous needles in your ever-growing haystack of vulnerabilities. And to do that you need insight into threat intelligence and a model that can help predict which of your vulnerabilities are most likely to be attacked. Prioritizing vulnerabilities based on a predictive model will improve your team’s ability to respond quickly and efficiently to the most critical threats to your business.

Learn more

订阅 Tenable 博客

免费试用 立即购买

选择 Tenable.io

免费试用 60 天

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即注册并在 60 秒内运行第一次扫描。

立即购买 Tenable.io

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

65 资产



免费试用 立即购买

免费试用 Nessus Professional

免费试用 7 天

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。

购买 Nessus Professional

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。


免费试用 立即购买

试用 Tenable.io Web Application Scanning

免费试用 60 天

完整享有专为现代化应用程序而设、属于 Tenable.io 平台组成部分的最新 Web 应用程序扫描功能。可安全扫描全部在线资产的漏洞,具有高度准确性,而且无需繁重的手动操作或中断关键的 Web 应用程序。 立即注册并在 60 秒内运行第一次扫描。

购买 Tenable.io Web Application Scanning

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。




免费试用 联系销售人员

试用 Tenable.io Container Security

免费试用 60 天

完整获得已集成至漏洞管理平台之唯一容器安全产品的功能。监控容器映像中的漏洞、恶意软件和策略违规。与持续集成和持续部署 (CI/CD) 系统进行整合,以支持 DevOps 实践、增强安全性并支持企业政策合规。

购买 Tenable.io Container Security

Tenable.io Container Security 经由与构建流程的集成,可供全面了解容器映像的安全性,包括漏洞、恶意软件和策略违规,借以无缝且安全地启用 DevOps 流程。

了解有关 Industrial Security 的详情