Cybersecurity company Trend Micro has released findings from its 2024 Cyber Risk Report, Intercepting Impact.
The study, based on global telemetry data collected from its attack surface risk management solution and extended detection and response tools, highlights key industry insights, including:
-
America had the highest risk index among regions due to vulnerabilities in banking and critical infrastructure, while the Asia Pacific, Middle East, and Africa region ranked third with an average risk index of 42.7.
-
Europe leads in patching efficiency, with a mean time to patch of 26 days for the first half of 2024, the quickest among all regions. Meanwhile, the Asia Pacific, Middle East, and Africa region averages over 28 days, surpassing the overall global average.
-
Mining emerged as the most vulnerable sector, with the highest risk score, attributed to its critical role in global supply chains and a vast attack surface, while pharmaceuticals lead in patching speed, underscoring the industry’s prioritisation of sensitive data protection.
“Trend’s cyber risk report shares key insights on where risks are greatest within organisations, such as weak security controls, misconfigurations, and unpatched actively exploited vulnerabilities,” said Trend Micro’s ANZ Field CTO Mick McCluney. “Shifting towards a more risk-based approach to cybersecurity, discovering the entire attack surface, using AI to calculate the actual risk, and providing mitigating controls advice, allows an organisation to improve its cybersecurity posture like never before.”
Using a risk event catalogue, the Trend Vision One platform calculates a risk score for each asset type and an index for organisations by multiplying an asset’s attack, exposure, and security configuration by impact. An asset with low business impact and few privileges has a smaller attack surface, while higher-value assets with more privileges have a larger attack surface. The following assets are the most at risk:
-
Devices: 22.6 million total devices, with 877,316 classified as high-risk;
-
Accounts: 53.9 million total accounts, with 12,346 classified as high-risk;
-
Cloud Assets: 14.5 million total cloud assets, with 9,944 classified as high-risk;
-
Internet-Facing Assets: 1.1 million total, with 1,661 classified as high-risk; and
-
Applications: 8.8 million total applications, with 489 classified as high-risk.
The number of high-risk devices is much higher than that of accounts, even though there are more accounts in total. Devices have a larger attack surface and can be targeted with more threats. However, accounts are still valuable as they can grant threat actors access to various resources. Elsewhere, the report also found:
-
America has the highest average risk index among regions, with an average risk index rating of 43.4, driven by vulnerabilities in the banking sector and critical infrastructure and the region’s attractiveness to profit-driven actors. In comparison, the Asia Pacific, Middle East, and Africa region ranked third with an average risk index of 42.7.
-
Europe is the quickest region to patch vulnerabilities, indicating strong security practices. Meanwhile, the Asia Pacific, Middle East, and Africa region has a mean time to patch averaging over 28 days, surpassing the overall global average.
-
Mining has the highest risk score of any vertical due to its strategic position in global supply chains and large attack surface.
-
Pharmaceuticals are the fastest sector to patch vulnerabilities by several days, reflecting the importance of protecting sensitive data.
-
The top detected risk event is accessing cloud applications with a high-risk level based on historical application data, known security features, and community knowledge.
-
Old and inactive accounts, accounts with disabled security controls, and sensitive data being sent outside the network are other risk events with high event counts.
The report also uncovered many weak configurations that could lead to compromise, especially around security control settings.
As the threat landscape continues to evolve, organisations’ ability to identify and manage risks is becoming increasingly crucial. The Trend Vision One platform, with its integrated attack surface risk management, provides the necessary tools for comprehensive threat visibility and effective risk mitigation.
The following steps are recommended to help mitigate cyber risk:
-
Optimise product security settings to get alerts on misconfigurations;
-
When a risky event is detected, contact the device and/or account owner to verify the event. Investigate the event to find more information about or check event details on the product management server;
-
Disable risky accounts or reset them with a strong password and enable multi-factor authentication; and
-
Apply the latest patches or upgrade application and operation system versions regularly.
You can read the full report here.
