Immersive Labs: Average cyberthreat response takes 96 days

How each industry performed

The Immersive Labs study tracked the average number of crisis exercises ran by companies in each sector, with the sectors being technology, financial services, government, consulting, retail and commerce, healthcare, education, infrastructure, manufacturing and transport.

The technology sector ran the most exercises, with nine on average per year, per company. Manufacturing and transport were at the bottom with one.

Another statistic found in this section was the "average performance score" by each sector across these exercises. According to the report, "each separate decision throughout a crisis simulation is given a score depending on how well it addresses the overall crisis. The performance score amalgamates these."

Immersive Labs found that the average score overall was 68%, but there was quite a bit of variance among the different industries. Manufacturing, education and technology all had an average score of at least 80%, while financial services and healthcare both fell below 50%. Manufacturing set the top bar at 85%, while healthcare came in far below the rest of the field at just 18%.

The report also examined the average time it took entities to develop "the human capabilities necessary to defeat attackers," and this too was broken down by sector. Breen discussed some of the findings of this part of the study.

"The data shows that the sectors with fastest time to human capability when posed with a cybersecurity threat are those which could perhaps be considered more innately digital, such as e-commerce," Breen said. "Perhaps this is a byproduct of the fact that a culture of technology is more entwined in their foundations.  As a counterpoint, more traditional sectors, such as transport and infrastructure, were slower in their development of human capabilities."

The report provided figures on response times, with retail and commerce being one of the quickest industries at 68 days on average, and infrastructure and transport being the two slowest, at 128 and 145 days, respectively. Technology and financial services fell near the middle of the pack, with tech taking 92 days on average to complete and financial services taking 97.

Prioritizing aspects of new threats

The study also highlighted what parts of an attack cybersecurity teams are most interested in understanding and studying. The report found that infosec professionals were most interested in knowing how threat actors entered their systems and how they got past the systems' defenses rather than what the actors did once they were inside.

Immersive Labs also found that the three most important areas were the execution of the breach, the defense evasion and then its discovery. The three least important were the impact of the breach, and the exfiltration and collection of the data.

The report described the amount of time it took entities to develop capabilities necessary for dealing with a breach. The fastest times were with examining the impact of the breach and the exfiltration and collection of the data, while the slowest was discovering how the threat actors gained initial access.

Immersive Labs also analyzed how often organizations that suffer ransomware attacks pay the ransom to recover their data. Through its simulations and examinations of real-life examples of data breaches and ransomware attacks, the company found that organizations often had very low confidence scores when faced with ransomware scenarios.

The findings also showed that education and consulting were the two industries that paid the ransom most often, at 25% and 23% of the time, respectively, and that critical infrastructure organizations never paid ransoms.