The UK government's third phase of research shows how well UK organizations have been improving their cybersecurity efforts but indicates that the risk from certain attacks have only been reduced marginally.
As part of the UK government’s National Cyber Strategy, their Cybersecurity Longitudinal Survey has been run three times to show how well UK businesses and charities are working to improve their state of cybersecurity.
According to the “Wave Three” report, organizations are making improvements:
- Approximately nine in ten organizations have implemented one of five security frameworks approved by the UK government. This is up from 82% in Wave One in January of 2022
- Approximately one in five organizations (22%) have implemented all five of the approved frameworks. This is up from 17% in Wave One
- Approximately six in ten businesses are offering some form of security awareness training. This is an increase from Wave One where it was around one in two
So, it appears that UK businesses are indeed improving their state of cybersecurity. But according to the Wave Three report, there are still plenty of attacks occurring:
- Around three-quarters of businesses (75%) and eight in ten charities (79%) report experiencing a cybersecurity incident in the last twelve months.
- Around one-quarter of businesses (23%) and charities (24%) that experienced a cybersecurity incident in the last year reported it having a negative impact, which is in line with Wave Two.
You can see a better visual of the changes over time with this image showing attack frequency below:
Source: Gov.uk
Getting a bit more specific, seven in ten businesses and three-quarters of charities report experiencing phishing attacks – these are consistent with the Wave Two report published in December of 2022. Additionally, two in five businesses report experiencing people impersonating their organization in emails.
Given we see an improvement in the delivery of security awareness training, and yet phishing and impersonation attacks continue, it raises a frequent concern of mine: As with every time we hear an organization stating they provide training, we have to ask whether it’s more like “once a quarter breakroom” training or continual new-school security awareness training. The former is going to yield minimal value, while the latter helps to establish a culture of security and a vigilant user who is ready to play a role in stopping attacks.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
