Organizations are coming to accept that it is a matter of when, not if, they will be targeted by cybercriminals. That realization is changing the dynamic of cyber risk management, pushing damage limitation to the forefront and, as a result, turning the spotlight on attack detection.

Detecting (preferably rapidly) when a malicious actor has access, or is attempting to gain access, to an organization's systems is the foundation on which response and recovery are built. And it is an element whose benefit can be measured in cash. The average cost of a cyber breach lasting 200 days or more was $4.86 million, technology company IBM said in its "Cost Of A Data Breach Report," published in 2022. Reducing that breach to less than 200 days cut the cost by just under a quarter, to an average $3.74 million, according to IBM.

Sums like that underline the importance of detection to companies' cyber risk management. And they highlight why S&P Global Ratings considers effective cyber detection to be integral to cyber risk management and ultimately a potential factor in the assessment of issuers' credit worthiness.

A Lifecycle Not An Event

To better understand the role that detection plays in cyber risk management it helps to understand the nature of a typical cyberattack. Contrary to common perception, cyberattacks are not singular events. Rather they are a chain of events that can take place over a matter of weeks or even months. We refer to this as the cyberattack lifecycle (see chart 1).

Understanding the nature of that lifecycle offers a foundation from which to better analyze cyber risk. It also enhances the ability to manage that risk, not least because it demonstrates how each step provides an opportunity for a target to detect malicious activity and thus break the cyberattack lifecycle and minimize damage.

Chart 1

As IBM's report shows, early detection of a cyberattack is key to limiting its cost. The longer that an attacker remains undetected and with access to a target's technology systems the greater is the opportunity for them to establish control and thus achieve their objectives. Moreover, retaking control of a system from an attacker, and remedying their actions, are major elements of the cost of a cyberattack.

Racing Against Time

Defenders are detecting cyberattacks faster, but they also face shorter attack lifecycles. About 70% of breaches not unveiled by an attacker (known as a non-actor disclosed breach) are detected in a day or less, while 20% take "months or more" to detect, according to the "Data Breach Investigations Report," published in 2022 by Verizon, a U.S. wireless network operator. The report suggests that detection speeds have notably improved in the past five years, with almost 50% of non-actor disclosed breaches taking "months or more" to detect in 2017 (see chart 2).

Verizon's figures also demonstrated the extent to which defenders are locked in an arms race, with faster detection offset by shortened attack lifecycles, notably due to the growing prevalence of ransomware attacks. In 2016, about 6% of breaches were characterized by an attacker notifying their presence to the target (known as actor disclosure), according to Verizon. By 2022, that figure had grown to 58%--suggesting that a majority of cyberbreaches go undetected until after attackers have found what they want and sent a ransom note.

Chart 2

Thankfully, defenders don't have to face the threat posed by accelerating cyberattacks alone. Government organizations are playing a growing role in incident detection. The U.S.'s Cybersecurity & Infrastructure Security Agency (CISA), the U.K.'s National Cyber Security Centre (NCSC) and the Australian Cyber Security Centre (ACSC) are developing capabilities to support public and private sector entities with incident detection, technical support, communication, and outreach.

Contribution from government organizations was likely a material contributor to the faster detection observed in Verizon's report. It also appears to be reflected in a decrease in the period between a cyber attacker's entry and detection (known as dwell time), which fell to 28 days in 2021, from 184 days in 2018, according to a report, "M-Trends 2022: Cyber Security Metrics, Insights and Guidance From the Frontlines," produced by cybersecurity firm Mandiant, a unit of Google. Those figures require some qualification as Mandiant's sample of externally detected breaches includes actor disclosure, so is skewed by the growth in ransomware attacks that result in an attacker notifying their presence.

Early Detection Is Key To Breaking The Attack Lifecycle

Issuers that quickly detect an attack afford themselves a chance to break the attack lifecycle at an early stage and thus limit financial damage and potential credit quality impacts. An attacker doesn't gain access to a target's systems until step three of five (exploitation) in the attack lifecycle. Detecting malicious activity in steps one or two (preparation and delivery) can thus nullify an attack. For example, an employee may receive a phishing email during the delivery phase of an attack. If that employee is trained in phishing awareness, and has a mechanism to report the malicious email, the target entity can respond before the attack gains access to an IT system and is able to deliver malware.

Even if that malware is delivered, resulting in a system breach, rapid detection remains crucial to damage limitation. Response and recovery typically become progressively harder and more expensive as an attack progresses through its lifecycle. Immediately following entry, an attacker may only have access to a small segment of an entity's systems and networks. Defenders, at that stage, can isolate infected systems, and or cut-off unauthorized access through targeted action. Once an attacker gains persistence and control (phase four of the lifecycle), removing them is likely to be significantly more costly and time consuming, requiring a concerted effort to identify all affected systems and restore their integrity.

Finally, if the attacker carries out their desired actions (phase five), the target entity may have to bear additional costs including business interruption, reputational damage, and regulatory penalties. The snowballing of cost and damage as a cyberattack progresses through its lifecycle makes early detection (and an effective response plan) key to an organization's cybersecurity program--not least because an attack's impact, when significant, can lead to a deterioration in credit quality.

Where To Invest

Our analysis of rated issuer's cyber preparedness contributes to (and is embedded within) our assessment of governance and operational risk management. Material deficiencies in an issuer's cybersecurity capabilities can therefore affect our view of an issuer's credit worthiness and, ultimately, influence our credit rating on an entity.

Organizations can bolster their detection capability through investment (of time and money) in three broad categories of cyber threat detection: logging, monitoring, and threat hunting (see chart 3). These elements are generally cumulative, with monitoring and threat hunting built upon, and augmenting, basic logging capabilities.

The breadth of issuers we rate means that there will be differences in organizations' requirements, which will be reflected in our expectations of their cyber security preparedness. Indeed, some organizations may not need significant capabilities (and thus investment) beyond logging and monitoring, while others will require consequential automation and threat hunting operations.

Chart 3

The Threat To Credit Quality

The presence, or absence, of a cyber threat detection mechanism at an issuer is unlikely to have direct credit rating implications. However, we consider that weaknesses in an entity's threat detection capabilities indicates deficiencies in operational risk management, which can affect our view of an entity's governance practices and ultimately its credit worthiness.

Furthermore, and as the studies cited earlier confirm, organizations with weak threat detection tend to suffer heavier costs directly related to attacks. They can also be expected to suffer greater reputational damage, which could have a further financial impact. The potential magnitude of those damages makes it possible that an attack could weigh on an issuer's credit worthiness.

Given those risks, organizations lacking effective cyberattack detection capabilities can ill afford to delay investment in the necessary platforms. And they will have to keep investing. The constantly evolving cyber landscape means that security controls and defenses must develop if they are to continue to benefit credit quality. In the same way that a cyberattack is better thought of as a lifecycle rather than an event, cyber security should be considered a journey not a destination.

Related Research

• Cyber Risk Insights: Navigating Digital Disruption, Feb. 22, 2023
• Cyber Risk Management Is Credit Risk Management, Says Seminar, Nov. 01, 2022
• Cyber Brief: Multifactor Authentication Remains Effective But Not Impenetrable, Oct. 18, 2022
• Cyber Risk In A New Era: The Rocky Road To A Mature Cyber Insurance Market, July 26, 2022

Writer: Paul Whitfield