Scienza e Tecnologia
BlueVoyant Research Reveals 97% of UK Organisations Have Suffered a Cybersecurity Breach Because of Weaknesses in Their Supply Chain
This compares to 82% of respondents who suffered a cybersecurity breach owing to vendor vulnerabilities in 2020. Not only is this higher than the overall average of 93% in 2021, but the UK was also second highest out of all the regions surveyed. The UK was surpassed by European respondents in Germany and The Netherlands (grouped together), where 99% reported supply chain-related cybersecurity breaches.
The study was conducted by independent research organisation, Opinion Matters, and recorded the views and experiences of 1,200 CIOs, CISOs and Chief Procurement Officers, with 300 respondents from the UK, in organisations with more than 1,000 employees across a range of industries including: business services, financial services, healthcare and pharmaceutical, manufacturing, utilities and energy, and defence. It covered six countries: U.S., Canada , Germany , The Netherlands , the United Kingdom , and Singapore .
Other key UK survey findings were equally stark:
James Tamblin , President of BlueVoyant UK, said: "It is concerning that UK firms are not prioritising supply chain cybersecurity risk, despite such a high prevalence of cyber breaches. I would have expected firms to be focusing urgently on addressing third-party cyber risk, especially bearing in mind that almost all the UK firms surveyed have experienced a breach via their supply chain – this should be sounding alarm bells and prompting immediate action. With supply chains stretched to the breaking point by the pandemic, many UK firms have had to diversify suppliers to build resilience, which could also be limiting visibility."
However, UK companies did fare better than counterparts in other territories when it comes to how frequently they reassess their vendors and brief the executive team on the results.
James Tamblin added: "It was encouraging to see that UK firms are reporting more frequently on supply chain risk than they were last year. This is better than other countries surveyed. This positive approach to more regular supply chain auditing is promising. However, reporting and assessments could be much more effective if there was more expansive and rigorous awareness of cyber and third-party risk and more sophisticated programmes in place to deliver comprehensive and accurate data."
While budgets in the UK are rising year-on-year, this raises questions around why this is not resulting in fewer breaches. Ninety-two percent say that budgets for third-party cyber risk management are increasing in 2021, up from 87% in 2020. In fact, 47% of organisations indicated budgets were rising by between 51-100% this year - up from 28% in 2020. However, the degree to which these investments are coordinated is unclear.
Surveyed UK companies report an almost equal distribution of pain points: managing false positives, managing the volume of data, prioritising risk, knowing their own risk position, among others. The fact that companies are reporting so many issues suggests that larger budgets are not resulting in risk reduction. There was a similar picture last year with multiple pain points being reported.
Robert Hannigan , Chairman of BlueVoyant International concluded: "Budget increases demonstrate that firms are recognising the need to invest in cybersecurity and vendor risk management. However, the fact that UK firms are not prioritising supply chain risk suggests that budgets are not being directed to where they will make the most impact. Additionally, with UK firms being so heavily targeted, how will they reduce the breach rate and drive down cyber risk in the face of such apparent apathy? Clearly there is a lot of work to be done."
The full UK BlueVoyant research report: "Managing Cyber Risk Across the Extended Vendor Ecosystem" is available here.
At BlueVoyant, we recognise that effective cybersecurity requires active prevention and defense across both your organisation and supply chain. Our proprietary data, analytics and technology, coupled with deep expertise, works as a force multiplier to secure your full ecosystem.
Accuracy. Actionability. Timeliness. Scalability.
Founded in 2017 by former Fortune 500 and former government cyber officials, BlueVoyant is headquartered in New York City and has offices in Maryland , Tel Aviv , San Francisco , Manila , Toronto , London , Latin America and Budapest . Visit www.bluevoyant.com.
Jim Pople
C8 Consulting (EMEA & APAC)
T: +44 7955 030191
E: jim@c8consulting.co.uk
:
The 2021 survey was carried out by Opinion Matters on behalf of BlueVoyant with a sample of 1,200 18+ CTOs/CSOs/COOs/CIOs/CISOs/CPOs responsible for supply chain & cyber risk management in the U.S., Canada , Germany , The Netherlands , UK and Singapore , working in companies employing 1,000+ employees guaranteeing at least 50 respondents per industry sector per country in the following: Financial services, Healthcare and Pharmaceutical, Utilities & Energy (combined: equal split), Business services (i.e. professional services/legal and so forth), Manufacturing, Defence. Three-hundred respondents were from the UK. Survey carried out between 22.06.21 - 06.07.21 .
The 2020 survey was carried out by Opinion Matters on behalf of BlueVoyant with a sample of 302 18+ CIOs/CISOs/CPOs responsible for supply chain and cyber risk management working in companies employing 1,000+ employees in the UK. Survey carried out between 17.06.2020 - 24.06.2020 . Opinion Matters abides by and employs members of the Market Research Society, which is based on the ESOMAR principles.