With Halloween around the corner, it seemed like a good time to share these scary cybersecurity stats. Read on if you dare — this roundup of reports reveals some of the scariest findings from cybersecurity researchers in 2023.

Menlo Security
How Employee Usage of Generative AI is Impacting Security Posture

  • Since the launch of ChatGPT in November 2022, use of generative AI has increased by 1,200% and carries with it a slew of security concerns, including employees inadvertently exposing corporate data. In observing generative AI usage of 500 global organizations within a 30-day period, Menlo found 10,190 instances of attempted file uploads into chatbots, and 3,394 instances of employees copying and pasting information into chatbots. 
  • As employees were attempting to input sensitive and confidential information into generative AI platforms, it was found that 50.4% of data was classified as personally identifiable information (PII) and another 24.6% was classified as confidential documents.

Annual Cyberthreat Defense Report

  • Four out of 5 ransomware attacks include threats beyond data encryption, such as threats to publicly release exfiltrated data, notify customers or the media of a data breach, or commit a DDoS attack against the organization. 

Dig Security 
The State of Cloud Data Security in 2023

  • More than 30% of cloud data assets contain sensitive information. PII is the most common sensitive data type that organizations save. In a sample data set of 1 billion records, more than 10 million social security numbers were found (the sixth most common type of sensitive information), followed by almost 3 million credit card numbers, the seventh most common type.
  • A staggering majority (91%) of database services with sensitive data were not encrypted at rest, 20% had logging disabled, and 1.6% were open to the public.
  • More than 60% of storage services were not encrypted at rest, and almost 70% were not logged.

Cowbell
Q2 2023 Cyber Round-Up Report

  • SMEs without insurance fear a major cyberattack could sink them. In fact, 72% of SMEs without cyber insurance say that a major cyberattack could destroy their business.
  • Cyber incidents cost SMEs more than they anticipated, according to 90% of SMEs that experienced a serious incident.
  • Cyber incidents erode customer trust and business operations. For example, 81% of the SMEs that experienced a cyber incident say they saw a widespread drop in customer trust, and 91% said it significantly degraded their business operations.
  • Critical infrastructure tops the list for cyberattack victims — 68% of SMEs in the computer hardware or software industry have experienced a significant cyberattack in the past 12 months, with utilities/energy/water/telecom following closely with 61%, and financial services or insurance with 60%.

Zimperium
Global Mobile Threat Report

  • Almost half (43%) of all compromised devices were fully exploited (not jailbroken or rooted), an increase of 187% year-over-year.
  • Both Apple and Android saw increasing instances of detected vulnerabilities. There was a 138% increase in critical Android vulnerabilities discovered in 2022, while Apple iOS accounted for 80% of the zero day vulnerabilities actively being exploited in the wild.
  • Malware is continuing to proliferate rapidly. Between 2021 and 2022, the total number of unique mobile malware samples rose 51%, with more than 920,000 samples detected, including Dirty RatMilad, MoneyMonger, and Dark Herring. Zimperium protected its customers from 2,000 samples each week that were not yet identified by the industry in general (zero day malware).

XM Cyber
State of Exposure Management Research Report

  • Only 2% of exposures lie on choke points leading to critical assets. Focusing on these maximizes risk reduction while minimizing remediation workload. 
  • Nearly three-quarters (71%) of firms have exposures that enable attackers to pivot from their on-prem to cloud environment. Once there, 92% of critical assets lie just one hop away.
  • Attackers can access 70% of critical assets in on-prem networks in just three steps. It’s even worse in the cloud, where 90% of critical assets are just one hop away from initial compromise. 
  • Endpoint detection and response capabilities cover fewer than half of all devices in 38% of firms.
  • More than one-third (36%) of firms grant permissions enabling at least half of their devices to access critical assets. 
    • Techniques targeting credentials and permissions affect 82% organizations and constitute over 70% of all identified security exposures. 

Salt Security
State of API Security Report

  • More than half (54%) of respondents said outdated or "zombie" APIs are a high concern, up from 42% from last quarter. (Zombie, or outdated, APIs have been the No. 1 concern in the past five surveys from Salt, likely the result of increasingly fast-paced development as organizations seek to maximize the business value associated with APIs.)
  • Account takeover (ATO) was a high concern for 43% of respondants.
  • Only 20% cited shadow APIs as a top concern. Given API documentation challenges, it’s likely most environments are running APIs that are not documented, meaning the risk in this area is likely higher than many respondents realize

Auvik
2023 Network IT Management Report

  • Almost half (45%) of IT teams do not fully know the configuration of their networks, and 21% shared that individuals outside of ITOps are making configuration changes.
  • Network documentation is updated monthly or less often, according to 41.5% of respondents despite 53% reporting that configuration changes are happening daily or weekly.
  • Only half of IT professionals surveyed said they are performing SaaS and cloud monitoring or Wi-Fi management. SaaS and cloud applications (e.g., Salesforce, Slack, G Suite, Microsoft 365, Zoom, etc.) are how employees are getting work done. These apps, as well as the Wi-Fi employees are using at home (or at a hotel, a coffee shop, etc.), pose potential security risks to the enterprise network, and, thus, IT teams must have visibility and solutions for enabling their workforce to be productive while minimizing risk.

Keeper Security
Cybersecurity Disasters Survey: Incident Reporting & Disclosure

  • Nearly half (48%) of respondents have been aware of a cybersecurity attack that their organization did not report to the appropriate authorities.
  • Nearly one-fourth of all respondents (22%) said their organizations had “no system in place” to report breaches to leadership.
  • A combined 48% of respondents did not think leadership would care about a cyberattack (25%) nor would respond (23%). 

Three in Four People at Risk of Being Hacked Due to Poor Password Practices

  • Three-quarters (75%) of people globally don't adhere to widely accepted password best practices, with a majority (64%) either using weak passwords or repeat variations of passwords to protect their online accounts.

CardinalOps
State of SIEM 2023 Report

  • Enterprise SIEMs are missing detections for 76% of all MITRE ATT&CK techniques.
  • Detections are holding organizations back, not data — SIEMs are already ingesting sufficient data to cover 94% of all MITRE ATT&CK techniques.

Incode
Consumer Pulse on Biometrics Report

  • When it comes to online payments, 38% do not trust passwords to protect their processes.