IBM’s annual Cost of Data Breach Report for 2022 is packed with revelations, and as usual none of them are good news. Headlining the report is the record-setting cost of data breaches, with the global average now at $4.35 million. The report also reveals that much of that expense comes with the data breach version of “long Covid,” expenses that are realized more than a year after the attack.

Most organizations (60%) are passing these added costs on to consumers in the form of higher prices. And while 83% of organizations now report experiencing at least one data breach, only a small minority are adopting zero trust strategies.

Security AI and automation greatly reduces expected damage

The IBM report draws on input from 550 global organizations surveyed about the period between March 2021 and March 2022, in partnership with the Ponemon Institute.

Though the average cost of a data breach is up, it is only by about 2.6%; the average in 2021 was $4.24 million. This represents a total climb of 13% since 2020, however, reflecting the general spike in cyber crime seen during the pandemic years.

Organizations are also increasingly not opting to absorb the cost of data breaches, with the majority (60%) compensating by raising consumer prices separate from any other accurate increases due to inflation or supply chain issues. The report indicates that this may be an underreported upward influence on prices of consumer goods, as 83% of organizations now say that they have been breached at least once.

Brad Hong, Customer Success Manager for Horizon3.ai, sees a potential consumer backlash on the horizon once public awareness of this practice grows: “It’s already a breach of confidence to lose the confidential data of customers, and sure there’s bound to be an organization across those surveyed who genuinely did put in the effort to protect against and curb attacks, but for those who did nothing, those who, instead of creating a disaster recovery plan, just bought cyber insurance to cover the org’s operational losses, and those who simply didn’t care enough to heed the warnings, it’s the coup de grâce to then pass the cost of breaches to the same customers who are now the victims of a data breach. I’d be curious to know what percent of the 60% of organizations who increased the price of their products and services are using the extra revenue for a war chest or to actually reinforce their security—realistically, it’s most likely just being used to fill a gap in lost revenue for shareholders’ sake post-breach. Without government regulations outlining restrictions on passing cost of breach to consumer, at the least, not without the honest & measurable efforts of a corporation as their custodian, what accountability do we all have against that one executive who didn’t want to change his/her password?”

Breach costs also have an increasingly long tail, as nearly half now come over a year after the date of the attack. The largest of these are generally fines that are levied after an investigation, and decisions or settlements in class action lawsuits. While the popular new “double extortion” approach of ransomware attacks can drive long-term costs in this way, the study finds that companies paying ransom demands to settle the problem quickly aren’t necessarily seeing a large amount of overall savings: their average breach cost drops by just $610,000.

Sanjay Raja, VP of Product with Gurucul, expands on how knock-on data breach damage can continue for years: “The follow-up attack effect, as described, is a significant problem as the playbooks and solutions provided to security operations teams are overly broad and lack the necessary context and response actions for proper remediation. For example, shutting down a user or application or adding a firewall block rule or quarantining a network segment to negate an attack is not a sustainable remediation step to protect an organization on an ongoing basis. It starts with a proper threat detection, investigation and response solution. Current SIEMs and XDR solutions lack the variety of data, telemetry and combined analytics to not only identify an attack campaign and even detect variants on previously successful attacks, but also provide the necessary context, accuracy and validation of the attack to build both a precise and complete response that can be trusted. This is an even greater challenge when current solutions cannot handle complex hybrid multi-cloud architectures leading to significant blind spots and false positives at the very start of the security analyst journey.”

Rising cost of data breach not necessarily prompting dramatic security action

In spite of over four out of five organizations now having experienced some sort of data breach, only slightly over 20% of critical infrastructure companies have moved to zero trust strategies to secure their networks. Cloud security is also lagging as well, with a little under half (43%) of all respondents saying that their security practices in this area are either “early stage” or do not yet exist.

Those that have onboarded security automation and AI elements are the only group seeing massive savings: their average cost of data breach is $3.05 million lower. This particular study does not track average ransom demands, but refers to Sophos research that puts the most accurate number at $812,000 globally.

The study also notes serious problems with incident response plans, especially troubling in an environment in which the average ransomware attack is now carried out in four days or less and the “time to ransom” has dropped to a matter of hours in some cases. 37% of respondents say that they do not test their incident response plans regularly. 62% say that they are understaffed to meet their cybersecurity needs, and these organizations tend to suffer over half a million more dollars in damages when they are breached.

Of course, cost of data breaches is not distributed evenly by geography or by industry type. Some are taking much bigger hits than others, reflecting trends established in prior reports. The health care industry is now absorbing a little over $10 million in damage per breach, with the average cost of data breach rising by $1 million from 2021. And companies in the United States face greater data breach costs than their counterparts around the world, at over $8 million per incident.

Shawn Surber, VP of Solutions Architecture and Strategy with Tanium, provides some insight into the unique struggles that the health care industry faces in implementing effective cybersecurity: “Healthcare continues to suffer the greatest cost of breaches but has among the lowest spend on cybersecurity of any industry, despite being deemed ‘critical infrastructure.’ The increased vulnerability of healthcare organizations to cyber threats can be traced to outdated IT systems, the lack of robust security controls, and insufficient IT staff, while valuable medical and health data— and the need to pay ransoms quickly to maintain access to that data— make healthcare targets popular and relatively easy to breach. Unlike other industries that can migrate data and sunset old systems, limited IT and security budgets at healthcare orgs make migration difficult and potentially expensive, particularly when an older system provides a small but unique function or houses data necessary for compliance or research, but still doesn’t make the cut to transition to a newer system. Hackers know these weaknesses and exploit them. Additionally, healthcare orgs haven’t sufficiently updated their security strategies and the tools that manufacturers, IT software vendors, and the FDA have made haven’t been robust enough to thwart the more sophisticated techniques of threat actors.”

Familiar incident types also lead the list of the causes of data breaches: compromised credentials (19%), followed by phishing (16%). Breaches initiated by these methods also tended to be a little more costly, at an average of $4.91 million per incident.

Cutting the cost of data breach

Though the numbers are never as neat and clean as averages would indicate, it would appear that the cost of data breaches is cut dramatically for companies that implement solid automated “deep learning” cybersecurity tools, zero trust systems and regularly tested incident response plans. Mature cloud security programs are also a substantial cost saver.

• Matt Hicks, a 16-year Red Hat veteran, was named CEO of the open source firm last week.
• Hicks shared with Insider his three-point plan for Red Hat to win the hybrid cloud market.
• He will report to IBM CEO Arvind Krishna and is eyeing acquisitions in hybrid and edge computing.

Red Hat, the open source software company that IBM acquired for a record $34 billion in 2019, is gearing up to capture more of the hybrid cloud market with a new leader at its helm.

Matt Hicks, a 16-year Red Hat veteran who most recently led its products and technologies division, was appointed CEO last week. He takes over for Paul Cormier, who had been in the CEO seat for two years and will become chairman of Red Hat.

Red Hat has grown at a steady clip since it was bought by IBM as part of its ambition to become a leader in hybrid cloud, where customers use a combination of on-premises, physical data centers with cloud providers like Amazon Web Services for their IT infrastructure. 

It reported 17% growth in the second quarter earlier this week, and revenue from its flagship OpenShift software, which lets developers run code across multiple clouds and data centers, grew four and a half times from pre-acquisition, IBM said. Its software unit, which includes Red Hat, reported revenue of $6.2 billion.

The plan for Hicks and Cormier, who both now report to IBM CEO Arvind Krishna, is to continue what they consider a "close working relationship" with Krishna that hinges on maintaining Red Hat's independence and neutrality as a vendor that works openly with all the major cloud providers.

Some of that relationship has already paid off — IBM's sales force is selling Red Hat products, Cormier previously told Insider, boosting its reach.

Hicks, who has worked alongside Cormier for the past decade, said his plan for Red Hat's future isn't too different from his predecessor's, but will focus on three key areas.

"I'm in a pretty lucky position where I'm inheriting a phenomenal strategy, a core product strategy and team," Hicks told Insider. "And so my focus is on executing the opportunity that we have ahead of us."

First, the company is firmly targeting the hybrid cloud market. Echoing what parent company IBM has repeatedly called a trillion-dollar opportunity, Hicks said there's plenty more of that market up for grabs.

"Customers are starting to understand that the public clouds will specialize in innovation and they'll probably be using multiple, and their on-premise environments aren't going away," he said. "We think only a quarter of workloads have been moved so far."

Second, Hicks said Red Hat is investing more in running its OpenShift software for customers directly. The company last year unveiled managed cloud services, an offering where it can fully manage customers' IT operations in cloud providers like AWS, Microsoft Azure, and Google Cloud.

"It's a new area for us to execute and prove that we can be relied on for running mission-critical workloads, not just supporting them when customers run them," Hicks said. "I think it has equal opportunity."

Lastly, Red Hat is pushing heavily into edge computing, the model where processing power is placed closer to where data is created in the physical world, such as devices. For Red Hat, that means helping customers use their hybrid cloud infrastructure in edge environments like manufacturing floors.

Hicks says the open source company is focusing on the telecom and automotive industries, because "we do have to pick and make sure we're focused where we can deliver the most value, realistically." That includes investing in 5G, the next-generation telecommunications network that will support edge computing.

And Cormier, who has been with Red Hat for over two decades, says he will advise Red Hat's largest customers on their cloud deployments. He will run a strategic advisory board dedicated to those clients, he told Insider, and keep an office at Red Hat headquarters.

Critically, Cormier says he'll continue having a "big voice" when it comes to the company's acquisition strategy. "The only difference in the M&A strategy is, Matt will be the one making the final decision," he said.

Both IBM at large and Red Hat, in particular, appear to be gearing up for acquisition sprees amid the market downturn: Krishna recently said Big Blue is looking at firms specializing in hybrid cloud and automation, and Hicks told Insider Red Hat is focused on edge computing and hybrid cloud opportunities.

"There are a lot of options there," Hicks said. "I think it will be an exciting space to watch."

IBM has published details on a collection of techniques it hopes will usher in quantum advantage, the inflection point at which the utility of quantum computers exceeds that of traditional machines.

The focus is on a process known as error mitigation, which is designed to Improve the consistency and reliability of circuits running on quantum processors by eliminating sources of noise.