Amount of employees

Of the respondents who were aware of a cyber attack, more than 80% recorded fewer than 6 incidents. Nearly two in 10 of the impacted companies recorded more than 5 attacks. Remarkably, in 22% of cases, those who did not detect incidents did not know whether their organization had neutralized attacks.

Larger organizations (with 250 or more employees) are more likely to fall prey to cybersecurity incidents than small and medium-sized businesses (with 10 to 249 employees). Among very large companies (+ 2,000 employees), 45% reported experiencing an incident in the past 12 months. This could be because very large companies are better able to detect attacks, or because they are more likely to be attacked due to the larger attack area.

In 2023, 30% of respondents report having experienced a cybersecurity incident*, a percentage in line with the previous year’s results. That over a third of ‘incident-free’ participants admitted to having little confidence in their ability to detect incidents may indicate an underestimate.

Due to digital transformation, working from home and the rise of new technologies, the ‘attack surface’ of cybercriminals is increasing year after year. At the same time, hackers are increasingly better organized and employ more sophisticated modes of attack. According to the International Monetary Fund, the number of incidents has more than doubled since the Covid pandemic. It goes without saying that Belux companies are also targets.

Three-quarters of respondents had experienced social engineering attacks, such as phishing, vishing and smishing. In these cases, cybercriminals exploit human psychology to gain unauthorized access or extract sensitive information. This high prevalence underlines the need for robust defenses and ongoing awareness-raising of employees. Note, too, the emergent use of deep fakes with which cybercriminals are attempting to deceive them.

Nearly half the affected companies declared malware incidents. Three-quarters of these cases were combined with ransomware. These proportions remain fairly stable compared to the previous year.

Imperfections in software code or system configurations create vulnerabilities. They compromise data integrity and security and represent 41% of the reported cases.

Nearly half of respondents reported decreased productivity resulting from cybersecurity incidents. A similar number reported attack-related costs, including notifying authorities, customers and stakeholders.

Reputational damage, including negative publicity, loss of trust and damage to brand image, also occurs frequently. Surprisingly, about 30% of respondents reported that they had not experienced any direct financial impact or damage. This may be due to effective security measures or incidents that did not directly affect the company profits.

Cyber incidents prevented employees from performing their duties in one in four of the affected targets. This is down from the 2023 cybersecurity report (30%). In most cases, the unavailability was limited to only a few employees for up to one week.

A quarter of incidents were the result of carelessness or inadvertent mistakes by employees. For example, wrong configurations or unintentional clicks can lead to a security breach. Nearly 30% of incidents were intentionally committed by internal or external parties who purposefully carried out attacks. A combination of both factors was involved in 44% of cases. The results of Verizon’s 2024 Data Breach Investigation Report confirm these figures. They found that inadvertent errors were the root cause in 68% of investigated incidents.

According to Verizon's 2024 Data Breach Investigations Report, 62% of financially motivated incidents involved ransomware or extortion. Verizon calculated the median loss at $46,000 per breach. However, financial losses from incidents also happen due to data corruption and destruction, loss of productivity, and theft of intellectual property or personal data.

IT leaders show low confidence in their internal and external communications and public relations concerning incidents. They also rate their ability to contain and eradicate threats as weak.

Identify, Protect, Detect, Respond & Recover is a popular framework from NIST to map cybersecurity actions. It shows that among those surveyed, predicting and identifying (Identify) potential risks is the least well established. Prevention and detection are already better, but there is still room for improvement. The average level of practicality lies in taking the necessary actions (Respond) and the recovery process (Recover).

Large companies are more likely to have higher cybersecurity maturity across the five core functions of the framework. On the other hand, there is still room for growth among SMEs, especially in Identify and Respond.

Cyber attacks can manifest themselves in any business department. A sophisticated strategy that covers the entire organization is, therefore, essential.

More than half of respondents experienced a shortage of specialized personnel in the security department. That’s significantly higher than the previous year when 36% struggled with a gap in cybersecurity skills. That higher percentage clashes somewhat with the observation that a significant number of companies rely purely on their own IT department. However, a significant portion of decision-makers do intend to close the skills gap through hiring. Surprisingly, a quarter of respondents have no concrete strategy in that regard.

The ‘war for talent’ rages fiercely within the IT and cybersecurity sectors. For many companies, it is difficult to recruit and retain those possessing the right profiles. An Agoria survey showed that the cybersecurity sector had more than 1,200 job openings, at a rate of 16%, higher than the IT sector. Consequently, given the ever-increasing attack intensity, the gap between desired and available cybersecurity competencies is only widening.

In the rapidly changing world of cybersecurity, inaction is not an option. A proactive approach that includes the necessary reactive processes ideally figures high on the agenda of every organization.