India Braces for Phishing and Ransomware Surge, Urges AI and Automation Adoption for Security

Fortinet, a global leader in cybersecurity driving networking and security convergence, has unveiled insights from a recent IDC survey on Security Operations (SecOps) in the Asia-Pacific region. Commissioned by Fortinet, the survey sheds light on the current SecOps landscape, with a focus on Artificial Intelligence (AI) and automation. The study delves into various facets, including prevalent security practices, attack frequencies, alert fatigue, and the impact of automation on SecOps workflows, alongside challenges in skill development within the SecOps domain. Key highlights from India include:

Current Security Landscape: Threats and Preparedness

· Primary Cyber Threats: Phishing and insider threats top the list of concerns in India, with approximately 50% of organizations identifying them as their top worries. Other prominent threats include ransomware, unpatched vulnerabilities, and identity theft.

· Rise in Ransomware: Ransomware incidents have doubled across India, with 70% of organizations reporting a 2X increase in 2023 compared to 2022. Phishing and malware remain the primary attack vectors, followed by social engineering attacks, insider threats, and zero-day exploits.

· Impact of Remote Work: 88% of respondents note an uptick in insider threat incidents due to remote work. Insufficient training and communication contribute to this surge, highlighting the need to address human factors in cybersecurity.

· Resource Allocation: Only 44% of businesses have dedicated IT resources for security teams, posing challenges in bolstering security measures.

· Challenges of Emerging Technologies: Hybrid work, AI, and IT/OT system convergence pose significant challenges, with cloud technology adoption emerging as a primary concern affecting organizational vulnerability to cyber threats.

Challenges in SecOps: Alert Fatigue and Threat Containment Struggles

· Preparedness Concerns: One in three organizations express concerns about being under-equipped for threat containment, underlining the need to enhance cybersecurity capabilities.

· Alert Fatigue: Over 50% of enterprises face an average of 221 incidents per day, with 2 out of 5 enterprises dealing with over 500 incidents daily, leading to alert fatigue. Key alerts include phishing emails and multiple failed login attempts.

· Workload Constraints: On average, there is only one SecOps professional for every 214 employees, managing about 48 alerts daily, placing significant pressure on cybersecurity professionals.

· Response Time Challenges: 74% of respondents note that at least 25% of alerts they receive are false positives, with 82% taking more than 15 minutes to validate an alert, underscoring the need for automation.

· Skills Development: 88% of respondents find it challenging to keep their team’s skills updated, with automation being prioritized as a key skill for SOC teams.

Automation in SecOps: Current Adoption and Future Prospects

· High Adoption Rate: All surveyed organizations have embraced automation and orchestration tools, but there’s untapped potential in fully harnessing these technologies.

· Productivity Gains: Around 96% of respondents have experienced significant productivity gains, with automation leading to a 25% improvement in incident detection times.

· Future Plans: 60% of organizations across Asia-Pacific plan to implement automation tools within the next year, focusing on streamlining response triage and accelerating incident containment.

Beyond Threats: Future Priorities in SecOps

· Focus on Threat Detection and Response: Organizations prioritize faster threat detection (70.7%) and overall threat detection capabilities (58.5%) through automation.

· Holistic Automation: Over 50% of respondents prioritize areas such as maximizing visibility, automated responses, and threat intelligence for enhanced security operations.

· Future Priorities: Organizations plan to invest in network and endpoint security, staff cyber awareness, threat hunting and response, system updates, and security audits.

Supporting Quotes:

Simon Piff, Research Vice-President, IDC Asia-Pacific: Emphasizes the importance of automation and AI in cybersecurity, highlighting the need for organizations to adapt to evolving threats.

Rashish Pandey, Vice President, Marketing & Communications, Asia and ANZ, Fortinet: Underlines Fortinet’s commitment to automation and AI-driven security solutions.

Vivek Srivastava, Country Manager, India & SAARC, Fortinet: Stresses the significance of automation in swift threat detection and response, essential in today’s dynamic threat landscape.