UK business leaders expect ransomware threat spike in 2022

01 December 2021 Consultancy.uk 5 min. read
Profile
More news on

The majority of business leaders anticipate a rise in cyber-attacks in the coming year. Of those, 61% suggested ransomware in particular will pose a mounting threat.

In 2017, a ransomware attack known as WannaCry impacted more than 200,000 devices in over 150 countries. The watershed moment sent a tidal wave through the cyber-security landscape. The UK government came under increasing scrutiny for its approach to cyber-security, after it emerged the hack had made use of notorious weakness in antiquated Windows software to hit the NHS, while private firms spent the following months scrambling to improve their cyber-defences.

Ransomware is a type of malware from cryptovirology, which threatens to publish a victim's personal data or perpetually block access to it, unless a ransom is paid. In the years since WannaCry, despite the initial efforts to prepare for further use of ransomware, a continued spike threatens to overwhelm businesses in the years ahead. According to the National Cyber Security Centre's 2021 annual review, for example, there were three times as many ransomware attacks in the first quarter of 2021 than in the whole of 2019.

Increasing concern about ransomware attacks

Now, a new study from PwC shows UK businesses believe worse may soon come to pass. PwC’s survey of 3,600 business and technology executives from around the world included 257 respondents in the UK. Of those, a majority of 61% noted expectations that they will see an increase of reportable ransomware incidents in 2022. This comes as almost two-thirds of respondents also told PwC’s survey they expect cyber-security threats of all shapes to increase in that time.

Richard Horne, Cyber Security Chair, PwC UK, warned, “Even when their own cyber defences are solid, organisations can be vulnerable to an attack through their suppliers. A sophisticated cyber-criminal will always search for the weakest link. It is essential for business leaders to fully understand and manage their organisation’s web of third-party relationships. However, our research shows that fewer than half of UK respondents say they have responded to the escalating threats that complex business ecosystems pose.”

Many firms have had to rapidly digitalise over the course of the pandemic – leaving them more vulnerable to cyber-crime, as they may have overlooked certain facets of cyber-security in order to complete business-critical roll-outs quicker. In particular, this handed opportunities to ransomware attacks, which have caused a significant impact on organisations already dealing with the challenges posed by the Covid-19 crisis.

Looking ahead, 86% of respondents said they felt that complexity in their organisation was creating concerning levels of risk, with third-party cyber-risks in particular providing a glaring blind spot, where ransomware might find a foothold. Notably, 64% of UK respondents expect a jump in attacks on their cloud services over the next year, however only 41% profess to have an understanding of cloud risks based on formal assessments. Similarly, 63% of respondents say their organizations expect a rise in breaches via their software supply chain, yet only 42% have formally assessed their enterprise’s exposure to this risk.

Cyber security budgets set to rise

Richard Horne, Cyber Security Chair, PwC UK, noted that simply upping spending would not be enough to adapt to this, however. Even though the portion of companies increasing cyber-security budgets has risen to 63% for 2022, many are still worried the changes are not enough. In this context, firms need to evaluate their organisation on a holistic scale, before they can be confident that their cyber-security spend is achieving value for money.

Horne went on, “While 37% of UK respondents said they had implemented cloud security at scale, just 18% are fully realising the benefits of their investment… To overcome this challenge and build greater confidence in their security investments, organisations must improve their cyber risk modelling and analysis. This ensures increases in cyber budgets are allocated to priority risks and help build long-term resilience.”

One thing businesses can be sure of, is that ransomware is here to stay. Whereas other types of crises may be perceived as 'black swan' events that cannot be predicted, Crisis and Resilience Partner Bobbie Ramsden-Knowles added that ransomware attacks have become so widespread that there are now a common set of challenges and decisions that all organisations likely face, and can take action to prevent.

The PwC expert concluded, “Ransomware has the potential to rapidly disrupt an organisation’s entire business, across geographies and functions. For organisations without a framework for managing enterprise-wide crises there is an acute need to develop and embed one, to be able to respond to this type of disruptive event in a coordinated way. Developing - and aligning - ransomware playbooks for executive crisis teams and operational responders is a no-regrets move. And, testing these through wargames and exercises can reduce uncertainty, build confidence in the ability to respond and help prioritise focus on preventative measures.”