Nearly two-thirds of business professionals aren’t confident in their abilities to prevent and address serious cyberattacks, according to a recent report from the Ponemon Institute and Illusive Networks. The report analyzed how effective organizations are in minimizing damage caused by silent attackers.

The study surveyed 627 IT and IT security practitioners within the US, who are all involved in the IT security solutions and practices within their organizations. Security budgets are expected to increase in the coming year, with threat detection spending growing from 32% to 40%, but preventative security control spending is dropping from 31% to 18%, the report found.

SEE: IT leader’s guide to cyberattack recovery (Tech Pro Research)

This decrease in preventative security controls could be detrimental to organizations, especially since only 25% of respondents said they felt confident in their abilities to respond effectively to cyberattacks, according to the report. When asked to rate themselves on a scale of 1 to 10, only 28% of respondents rated themselves a 7 or above on their ability to discover improperly stored user credentials. Additionally, only 40% of organizations rated themselves 7 or higher in their ability to detect that same type of attack, the report added.

“To reach sensitive data and critical systems, these attackers use valid credentials and connections that the business itself creates, making them very difficult to detect,” said Ofer Israeli, founder and CEO of Illusive Networks, in a press release. “These findings suggest that organizations of all sizes are at risk and must drive improvements in their abilities to preempt, detect and respond to these pernicious threats.”

SEE: Man-in-the-middle attacks: A cheat sheet (TechRepublic)

While business leaders are crucial to mitigating risk, most do not clearly communicate business risk priorities, the report found. Security leaders are often times not included in planning new tech and business initiatives, and most security teams aren’t given risk-informed visibility on how attacks can ultimately affect the business, the report added.

This lack of communication and inability to prioritize attacks based on potential impact was cited as one of the largest obstacles to effective incident response, according to the release. Only 37% of respondents agreed that when a system is compromised, they are able to tell what critical services were impacted.

Check out this TechRepublic article for advice on how to better train your employees for cybersecurity.

The big takeaways for tech leaders:

  • Nearly two-thirds of employees aren’t confident in their abilities to prevent and recognize serious cyberattacks. — Ponemon Institute, 2018
  • Business leaders do not clearly communicate business risk priorities, leaving security leaders in the dark. — Ponemon Institute, 2018