Cisco Cybersecurity

Readiness Index
Resilience in a Hybrid World
March 2023
Contents Executive Summary 3

Benchmarking Readiness 6

Protecting Identity 8

Protecting Devices 10

Protecting Networks 12

Protecting Application Workloads 14

Protecting Data 16

Industry and Size Matters 18

Conclusion20

About the Research 21

Cisco Cybersecurity Readiness Index

2 Resilience in a Hybrid World
Executive Summary

In a post COVID world, the requirements of cybersecurity While there is broad consensus that the move to hybrid
have changed as the landscape for businesses has is here to stay, its long-term success hinges greatly on
been spun on its head. Organizations have moved from organizations’ ability to safeguard themselves against new
an operating model that was largely static – where and rapidly evolving threats.
people operated from single devices from one location,
connecting to a static network – to a hybrid world in which Set against this, we wanted to understand how ready
we increasingly operate from multiple devices in multiple organizations around the world are to meet these modern
locations, connecting to multiple networks. security challenges. To do this, we developed the Cisco
Cybersecurity Readiness Index. It categorizes companies
into four stages of readiness: from Beginner, to Formative,
Progressive, and finally Mature, based on their preparedness
across five key pillars and the state of deployment of 19
A mere 15% of organizations
security solutions within those. More details on the scoring
globally are deemed to have a methodology can be found in the following section.
mature level of preparedness
The Global Cybersecurity Readiness Gap
to handle the security risks of
our hybrid world. The results are stark: according to the index, a mere 15%
of organizations globally are deemed to have a mature

Cisco Cybersecurity Readiness Index

3 Resilience in a Hybrid World
level of preparedness to handle the security risks of our Mapping Readiness Around the World
hybrid world.
As you might expect, there are variations in private
This is despite most companies being aware that the threat company cybersecurity readiness across markets, but not
is real. Four out of five (82%) security leaders we spoke to in the way we might ordinarily expect. In our index, private
globally believe cybersecurity incidents are likely to disrupt sector companies in less developed nations outperform
their businesses over the next 12 to 24 months. their peers in wealthier countries by a considerable
margin, especially in Asia-Pacific and the Americas.
And the consequences of not being prepared have never
been greater. Almost 60% of respondents said they had In the Americas, Brazil stands out as the country where
experienced some kind of cybersecurity incident in the companies are most ready to tackle today’s security
last 12 months. The incidents cost 71% of organizations challenges, with 26% of companies considered in a mature
affected at least US$100,000, with 41% saying the overall stage of preparedness. Meanwhile, companies in Canada
cost was US$500,000 or more. (9% in Mature stage), the USA (13% in Mature stage) and
Mexico (12% in Mature stage) demonstrate low levels of
We have an alarming cybersecurity readiness gap, and it’s readiness compared to the global average.
only going to widen if global business and security leaders
don’t pivot quickly. In Asia-Pacific, organizations in Indonesia (39% in Mature
stage), the Philippines, and Thailand (27% each in Mature
stage) top the chart both regionally and globally. On the
other hand, companies in richer countries like Japan (5%
Almost 60% of in Mature stage) and South Korea (7% in Mature stage) are
languishing at the bottom.
respondents said they had
experienced some kind of Markets most mature in their overall cybersecurity readiness
cybersecurity incident in Mature stage

the last 12 months.

Indonesia 39%

The Philippines 27%

Thailand 27%

Brazil 26%

This variance could be largely explained by the fact that

companies in emerging markets started their digitization
journeys more recently compared to their peers in
developed markets. That means many of these companies
do not have legacy systems holding them back, making it
relatively easier to deploy and integrate security solutions
across their entire IT infrastructure. While awareness of
security risks and their impact on business has never been
higher, this finding highlights that ‘tech debt’ continues to
be a major driver of the readiness gap.

This trend is not seen across Europe, though, where

companies are lagging the global average on readiness.

Cisco Cybersecurity Readiness Index

4 Resilience in a Hybrid World
In almost all countries less than 10% of companies are rather than later. Given the environment that businesses
deemed mature enough to tackle today’s cybersecurity operate in and the current readiness gap, a 12-month wait
issues. The UK and Germany are two exceptions, with is far too long.
17% and 11% companies in a mature state of readiness
respectively. As these companies invest in their cybersecurity
readiness, confidence in their ability to stay resilient will
Readiness by Size and Industry improve. Of the companies that were ranked Mature, 53%
said they were ‘very confident’ in the ability to stay resilient
Readiness varies across company sizes in an interesting against potential cyberattacks in the next 12 to 24 months.
way. The data shows that globally mid-sized firms of On the other hand, only 30% of companies in the Beginner
between 250 and 1,000 employees are best prepared, stage and 34% in the Formative stage said the same.
with over 19% of such firms at a mature stage of overall
readiness compared to 17% of larger businesses (1,000+ But as they deploy budgets, companies do need to think
employees). This suggests that while larger organizations about security differently. Because threats are everywhere,
may have bigger budgets, they typically require more stand-alone security strategies are no longer effective;
complex deployments, which can take longer to implement. they focus too much on threat prevention, create siloes
that can be exploited, and don’t account for the full
Smaller organizations are the least well-prepared with business impact.
just 10% being mature in their readiness. While this is not
surprising, it is an area of concern, as small companies What organizations need is security resilience, where
falling below this ‘security poverty line’ bring wide- security is foundational to business strategy and is
reaching externalities – they’re increasingly part of supply collectively prioritized throughout the organization,
chains of larger organizations, making them an attractive allowing companies to better anticipate threats and
target for malicious actors. In today’s hyper-connected bounce back faster when a threat becomes real. Most
world, it is critical to ensure there are no weak links that organizations are already thinking about resilience in
bad actors can exploit. their financial, operational, organizational, and supply
chain functions. Security resilience cuts across all of
Of course, readiness is also dependent on the type them. Resilience is about verifying threats, understanding
of industry in which our respondents work in. Those connections across the organization, and seeing the full
in sectors with the most to lose tend to have more context of any situation so teams can prioritize and ensure
companies in the Mature state of readiness, including their next action is the best one.
healthcare (18%) and financial services (19%). However, it
is retail, with 21% of organizations in the Mature category, For business leaders to build secure and resilient
that comes out on top. This likely reflects the substantial organizations, they must establish a baseline of how
number of cyberattacks this industry has faced over the ‘ready’ they are across the five major security pillars. The
years, as bad actors regularly target the personal and maturity of security infrastructure, particularly in relation
financial data held by these organizations. to local and global peers, will help organizations identify
what areas they are strong in and where they can best
Closing the Cybersecurity Readiness Gap – prioritize resources to improve their ability to be resilient.
Our Global Security Resilience Imperative Our hope is that this Cybersecurity Readiness Index will
act as a wake-up call for senior business leaders. Closing
While the cybersecurity readiness gap may be alarmingly the cybersecurity readiness gap must become a global
large, businesses are not standing still. imperative. We cannot afford to fall further behind as the
shift to hybrid continues to accelerate. The impact on
Security leaders are aware of the risks and are keen businesses, customers and society will only increase amid
to invest in their cybersecurity readiness: 86% of an explosion of hybrid threat vectors and an increasingly
organizations have plans to increase their cybersecurity complex threat landscape. While some progress has been
budget by more than 10% over the next 12 months. It is made, not enough firms are cybersecurity-ready to take on
crucial that these budget increases are delivered sooner the challenges that our hybrid world has created.

Cisco Cybersecurity Readiness Index

5 Resilience in a Hybrid World
Benchmarking Readiness

While most of us are broadly aware of the increased We asked respondents whether their companies had
security risks brought about by the move to hybrid solutions in place to meet the challenges of each pillar, and
working, what isn’t widely understood is how ready how far along they were towards full deployment.
organizations are to face those risks.
The data was then organized and categorized into a
Cisco’s Cybersecurity Readiness Index is a new way of state of readiness, where respondents were ranked from
assessing how ready businesses are. Beginner, to Formative, Progressive, and finally Mature
based on the weighted scores of each pillar reflecting their
It is sourced from a double-blind survey of 6,700 private importance: network (25%); identity (20%); devices (20%);
sector cybersecurity leaders in 27 global markets. The data (20%); and application workloads (15%).
index is based on five pillars: Identity, Devices, Network,
Application Workloads, and Data. From within those pillars, A fuller explanation of the methodology can be found at
we examined 19 different solutions required to address them. the end of this report.

Identity Devices Network Application Data

Workloads
In the hybrid work There are two aspects to In today’s way of working, As companies move some Often described as
environment, it is critical this. First are the devices the network lies at the or all of their operations ‘new currency,’ data has
for companies to be able that employees use to log heart of a comprehensive to the cloud, they are emerged as one of the
to verify the identity of on to a company network. approach to security given also experiencing a shift most valuable assets for
everyone who tries to These can be both official that people, devices, data, in the way they manage businesses. It is critical for
access network resources and personal. Second are and applications all move and deploy applications. organizations to protect
and information. One can other devices within the across it. Safeguarding the From containerization to data from unauthorized
argue that this is the first infrastructure – ranging network from malicious serverless architectures, access, use, disclosure,
line of defence from a from security cameras actors, insider threats, and and microservices, disruption, modification,
security perspective. to smart printers, which third-party risks is critical protecting application or destruction. With the
are all connected to the to the viability of the workloads is crucial in increasing amount of
network. Companies need company. today’s digital landscape. sensitive information
capabilities to verify these Attacks against these being stored and shared
devices and protect them platforms and services electronically, robust
from being accessed by can lead to sensitive security capabilities and
bad actors. data breaches, loss measures are foundational
of productivity, and to achieving this
irreparable damage to an protection.
organization’s reputation.

Cisco Cybersecurity Readiness Index

6 Resilience in a Hybrid World
 Based on the overall score, organizations are categorized
into one of four stages of readiness:

• Beginner (Less than 10): Organizations at the initial

stages of deployment of solutions.

• Formative (11 – 44): Organizations that have some

level of deployment but performing below average on
cybersecurity readiness.

• Progressive (45 – 75): Organizations with considerable

level of deployment and performing above average on
cybersecurity readiness.

• Mature (76 and higher): Organizations that have

achieved advanced stages of deployment and are most
ready to address security risks.

Looking at the overall picture, nearly half of our respondents

(47%) and their organizations fall into the Formative
category, where they have taken some of the much-needed
steps to protect themselves but cannot be classified as
ready to meet the challenges of our new hybrid world.
Progressives form the next largest cohort at 30%.

Only 15% fall into the Mature category, with a high level of
Nearly half of our
readiness. Less than one in ten (8%) are in the Beginner
respondents (47%) and their category, representing the first step on the readiness ladder.
organizations fall into the
This report represents the first study of its kind and
Formative category, where
provides a comprehensive cybersecurity readiness
they have taken some of the assessment for companies across 27 markets globally.
much-needed steps to protect
themselves but cannot be
Overall cybersecurity readiness of organizations globally
classified as ready to meet the
challenges of our new Mature 15%
hybrid world. Progressive 30%

Formative 47%

Beginner 8%

Cisco Cybersecurity Readiness Index

7 Resilience in a Hybrid World
Protecting Identity

Traditionally, cybersecurity operations focus on creating moved to remote and hybrid work arrangements, many
a strong perimeter to keep out threats. The assumption have started to add a second layer of verification. These
being that anyone who was ‘inside the wire’ was are Integrated Identity and Access Management (IAM)
authorized to be there. However, in the hybrid working solutions, such as Multifactor Authentication, where even
model, data can be spread across limitless services, when a user enters the right username and password
devices, applications, and users, making traditional combination, they are then given a second prompt to
perimeter approaches inadequate. prove that they are who they say they are.

This calls for a new security strategy where no-one and Given that identity management is ranked by our
nothing is trusted until their identity has been proactively respondents as the number one risk, it is no surprise that
verified. Our research underlines the challenge: a quarter 95% have implemented some kind of identity management
(24%) of all respondents ranked Identity Management as solution, with IAM proving most popular, with two-thirds
the number one risk for cyberattacks. saying they have deployed these solutions.

For years, companies have relied on identity management Some companies are adding yet another layer of security
solutions like Data Stores, which are a storage of things to identity management – Privileged Access Management.
like identity of a person, their username, and their This is where, even after the first two layers of identity
password. A person uses these to login, and if they match, verification, access is granted based on pre-assigned
they are granted entry. However, as companies have privileges, such as the user’s role within the company, the

Cisco Cybersecurity Readiness Index

8 Resilience in a Hybrid World
 device they are using to log in, and the location they are
logging in from. The good news is that for all the identity
management solutions – Traditional Data Stores, IAM and
Privileged Access Management – our respondents are
well progressed with most having fully deployed whichever
solution they have decided to use.

However, it is of concern that for those that have not yet

rolled out identity solutions, more than two thirds (69%)
said they have no intention to do so. For those that do
intend to roll out identity solutions, most will take from one
to as many as five years to complete their implementation.
Given that identity
management is ranked by our Overall, companies need to step up further to meet
respondents as the number the challenge of identity verification. Despite the clear
threat presented by identity management, most of our
one risk, it is no surprise that respondents are at the Formative (38%) or Beginner (20%)
95% have implemented some stage. Only 20% fall into the Mature category, with a
kind of identity management further 22% in the Progressive segment. Surprisingly it is
markets that are bigger and more mature that lag with the
solution, with Integrated Identity Netherlands (31%), France (35%) and Japan (50%) showing
and Access Management proving the highest percentage of Beginners.
most popular.
Readiness to protect identity

Mature 20%

Progressive 22%

Formative 38%

Beginner 20%

Cisco Cybersecurity Readiness Index

9 Resilience in a Hybrid World
Protecting Devices

Long gone are the days when employees accessed a For our respondents, protecting devices ranks third
corporate network from a single desktop PC. The need out of five in their list of risk potential, behind identity
to access data on the move and in a variety of forms has management and the network itself. It also seems to be
created an explosion in the number of devices employees less challenging for most with it ranking third on their list
use. The pandemic has also added to the list of devices for difficulty.
we all use regularly with cameras and microphones,
for example, helping make video conferencing a better Three quarters (73%) of our respondents have chosen
experience. to use enhanced anti-virus solutions as their key
solution to protect devices. Building protections into the
However, employee devices are not the only things operating system, such as host controls, is another way
accessing networks and data. Everything from soil organizations are protecting their devices, with 65%
moisture detectors to plant machinery, and even door saying they have deployed this type of solution. Endpoint
security systems are connected to corporate networks, protection platforms – firewalls, malware, and process
providing important and insightful data. visibility etc. – rank third in the solutions companies have
deployed.
Whatever the device, it needs to be protected. We have
seen significant data breaches in the past originating from However, there are two key trends to take note of. Firstly,
unprotected devices. the scale of deployment is partial. This is why, despite
a high number of respondents saying they have these

Cisco Cybersecurity Readiness Index

10 Resilience in a Hybrid World
 solutions in their posture, more than half (56%) of the
companies are either at the very start of their journey, or
only a short way down the path.

The second is that among those who do not have these

solutions in their posture, device management does not
seem to rank high in the list of cybersecurity priorities. Two
thirds of these respondents said their organization has no
plans at all to deploy a solution.

This shows that there is considerable work for many to do

to ensure that devices do not become the vulnerable point
in their cybersecurity strategy.

Japan is languishing at the bottom of the readiness league

table with 56% of its companies falling into the Beginner
category. New Zealand (45%) and South Korea (48%) do
not fare much better and companies in all three countries
should take note of the potential risks they run if they do
not accelerate their device security strategy. The risks are
particularly acute in Japan with 80% of companies still not
planning to do so for at least 12 months and many (60%)
are still to secure the budget for these programs.

By contrast, Indonesia is a long way in front of the

readiness stakes with three out of five companies (59%)
Despite a high number of
falling into the Mature category. Brazil (45%) and South
respondents saying they have Africa (44%) are other notable performers.
these solutions in their posture,
more than half (56%) of the
Readiness to protect devices
companies are either at the very
start of their journey, or only a Mature 31%
short way down the path.
Progressive 13%

Formative 28%

Beginner 28%

Cisco Cybersecurity Readiness Index

11 Resilience in a Hybrid World
Protecting Networks

Globally, cyberattacks are on the rise. From telecoms to Fortunately, our respondents recognize the risk; network
technology organizations and retailers, attacks have left protection ranks second in the list of their top five priorities.
networks vulnerable to exploitation. The result: billions of
data sets have been exposed across the world. Most have opted to use firewalls with built-in Intrusion
Prevention Systems (IPS). More than two-thirds (69%) of
At the last count, there had been more than 4,000 publicly firms in our survey said they had deployed this capability,
disclosed data breaches in the first three quarters of 2022
1
with network segmentation policies based on identity
alone – a significant increase on the previous year. And ranking number two (61% said they have deployed this),
the likelihood is that this is just the tip of the iceberg – with and Network Behavior Anomaly detection tools close
thousands more data breaches taking place in less well- behind at 60%. Packet Capture and Sensor Tools, though,
known organizations. come a distant fourth at 31%.

Today’s hybrid working environment calls for flexibility not only in However, the issue is that the scale of deployment is not
the number and type of devices that employees use, but also in keeping pace. Of those companies that have firewalls with
where they log in from, and where the data they need to access built-in IPS, only 56% have fully deployed, and only 64%
is stored and processed. The growth of cloud strategies – a of companies have fully deployed network segmentation
bedrock of hybrid working – means that employees need to policies.
be able to roam across multiple networks throughout their day,
1. https://www.cshub.com/attacks/articles/the-biggest-data-breaches-and-leaks-
rendering the network more vulnerable to cyberattacks. of-2022

Cisco Cybersecurity Readiness Index

12 Resilience in a Hybrid World
Regardless of where companies sit in their deployment, The problem is most acute in Japan where 82% of
and which technology they use, there are some very real businesses fall into the least prepared categories. Hong
issues highlighted by our index which shows that despite Kong and Italy are not too far behind with 72% in the
companies rating network protection as their number two Formative or Beginner classification.
priority, most (56%) are either in the Formative or Beginner
category and just 19% sit in the Mature category – the By contrast, some of the less developed nations in our
most advanced state of readiness. research are most ready to protect their network. Perhaps
this stems from the recognition that failing to protect their
This should be a clear signal to CISOs, CTOs and even networks presents an existential threat. Whatever the
CEOs that more work needs to be done to ensure trigger, though, Indonesia tops the readiness rankings
organizations are better prepared to protect their with seven in ten (69%) falling into the top two categories.
networks. Thailand is second best prepared with six in ten (60%)
ready to meet the threat.

One of the things that companies need to consider is that

as business models move from static to dynamic, and
Despite companies rating hybrid work becomes the norm, network security must
network protection as their keep up. They need to look at novel approaches such as
number two priority, most (56%) Secure Access Service Edge (SASE) to be adequately
prepared to tackle the risks these shifts present.
are either in the Formative or
Beginner category and just 19% SASE combines traditional network security functions
sit in the Mature category. with software-defined wide-area networking (SD-WAN)
capabilities. It allows organizations to provide secure and
reliable access to cloud-based applications and services
for remote workers, regardless of their location. SASE also
allows organizations to implement security policies that are
specific to the user, device, and application, rather than
just the network. The survey did show positive signs that
companies are likely to continue to improve on this front.
Among the companies that are still deploying network
security solutions, half (50%) said they are planning to roll
them out within the next 12 months.

Readiness to protect networks

Mature 19%

Progressive 25%

Formative 46%

Beginner 10%

Cisco Cybersecurity Readiness Index

13 Resilience in a Hybrid World
Protecting Application Workloads

As we have already seen, the move to hybrid work and that 750 million cloud-native applications will be created
the proliferation of devices has made cybersecurity globally by 20252.
exponentially more complex. This, however, is only part of
the story in our post-COVID world. While this has great benefits, it does present a new layer
of risk for companies. The shift to modern, distributed
Businesses have come to rely heavily on applications, applications can leave organizations more vulnerable due
particularly so over the past couple of years. With to an ever-expanding attack surface. According to latest
the increased expectations that end users now have research by Cisco AppDynamics, 78% of IT professionals
for always-on, secure, and exceptional experiences, globally feel that their organization is vulnerable to a multi-
organizations are under pressure to accelerate their staged security attack that would affect the full application
digital transformation projects. Hundreds of thousands of stack over the next 12 months3.
organizations across the world are building, modernizing,
and deploying all types of business-critical applications Security teams have had to introduce a range of tools to
including traditional/on-premises, as well as modern, their armories to protect against the additional threats
distributed cloud-native solutions. presented in this more dynamic environment.

In recent years, the pace of growth for applications has

been phenomenal, and it will increase exponentially in the 2. https://news.yahoo.com/idc-updates-future-digital-innovation-123000233.html
3. https://www.appdynamics.com/c/dam/r/appdynamics/2023/06-resources/08-
coming years. International Data Corporation (IDC) projects ebook/AppDynamics_Application_Security_Report-1.pdf

Cisco Cybersecurity Readiness Index

14 Resilience in a Hybrid World
Respondents to our survey have recognized the challenge, The good news for nervous CEOs and those responsible
and 97% have deployed some kind of solution to protect for governance is that most respondents (88%) plan to
application workloads. 66% have opted to use a host deploy application protection solutions within 24 months.
software firewall but endpoint protection was a close Although there are a worrying number of laggards with
second with 64% of organizations choosing this to 12% expecting it will take three to five years, a substantial
protect themselves. Less popular are application-centric number of the delayed deployments are hamstrung by
protection tools (55%), and data loss prevention software budgets, with only just over a third (39%) having agreed or
(DLP) with just over a third choosing this route (34%), and allocated the necessary funds.
visibility and forensic tools ranked fifth.
Less good news for worried CEOs is that, looking
While host software firewalls proved to be the number across all our respondents, two-thirds (65%) fall into the
one choice for most firms, only two-thirds (67%) have fully Formative or Beginner category of readiness. This means
deployed the solution. Much of the rest are in the middle their organizations are either low (14%) or below average
of deployment with 6% saying they have either just started (51%) performers when it comes to readiness to protect an
deployment, or not yet begun. organization’s application infrastructure.

Deployment of endpoint protection tools is even further In short, it means that while 97% of respondents have
behind with a little over half (57%) fully deployed and 35% rolled out application protection solutions, most are not yet
presently deploying. ready to meet the challenges ahead.

Sadly, Japan again leads the way in countries less prepared

to meet the challenge in this area of cybersecurity with half
of respondents (47%) falling into the Formative category and
While 97% of respondents have a huge 39% in the Beginner grouping.

rolled out application protection While Hong Kong and France fare better, they still rank
solutions, most are not yet ready 26th and 25th respectively in terms of readiness to repel
to meet the challenges ahead. attacks on application workloads. 81% of Hong Kong’s
respondents fall into the bottom half of preparedness
while more than seven out of ten (77%) of organizations in
France are low or below average performers.

As companies plan to take the next steps in readiness

on this front, they should keep in mind that speed and
coordination are paramount when dealing with application
security risks. Bad actors can take advantage of gaps and
delays between siloed security and application teams,
resulting in costly and damaging consequences.

Readiness to protect application workloads

Mature 12%

Progressive 23%

Formative 51%

Beginner 14%

Cisco Cybersecurity Readiness Index

15 Resilience in a Hybrid World
Protecting Data

Billions of datasets were stolen as a result of cybersecurity data or to ensure that they are able to backup and recover
breaches in 2022, according to industry estimates. lost data. More than two-thirds of firms (67%) have chosen
these solutions for this pillar of protection.
For many affected, these hacks are an inconvenience
resulting in wasted time changing personal details, Identification and classification with data leak protection
passwords and so on. For businesses, the impact of is applied by 55% of organizations, while host IPS and
data leaks can be highly significant. Not only do firms protection tools provide a way forward for 41%.
spend significant time on resolving the breach and
enacting disaster recovery plans, but there are also major The good news, bearing in mind the consequences of
implications once the initial crisis is over. Regulators often lost data, is that 94% have either fully or partially
want to understand the full extent of the incident and there deployed encryption tools – which is the number one
can be punitive fines for firms that have not taken the choice of most firms – while 92% have either completed
right steps. Brand reputation can take years to recover for or are on the road to completing the rollout of backup and
firms that have not acted properly to put in place expected recovery tools.
cybersecurity mitigation programmes.
Identification and classification with DLP are a little behind
Our respondents seem to understand these implications on deployment, with just 55% fully deployed, while that
and 98% say their organizations have solutions in place to number is 61% for host IPS and protection tools.
protect data properly. Most have chosen either to encrypt

Cisco Cybersecurity Readiness Index

16 Resilience in a Hybrid World
 There is evidence that teams at many organizations still
believe they need to do more to protect data with most
that have not yet deployed solutions saying that they are
planning rollouts. Of these, backup and recovery tools are
the most popular with nearly half (48%) of the stragglers
planning to deploy this solution.

There are some challenges over timelines, however, with

57% of respondents likely to wait more than 12 months
before beginning their deployments. This stems from a
lack of budgets with more than half (56%) not yet having
agreed funding.

The critical nature of data protection explains why the

Mature and Progressive categories account for half (50%)
of the respondents in our survey, a significantly higher
proportion than we saw for device protection readiness,
for example.

As we look at the readiness data by country, Indonesia

again leads the way in preparedness with 72% of all
respondents in this market falling into either the Mature or
Progressive stage. Not far behind is Brazil with just over
two-thirds of respondents (68%) in either the high or above
average performance category. South Africa is in third with
65% of respondents falling into the top two groups. At the
The critical nature of data
other end of the readiness index is Japan with 77% of its
protection explains why the respondents underperforming. South Korea is not far behind
Mature and Progressive also with 74% in the bottom two categories.

categories account for half (50%)

of the respondents in our survey. Readiness to protect data

Mature 22%

Progressive 28%

Formative 28%

Beginner 22%

Cisco Cybersecurity Readiness Index

17 Resilience in a Hybrid World
Industry and Size Matters

As we look at the industries that are most ready for the years, and the pressure regulators are applying to keep
challenges ahead, they tend to be dominated by those with financial and personal data safe.
most to lose from cybersecurity incidents, and most to gain
from keeping threats at bay. Healthcare, with the enormous If we look at each of the five pillars of security protection,
challenge of keeping patient records safe, has the third some other industries stand out in their readiness to protect
highest number of organizations in the Mature category specific areas of their operations. Travel Services is the
(18%) while Financial Services comes in second at 19%. most progressed among all industries in the protection
of data, with 26% of organizations in the Mature category
– a necessary step given the large amount of personal
information they process each day for customers taking
Retail comes out top with 21% flights and booking accommodation. It is also the second
of organizations in the Mature most advanced in the protection of devices after Retail,
followed by Manufacturing which comes in third with 35% of
category.
organizations at the Mature stage. This could be attributed to
the large number of IoT devices deployed in these industries.

Retail comes out top with 21% of organizations in Surprisingly, Restaurant Services shows a high level of
the Mature category. This reflects the cybersecurity readiness when it comes to identity management, coming
challenges the industry has seen over the last several in at second place with 25% of organizations at the Mature

Cisco Cybersecurity Readiness Index

18 Resilience in a Hybrid World
 in the Mature category (19%) than their larger competitors,
and more in the Progressive category (31%) too.

These organizations are in the sweet spot. Large enough to be

able to commit the budgets needed to get themselves ready
to fend off cybersecurity attacks and agile enough to be able
to deploy without the bureaucracy of larger businesses.

It goes without saying, unfortunately, that smaller

organizations – those of up to 250 employees – tend to
be less ready with more than 50% of their respondents
dropping into the underperforming, Formative category.
What’s more, small organizations show a greater disparity
between the two ends of the readiness spectrum.
Surprisingly, it is the mid-sized
There are more Beginners than Mature organizations among
companies – those of between smaller organizations in four out of the five pillars of security
250 and 1,000 employees – readiness. This is in contrast to larger organizations, which
that are best prepared with have more respondents at the Mature stage than the
Beginner stage across almost all five pillars of security
more organizations in the protection. In particular, while organizations of all sizes are
Mature category (19%) than most progressed in device protection, almost one third of
their larger competitors. smaller organizations (32%) are in the Beginner category,
significantly more than those that are mature (27%). The
disparity could be due to the diversity among companies
of this size, which may comprise family businesses,
stage, just after Retail. This reflects the business models professional services firms, tech start-ups and more - all
of many casual dining chains which require restaurant with varying levels of knowhow. With small and medium
managers at multiple locations to order through a central enterprises representing about 90% of businesses and
system, as well as report takings and manage staff. more than 50% of employment worldwide4, more support is
needed to help them ramp up their security readiness.
At the other end of the scale is Transportation where
a little over 16% of organizations fall into the Beginner Industries most mature in their overall cybersecurity readiness
category. This is somewhat surprising given it forms part of Mature stage

a country’s critical infrastructure but reflects the numerous

legacy systems that tend to characterize this industry.

The Media and Communications sector ranks 17th on the

21% 19% 18%
readiness index (second to last), with 15% in the Beginner Retail Financial Services Healthcare
category. Given the power of media in today’s world and
the need to protect populations from bad actors, this is Industries at the start of their cybersecurity journey
unexpected. We know media organizations are targeted, a Beginner stage

recent example being the ransomware attack against the

UK’s Guardian in late December, 2022.

As we might expect there are differences in readiness

depending on the size of the organization. Surprisingly, it is
16% 16% 13%
Transportation Media and Personal Care
the mid-sized companies – those of between 250 and 1,000 Communications and Services

employees – that are best prepared with more organizations 4. Small and Medium Enterprises (SME) Finance, World Bank

Cisco Cybersecurity Readiness Index

19 Resilience in a Hybrid World
Conclusion

Those charged with protecting their organizations are respondents (50%) plan to finalize deployments within the
faced with a myriad of new challenges brought about by next 12 months.
the once-in-a-generation effects of the global pandemic.
Despite its immediate effect on the world of work being Protection of devices is the most advanced of all five
largely complete, the effects on IT infrastructure are still pillars, with almost a third of organizations (31%) falling
being felt – and nowhere more so than in the offices of into the highest performing category of readiness. As with
CISOs who are faced with a complex web of problems. identity management and the network, the challenge is
deployment, with more than half (56%) of companies at
In today’s business environment, significant thought and either the Formative or Beginner stage. On the bright side,
effort needs to be given to how to protect identities, though, 88% of organizations that have not yet deployed
devices, network, data, and applications that operate solutions plan to do so within the next two years.
dynamically. The five pillars of security all need to be
protected and they need to work in harmony or else Looking at how organizations protect application
organizations face the risk of presenting a target of workloads, 97% have deployed some kind of solution with
opportunity to bad actors. most opting to use a host software firewall. This pillar is
the least well advanced - nearly two-thirds (64%) fall into
the Formative or Beginner stage of readiness. This means
they are either Beginners (14%) or below average (51%)
The five pillars of security all performers when it comes to readiness to protect an
need to be protected and they organization’s application infrastructure.

need to work in harmony or

When it comes to protecting data, 98% of respondents
else organizations face the risk of told us they have solutions in place. Most (67%) have
presenting a target of opportunity chosen to encrypt data or ensure that they are able to
backup and recover lost data. A large majority (94%) have
to bad actors.
either partially or fully deployed these solutions. These
positive responses are also reflected in the readiness
index where Mature and Progressive categories account
Our report finds that in all five areas, businesses across for exactly half (50%) of the respondents in our survey.
the world are making progress albeit some industries are
further ahead than others. The picture, then, is largely positive.

Progress is not even across all five pillars. Identity In critical areas, significant steps have been taken to
Management – recognized as the most critical area by secure organizations against cybersecurity threats.
our respondents – still has room for improvement, with However, organizations around the world – and perhaps
close to three in five respondents (58%) finding themselves governments – need to recognize that there is a long way
in either the Formative or Beginner category. Nevertheless, to go. Deployments of some solutions, particularly those
95% are at least at some stage of deployment with a solution. for identity, devices and networks, are not being rolled
out as quickly as they could, leaving some organizations
Efforts to protect the network – a particularly significant vulnerable to attack.
area given it is the backbone of all IT infrastructures
– faces a similar situation with over half (56%) of When the consequences of cyberattack are so clear to
respondents at the lower end of the readiness spectrum. see, readiness must be a priority for all organizations and
That indicates many are in the early stages of deploying deployment of solutions needs to be accelerated.
solutions although the good news is that half of our

Cisco Cybersecurity Readiness Index

20 Resilience in a Hybrid World
About the Research

The Cybersecurity Readiness Index is sourced from a then derived based on the stage of deployment of various
double-blind survey of 6,700 private sector cybersecurity solutions under each of the five pillars, with partially
leaders. The organizations cover 27 territories in deployed solutions assigned a 50% weighting and fully
North America, Latin America, EMEA and Asia-Pacific: deployed solutions weighted at 100%.
Australia, Brazil, Canada, China, France, Germany, Hong
Kong SAR, India, Indonesia, Italy, Japan, Malaysia, The scores for each pillar were then combined and
Mexico, Netherlands, New Zealand, Philippines, weighted to arrive at an overall cybersecurity readiness
Poland, Singapore, South Africa, South Korea, Spain, score for each organization. The importance of each pillar
Switzerland, Taiwan, Thailand, UK, USA and Vietnam. was weighted as network (25%); identity (20%); devices
(20%); data (20%); and application workloads (15%).
The index is based on five pillars: Identity, Devices,
Network, Application Workloads, and Data. From The respondents are drawn from 18 industries: business
within those pillars, we examined 19 different solutions services; construction; education; engingeering, design,
required to address them. Respondents were asked to architecture; financial services; healthcare; manufacturing;
indicate which of these they had deployed, the stage media & communications; natural resources; personal
of deployment, and if these solutions were not already care & services; real estate; restaurant services;retail;
deployed then what budgets had been approved, and the technology services; transportation; travel services;
intended timeline of deployment. wholesale and ‘others’.

Each solution was assigned an individual weightage The research was carried out between August and
based on its relative importance to helping safeguard the September 2022 using online and telephone interviews.
applicable pillar. The scores for each organization were

Measuring Security Readiness – weightages

Identity Devices Network Application Data

Workloads
CapabilityWeightage CapabilityWeightage CapabilityWeightage CapabilityWeightage CapabilityWeightage

Traditional data Built-in protections Network segmentation Host software Encryption tools 10%
stores like AD 30% in the OS such as policies based firewall 15%
AV and host controls 10% on identity 40%

Integrated IAM Anti-virus with some Firewalls with Endpoint protection Identification and
solution 60% enhanced features 20% built-in IPS 25% capabilities 35% classification with DLP 20%

Privileged End-point protection Network behavior DLP 10% Backup and

Access platform (Firewall, anomaly detections recovery 50%
Management 10% malware, USB controls, tools 25% Application centric
process viability) 70% protection tools 20% Host IPS &
Packet capture protection tools 20%
and sensor tools 10% Visibility and
forensic tools 20%

Pillar weightage: 20% Pillar weightage: 20% Pillar weightage: 25% Pillar weightage: 15% Pillar weightage: 20%

Cisco Cybersecurity Readiness Index

21 Resilience in a Hybrid World
Americas Headquarters Asia Pacific Headquarters Europe Headquarters
Cisco Systems, Inc. Cisco Systems (USA) Pte. Ltd. Cisco Systems International BV Amsterdam
San Jose, CA Singapore The Netherlands

Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco Website at https://www.cisco.com/go/offices

Cisco and the Cisco logo are trademarks of registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to www.cisco.com/go/trademarks.
Third-party trademarks mentioned are the property of their respective owners. To use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)