Cyber Defense eMagazine March Edition for 2022

The Cyber Security Market Has Failed Medium-Sized Businesses
The cyber security market has bifurcated into large, enterprise solutions and niche point solutions. Midmarket
companies are stuck in an inhospitable middle, where they don’t have the budget and resources
to purchase large enterprise solutions, but also have too much complexity and attack surface for point
solutions to be effective in providing security.
The high cost of implementing and operating security solutions severely impedes their adoption by midmarket
companies. Companies with 1,500 and fewer employees often have limited cyber security
budgets and very few dedicated security professionals – if they have any specialists at all. Hundreds of
employees and thousands of endpoints create an attack surface that stretches IT teams to their limits.
Mid-market companies are therefore forced to make bets on the most probable attack vectors to defend
against, leaving the rest of the attack surface exposed.
The Pandemic-Driven Shift Toward Remote Work Caught IT Departments Flat Footed
Nobody was ready for large-scale remote work in 2020. Teams were not culturally prepared to conduct
business online, office software wasn’t designed for remote work as its primary use case, and IT
departments had mostly focused on on-site and VPN-style security. The shift to predominantly remote
work in 2020 and 2021 disrupted every aspect of business and created huge opportunities for attackers
seeking to exploit the relative naivete of the new cloud working environment.
In Coro’s recent report analyzing mid-market cyber security, we found that while 50% of medium-sized
companies had email malware protection in place in 2021, 88% of them had misconfigured their
protection settings. Meanwhile, only 16% of mid-sized companies had email phishing protection in place,
and 71% of them had misconfigured settings. Other attack vectors fared similarly or worse. This means
many of the technologies deployed by IT teams, and especially the new ones deployed since the
beginning of the pandemic to enable remote work, offer little actual protection against emerging classes
of cyber threats.
Cyber Criminals Are Turning Downstream for Easier Pickings
A big score against a large enterprise is exciting for a cyber criminal, but so is the prospect of several
smaller, easier scores. We observed this in practice in 2021 as attacks on medium-sized companies
increased both in volume and in sophistication.
Specifically, we saw that attacks on mid-market companies increased by 150% in the past two years.
Moreover, these attacks are not just generic (AKA naive) attacks, but are increasingly tailored attacks for
Cyber Defense eMagazine – March 2022 Edition 92
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.