Enterprises going on the attack

Bishop Fox, a leading authority in offensive security, has published the results of a study, conducted by the Ponemon Institute, exploring enterprise adoption and use of offensive security tools and techniques to more effectively harden environments and assets. An overwhelming 64% are employing Red Teaming in some capacity, whether building their own internal team, employing external resources, or a combination. Additionally, more than half will increase investment in the function over the next 12-24 months, with nearly a quarter reporting significant increases in Red Teaming.

The report is the result of a survey of nearly 700 respondents in organisations that actively perform offensive security testing and was conducted by the Ponemon Institute. Nearly 70% of the companies comprised organisations of 5,000 employees or more.

The report underscores that despite substantial investments in threat intelligence and defensive technologies, there are levels of persistent exposure that can only be addressed by combining offensive and defensive strategies. It highlights how forward-leaning enterprises are taking matters in their own hands and leveraging attackers’ tactics, techniques and procedures against themselves. This enables them to identify weaknesses and close them down before threat actors discover them, as well as limit the scope of impact of any compromise that subverts defences.

Other notable findings in the report include:

The top three threats driving offensive security investments are ransomware (41%), social engineering (40%), and cloud vulnerabilities (39%)

More than half (52%) say employing offensive testing is effective or highly effective in defending against the top 3.

Nearly half of organisations are planning to conduct Red Team exercises at least monthly, with 26% planning to do so continuously

More than half prioritise their Red Team exercises around tabletop exercises (63%), ransomware readiness (55%), and data breach scenarios (51%)

Internal Red Teams are already in place, or in planning stages, in 70% of those surveyed

“We are approaching a tipping point in terms of organisational understanding that a wealth of external knowledge regarding the universe of active attackers, threats and vulnerabilities, is much less effective without truly understanding the specific risk and exposure dynamics in your own environment and assets,” said Tom Eston, VP of Consulting and Cosmos for Bishop Fox. “The market has been rapidly expanding to support this trend, and the overwhelming message in this report is a move to ‘full surface’ offensive security investment – from Attack Surface Management, to Red Team, to cloud, application, and product penetration testing and vulnerability assessment. If organisations aren’t complementing their defensive security program with offensive testing, they are, or will soon be, trailing the pack.” 

The success of offensive security in combating attacks is driving growth across all offensive security categories, an indication that the market tipping point is fast approaching. These indicators include:

Growth in additional offensive security use cases in the last 18 months, including cloud migration (41%), new app releases (40%), and new technology adoption (44%)

Additionally, the business drivers that overlay the use cases include improving attack surface visibility (40%), accelerating zero day response (42%), and meeting compliance and regulatory requirements (42%)

Finally, 62% of respondents express confidence or high confidence in their ability to identify assets and exposures