The SpyCloud Ransomware Defense Report2 Table of Contents The Escalating Ransomware Problem Section 1 | Losing Ground to Ransomware Section 2 | Visibility Gaps and Ineffective Countermeasures Creating Greater Risk Section 3 | Overcoming Barriers and Improving Preparedness Focus on Prevention to Boost Resilience About SpyCloud03 06 10 14 19 193 The 2022 SpyCloud Ransomware Defense ReportThe Escalating Ransomware Problem Within the past 12 months, ransomware attacks have forced a 157-year-old college to close its doors , a leading automaker to halt operations for a day, and an entire nation to declare a state of emergency. After dominating the headlines for several years, these kinds of stories may feel like old news by now. Yet the escalation of the ransomware threat into a global crisis keeps it at the top of the cybersecurity agenda for many organizations. A recent SpyCloud sponsored survey of enterprise CISOs found that ransomware is the most concerning issue they face today. And for good reason: 66% of organizations were hit by ransomware in 2021, compared to 37% in 2020. Not only is ransomware more prolific but threat actors also have gotten savvier – they succeeded in encrypting data in 65% of attacks last year, up from 54% in 2020. Adding to the injury is the fact that the majority of ransomware schemes now involve double extortion, with attackers stealing data first and threatening to leak it if the ransom isn’t paid. Just two years ago, only one gang used this tactic while today it’s present in 77% of attacks . In last year’s Ransomware Defense Report, we learned that organizations felt pessimistic about their prospects of avoiding an attack. Only 18% of those surveyed believed a ransomware incident wasn’t likely to happen to their organization, while 22% believed it would likely happen multiple times. We wanted to see how things have changed since then – and this year’s survey found that organizations feel even less confident today in their ability to fight back. As we discuss in this report, ransomware remains a broad, persistent, and complicated problem to solve. To help organizations gain a more holistic understanding of this threat, we also discuss the often-overlooked aspects of ransomware attacks and how organizations can address them. 4 Key Findings 1. The prevalence of ransomware attacks is on the rise. Year over year, we saw a significant decrease in the number of organizations that haven’t been hit by ransomware in the past 12 months (10% in 2022 vs. 27.5% in 2021) and a significant increase in the number of those that have experienced multiple attacks (50% were hit two to five times in the past year vs. 33.5% the previous year, and nearly 78% were hit between two times and 10+ times in the past year vs. nearly 52% the year before).• The prevalence and impacts of ransomware attacks • Countermeasures that organizations currently have in place and/or plan to add • The greatest risks and biggest obstacles related to ransomwareAbout the SpyCloud Survey Following the 2021 Ransomware Defense Report, SpyCloud wanted to learn how security leaders and practitioners’ perceptions about the threat have changed and what they’re doing differently, if anything, to defend against ransomware. This year, we surveyed 310 individuals in active IT security roles at US, UK, and Canadian organizations that have at least 500 employees. We examined areas such as: In addition to highlighting the survey findings, the report offers insights into how you can boost your organization’s ransomware defenses. We encourage you to use this actionable data as a benchmark for your organization’s preparedness and for making decisions on how to close your preparedness gaps. The 2022 SpyCloud Ransomware Defense ReportSurvey Demographics SpyCloud solicited responses from individuals whose roles range from IT security analysts and architects/ engineers, all the way to the executive s