October 8, 2019 By David Bisson 2 min read

A survey found that more than two-thirds of industrial organizations don’t report cybersecurity incidents to regulators.

In its “The State of Industrial Cybersecurity 2019” survey, Kaspersky Lab revealed that 67 percent of industrial organizations fail to report cybersecurity incidents to regulators. Kaspersky found that entities didn’t report on these events partly in an effort to avoid the consequences of doing so. More than half (52 percent) of industrial organizations said that security incidents constitute a violation of regulatory requirements, meaning these entities would likely need to pay a penalty for their noncompliance. Even more than that (63 percent) identified the loss of customer confidence following a security incident as one of their major business concerns.

That being said, survey participants said that complying with regulations is still important. Fifty-five percent of respondents said that regulatory compliance demands constituted their top driver in security budget investment strategies. Only 21 percent of industrial organizations disclosed that they don’t comply with mandatory industry regulations.

A Precarious ICS Threat Environment

Kaspersky’s survey follows on the heels of other reports that explored the growing threats facing industrial organizations. Back in March 2019, Kaspersky revealed that digital attacks had targeted approximately half of industrial control system (ICS) networks. Some of those campaigns consisted of destructive attacks; these types of incidents grew by 200 percent between the second half of 2018 and the first half of 2019, noted IBM X-Force.

Even so, Siemens found in its own study that less than half (42 percent) of industrial organizations rate their digital readiness as high, while just 31 percent said they could respond to a breach with high confidence. In the event of a breach, attackers could therefore wreak havoc on many industrial organizations’ systems, disrupt their functionality and, in the process, potentially threaten ordinary people’s safety.

Defending Against Industrial Cybersecurity Incidents

Industrial organizations can improve defenses against cybersecurity incidents by using machine learning to track abnormal behavior across their industrial internet of things (IIoT) devices. Security teams should also create a robust testing program to harden ICS systems against potential digital attacks.

More from

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Can memory-safe programming languages kill 70% of security bugs?

3 min read - The Office of the National Cyber Director (ONCD) recently released a new report, “Back to the Building Blocks: A Path Toward Secure and Measurable Software." The report is one of the first major announcements from new ONCD director Harry Coker and makes a strong case for adopting memory-safe programming languages. This new focus stems from the goal of rebalancing the responsibility of cybersecurity and realigning incentives in favor of long-term cybersecurity investments. Memory-safe programming languages were also included as a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today