Majority of Attacks Successfully Infiltrate Without Detection and More in Mandiant Security Effectiveness Report 2020

Organizations have been managing
security based on assumptions and best guesses for decades. However,
these assumptions have resulted for many in financial and operational
inefficiencies, defensive regression and an inability to determine if
organizations are actually making the right decisions for their
security posture.

The 2020 edition of our Mandiant
Security Effectiveness Report explores this topic further,
revealing insights into (and data about) how well organizations are
protecting themselves against the growing number of cyber threats and
attacks, and the overall effectiveness of their security infrastructure.

The Results: Alerts Were Generated for Only 9% of Attacks

Every organization’s environment is unique, complex and always
changing, and in the report we uncovered some interesting results. For
instance, we found that while organizations invest large sums in
security controls and assume that their business-critical assets are
fully protected, the reality is that attackers are successfully
infiltrating the majority (53%) of environments without being
detected. We found that 26% of attacks successfully infiltrated
environments but were detected, and 33% of attacks were prevented by
security tools. Alerts were generated for only 9% of attacks,
demonstrating that most organizations and their security teams do not
have the visibility they need into serious threats, even when they use
central SIEM, SOAR and analysis platforms.

The Mandiant Security Effectiveness Report 2020 also takes a
deeper look into techniques and tactics used by attackers, as well as
the primary challenges most commonly uncovered in enterprise
environments through security validation and conducting testing:

• Reconnaissance: In testing network traffic, organizations
  reported only 4% of reconnaissance activity generated an alert
• Infiltrations & Ransomware: 68% of the time,
  organizations reported their controls did not prevent or detect the
  detonation within their environment
• Policy Evasion: 65% of the time, security environments were
  not able to prevent or detect the approaches being tested
• Malicious File Transfer: 48% of the time, controls in place
  were not able to prevent or detect the delivery and movement of
  malicious files
• Command & Control: 97% of the behaviors executed did not
  have a corresponding alert generated in the SIEM
• Data Exfiltration: Exfiltration techniques and tactics were
  successful 67% of the time during initial testing
• Lateral Movement: 54% of the techniques and tactics used to
  execute testing of lateral movement were missed

What Organizations Need to Do Now

There are actions organizations can take to break out of this
assumption cycle. They need to continuously monitor and measure
security effectiveness, and to do that, they need empiric evidence in
order to specifically identify the gaps, how to address them, and
improve people, process and technology. Measuring cyber security
effectiveness is a continuous process, and doing so successfully
requires the right technology tools—such as Mandiant
Security Instrumentation Platform, which removes the assumptions
so that organizations can validate and optimize their security programs.

Check out the full
press announcement now. Interested in learning how to validate
controls against current and actual attacks? Check out our blog
posts: Addressing
the Perception Versus Reality Conundrum and Cyber
Risk and Security Effectiveness in the Digital Age.

Register today for webinar, 5
Steps to Security Validation, where Major General Earl Matthews
USAF (Ret) discusses how to move beyond assumptions with automated and
continuous security controls validation; identify and measure
vulnerability gaps; manage and suggest remediation steps by arming
security practitioners with meaningful evidence; and validate an
organization’s ability to defend itself by using real adversary behaviors.

And of course, download a full copy of the
Mandiant
Security Effectiveness Report 2020, including a list of
the 10 fundamentals for successful cyber security effectiveness validation.