The UK's cyber recovery challenge: Complexity vs Preparedness

New research spearheaded by Commvault, in collaboration with GigaOm, uncovers a concerning trend: the United Kingdom records a significantly higher rate of critical cyber incidents compared to other nations. These incidents, which include security breaches and ransomware attacks, severely compromise organisational data security.

Shockingly, only a meagre 7% of UK businesses report never encountering a "business-critical" incident, whereas this figure stands at 14% globally. Consequently, an overwhelming 93% of UK enterprises have faced such an incident, 57% of which transpired over the past 18 months.

Despite frequent attacks surpassing the global standard, UK corporations lag in preparedness and recovery. The study reveals they are 21% less likely to have a dedicated recovery environment and 11% less likely to have tested their recovery plans recently, benchmarked against international counterparts. These are essential components of a comprehensive recovery strategy.

The survey highlights critical findings concerning the Minimum Viability Company (MVC) concept, which delineates essential operations needed to swiftly resume business post-cyberattack. With cybercriminals increasingly adept at embedding malware in backups or activating dormant ransomware post-restoration, this strategy is crucial for seamless operations.

Respondents identified system and application complexity (52%) and the alignment of recovery plans with shifting business requirements (47%) as major challenges to achieving MVC. Additionally, 30% highlighted struggles in distinguishing core systems from broader operations.

Nevertheless, two-thirds of UK businesses have taken foundational steps to fortify against cyber threats, with 65% maintaining a catalogue of critical systems and 61% establishing incident response frameworks. These figures surpass global averages - 50% and 41% respectively -indicating a partial investment in incident response preparation, though real-world recovery effectiveness remains elusive.

While UK businesses are honing cyber readiness practices crucial for MVC implementation, merely 36% acknowledge a compelling priority for this approach.

“With the threat landscape evolving, business recovery is now a key concern at the board level,” says Richard Gadd, Senior Vice President, EMEA, Commvault. “However, this research identifies critical gaps many organisations in the UK face as they rapidly try to advance their cyber resilience strategies. Having a tested recovery plan in place and a dedicated recovery environment in the cloud can make all the difference between chaos and continuous business.” 

“Business-scale cyberattacks are now the norm, not the exception. If complexity is killing efforts to prepare for recovery, executive leaders need to assume control and set business-level priorities, so they can keep the organisation running after an attack,” says Howard Holton, Chief Operating Officer, GigaOm.