Menu
Stats, Trends, and Quotes
Stat 35% of Federal cyber leaders say their agency is using AI for cybersecurity today Stat Less than 1 in 3 Federal cyber leaders fully trust AI to automate cybersecurity decisionsStat 81% of Federal cyber leaders say accelerating AI adoption is critical to their agency’s resilience against evolving threats Trend As technology evolves, 86% of Federal cyber leaders feel human-AI collaboration will become the cornerstone of effective cyber strategies Stat The Defense Information Systems Agency (DISA) expects to roll out its Thunderdome program to 60 sites in fiscal year (FY) 2024 – thus far the agency has deployed the zero trust program to 23 sitesQuote "You can build, you can operate, you can maintain, but if you’re not securing, at the end of the day you’re not going to be able to operate effectively – Jen Easterly, Director, Cybersecurity and Infrastructure Security Agency (CISA) Stat 83% of TMF investments awarded since 2021 have been focused on cybersecurityQuote "Zero trust integration offers the most robust and reliable approach to cybersecurity, ensuring that our systems are resilient against evolving threats, while safeguarding our nation’s interests " – David McKeown, Deputy Chief Information Officer (CIO), Department of DefenseQuote “If you look at our funding, and if you look at our cyber investments we’re making and the time we’re spending, zero trust is first and foremost among what we’re doing" – John Sherman, Chief Information Officer (CIO), Department of Defense Stat President Biden's proposed FY25 budget allocates $13 billion in cybersecurity funding across the Federal government. This includes $103 million for the Cybersecurity and Infrastructure Security AgencyQuote “A greater emphasis is needed on human-centered approaches to cybersecurity where people’s needs, motivations, behaviors, and abilities are at the forefront of determining the design, operation, and security of information technology systems” – Federal Cybersecurity Research and Development (R&D) Strategic PlanQuote "If your agency is inching towards zero trust now, you probably want to look at accelerating that greatly to try to best keep up with the pace at which AI can start influencing" – Ken Bailey, Acting Deputy Branch Chief of Cyber Defense Coordination and Threat Hunting, Cybersecurity and Infrastructure Security Agency (CISA)Stat GAO reports that 15 of 23 inspectors general (IGs) from CFO Act agencies found their current FISMA programs to be ineffective. Going forward, the agencies and IGs said they want metrics that are directly tied to performance goals, account for workforce issues and agency size, and incorporate riskStat HHS has found a 93% increase in large breaches reported to the HHS Office for Civil Rights (OCR) from 2018 to 2022 – with a 278% increase in large breaches involving ransomwareQuote “The healthcare sector is experiencing a significant rise in cyberattacks, putting patient safety at risk. These attacks expose vulnerabilities in our health care system, degrade patient trust, and ultimately endanger patient safety ... HHS takes these threats very seriously, and we are taking steps that will ensure our hospitals, patients, and communities impacted by cyberattacks are better prepared and more secure" – Andrea Palm, Deputy Secretary, Department of Health and Human ServicesQuote "Ten to 15 years ago, the Federal government’s cybersecurity posture was largely reactive. We’ve gone from blindly trusting networks that have hardened outer defenses – and that may be connected to other similarly architected networks and environments – to a much more fluid, borderless way of interconnecting our enterprise information technology" –Sean Connelly, Senior Cybersecurity Architect, Cybersecurity and Infrastructure Security Agency (CISA)Stat One out of three Federal IT decision-makers say their agency is not advancing its identity security practices fast enough to address zero trust and cloud initiativesStat 87% of Federal IT decision makers believe modern identity at scale has moved beyond human capacityQuote “As we focus on the emergence of these new technologies [like AI, blockchain, or quantum computing] … we’re going to have to increase [identity] services to be able to continue to really protect and validate the authentic from the artificial” – anonymous Federal agency cybersecurity lead Stat The FBI found that adults ages 60 and older lost nearly $1.1 billion to scams involving cryptocurrency in 2022, a reported increase of nearly 350 percent from 2021Quote “As artificial intelligence technology becomes more prevalent, it presents opportunities to protect consumers but it can also pose privacy and safety challenges" – The Federal Communications Commission (FCC)Stat The global cybersecurity workforce gap has grown by 13% since 2022, indicating the need to fill an additional four million cybersecurity jobsStat 84% of U.S. executives plan to prioritize generative AI cybersecurity solutions over conventional cybersecurity solutionsQuote "Over the past seven years, the cybersecurity landscape has changed dramatically, and our doctrine around cyber incident response and coordination must evolve as well” – Eric Goldstein, Executive Assistant Director, Cybersecurity and Infrastructure Security Agency (CISA)Stat Nearly 96% of global CISOs claim they fell victim to a ransomware attack within the past year, and 83% paid the ransom demand. Of those who paid, over 50% paid more than $100,000, and 9% paid $1 million or moreStat 70% of global security leaders say AI benefits attackers more than defenders. The most anticipated use cases are faster and more efficient attacks (36%), voice and image impersonations for social engineering (36%), and an expanded supply chain attack surface (31%)Stat Federal cybersecurity leaders would most like to see their agency build its capabilities in: Developing and implementing advanced threat detection and incident response (65%), implementing proactive security measures for cloud-based infrastructure and services (65%), and enhancing the recruitment and retention of highly skilled cybersecurity professionals (61%)Stat One in three Federal cybersecurity leaders say their agency is not advancing its identity security practices fast enough to address zero trust and cloud initiatives Quote "We’ve got to bring risk down to a manageable level … Nobody is saying that we’re going to one day not have to talk about security. It’s just that we’ve got to get to a point where we can manage these risks and understand them and be able to prioritize effort” – Chris DeRusha, Federal Chief Information and Security Officer (CISO)Stat While just 16% of Federal cybersecurity leaders have implemented attribute-based access control (ABAC) today, another 49% are piloting a proof of concept or working on implementationQuote “Cybersecurity professionals have a long history of using tools and techniques supported by AI to prevent, and respond to, malicious cyber activity. Protecting our nation’s cyber infrastructure requires leveraging all tools at our disposal, including applying AI techniques to improve cybersecurity defenses in organizations of all sizes and technical capacity” – Sens. John Hickenlooper, D-Colo., and Thom Tillis, R-N.C.Quote “We know that foreign adversaries plan and are currently collecting encrypted data from public and private entities with plans to decrypt it later when they have access to a sufficiently developed quantum computer” – Dylan Presman, Director for Budget and Assessment, White House’s Office of the National Cyber Director (ONCD)Quote "When we look at the latest ransomware trends and how people are attacking us, phishing used to reign supreme, but it’s interesting those latest numbers have shifted ... Now, vulnerabilities are the number one attack vector for ransomware, and then the second most common is credential abuse” – Steven Hernandez, Chief Information Security Officer (CISO), U.S. Department of EducationStat 80% of breaches of government agencies and private entities used “compromised identities” to infiltrate and bypass securityQuote “Identity is becoming the quintessential security technology in many ways, if it isn’t already there, and we think that embracing that and modernizing our approach is really an important priority” – Grant Dasher, the Architecture Branch Chief for the Office of the Technical Director for Cybersecurity at CISAQuote “We need to ensure that our cybersecurity workforce looks like America. America’s diversity is indeed our superpower. There’s no other country like ours. And we’ve just begun to tap into the capabilities of our full population” – Kemba Walden, acting National Cyber DirectorQuote “We must support the development of a strong cyber workforce ... That cyber workforce has to meet the demand that we have all heard about in filling hundreds of thousands of cyber jobs vacancies – that’s a national security imperative, an economic imperative, a human security imperative. But it also is an opportunity for good paying jobs – good paying, middle-class jobs” – Camille Stewart Gloster, Deputy National Cyber Director for Technology and Ecosystem SecurityStat 60% of DoD IT decision-makers say that when an operational issue arises, their organization struggles to determine if the root cause is a cyberattack or an equipment maintenance issue Stat 44% of cybersecurity professionals say they’ve seen an increase in exploits targeting their business VPNs over the previous year Trend Although the volume of ransomware attacks decreased by 23% in 2022, they still accounted for 20% of all cybercrimes in the U.S. in 2022Stat Federal agencies reported 30,659 cyber incidents in FY22Trend Phishing attacks around the world rose nearly 50% in 2022 compared to 2021Stat 100% of public sector and 96% of private sector leaders report benefiting from shared cybersecurity intelligence, including educating staff on a threat (50%), proactively responding to a threat (47%), and fine-tuning overall cybersecurity posture (45%)Stat Top roadblocks to effective cybersecurity collaboration: Lack of training for end users (39%), Lack of trust in intelligence from outside sources (36%), Lack of training within the IT department (36%), Lack of specific information-sharing requirements (35%) Stat While 93% of cyber decision-makers say public-private partnerships are vital to national defense, just one in three (34%) believe they are very effectiveStat 69% of IT decision-makers say there is still some reticence in their organization around cybersecurity information sharing, and just 41% feel confident they have a direct line to a government agent/agency when neededQuote "The proliferation of commercial spyware poses distinct and growing counterintelligence and security risks to the United States, including to the safety and security of U.S. Government personnel and their families” – Fact Sheet: Executive Order on Prohibition on Use by the United States Government of Commercial Spyware that Poses Risks to National SecurityQuote “The Federal government is responsible for storing considerable amounts of sensitive and personal information – including credit card and social security numbers. We must ensure this data is stored securely and used in a way that does not violate civil rights and liberties” – Sen. Gary Peters, D-MichQuote “Malicious cyber actors attempt to hide their activity by exploiting legitimate credentials, either of authorized personnel or of the systems that act on behalf of legitimate users ... Rigorous identity and access management allows an organization the ability to detect and thwart these actors’ persistent efforts to corrupt critical systems and access information of national importance” – Alan Laing, NSA lead for the IAM working groupStat In 2022, there were over 714,000 open cybersecurity job roles in the United States – about 39,000 of those roles were in the public sector
  1. 1
  2. 2