New Report Shows Significant Improvement in Cybersecurity Metrics Since 2021

According to a new report by cybersecurity firm Rapid7, the cybersecurity posture of UK organisations has improved significantly since 2021.

The report focuses on the attack surface of the United Kingdom as represented by the FTSE 350, the 350 largest publicly traded companies listed on the London Stock Exchange. Compared to Rapid7's 2021 Industry Cyber Exposure Report, nearly every metric has improved. 

The report also found that the adoption of email security protocols such as DMARC and DNSSEC has greatly improved since 2021 and is on par with global adoption rates. The attack surface of the FTSE 350 is greatly improved compared to 2021, especially in materials, utilities, and healthcare.

Improvement in cybersecurity metrics is critical in today's world, as cyber attacks continue to increase in frequency and sophistication. There are several metrics that organizations can use to measure their cybersecurity posture and determine areas for improvement. Some key cybersecurity metrics include:

• Time to detect (TTD) and time to respond (TTR): These metrics measure how long it takes for an organization to detect a cyber attack and respond to it. A shorter TTD and TTR is generally better, as it means that an organization is able to quickly identify and mitigate a cyber attack, reducing the potential damage.

• Number of incidents: The number of security incidents is an important metric to track over time. By monitoring the number of incidents, organizations can identify trends and patterns in cyber attacks and take steps to improve their defenses.

• Compliance with regulations: Compliance with regulations such as GDPR, HIPAA, and PCI DSS can be an important metric for organizations that handle sensitive data. Demonstrating compliance with these regulations can help organizations build trust with customers and partners.

• Employee awareness and training: The level of employee awareness and training around cybersecurity is a critical metric to track. Regular training and awareness campaigns can help employees identify potential threats and avoid common pitfalls, reducing the risk of a successful cyber attack.

• Vulnerability management: Organizations can measure the number of vulnerabilities in their systems and track the progress of remediation efforts over time. By reducing the number of vulnerabilities, organizations can reduce their attack surface and make it more difficult for attackers to find and exploit weaknesses.

Improving these metrics requires a comprehensive approach to cybersecurity that includes both technical and non-technical measures. This may include implementing robust security solutions, developing and implementing policies and procedures, providing ongoing training and awareness campaigns for employees, and regularly testing and assessing the effectiveness of security measures.

"This is a positive trend that we are seeing across the UK," said Erick Galinkin, Principal Researcher at Rapid7. "As organisations become more aware of the importance of cybersecurity, they are taking steps to improve their overall security posture. This is an encouraging sign for the industry as a whole."

The report also highlights the importance of continuous monitoring and testing of cybersecurity controls, as well as ongoing staff training and awareness programs, in maintaining a strong cybersecurity posture.

"The improvement in cybersecurity metrics is a clear indication that organisations are taking cybersecurity seriously and making progress in their efforts to protect their networks and data," said Galinkin. "However, there is still more work to be done, and it is important that companies continue to invest in cybersecurity for ongoing risk management and threat mitigation."