Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, disclosed today that financial services firms are more confident in their ransomware protection than any other industry. At the same time, they are vulnerable due to supply chain risk and inadequate detection capabilities.
As part of a larger cross-industry report on ransomware, Trend Micro commissioned Sapio Research to poll over 355 financial services IT and business leaders worldwide.
It discovered that 75% of respondents believe they are adequately protected from ransomware, which is significantly higher than the overall average of 63%.
This confidence is justified in part: 99% say they patch servers on a regular basis, 92% secure remote desktop protocol (RDP) endpoints, and 94% have rules in place to mitigate risks from email attachments.
However, 72% of respondents admitted that their organization had previously been compromised by ransomware, and 79% believe that their industry is a more appealing target for threat actors than others. The current level of threat awareness in the financial services sector does not always translate into action.
Two-fifths do not use network detection and response (40%) or endpoint detection and response (39%), and half (49%) do not use extended detection and response (XDR). This could explain the low detection rates for ransomware activity. Only one-third (33%) can accurately detect lateral movement, while 44% can detect initial access.
Trend Micro also uncovered significant third-party cyber risk for financial services organizations:
- 56% have had suppliers compromised by ransomware, mostly partners (56%) and subsidiaries (29%)
- 54% believe their suppliers make them a more attractive target
- 52% say a significant number of their suppliers are SMBs, who may have fewer resources to spend on security
"Greater collaboration and information sharing with third parties could help to improve the security posture of the overall supply chain," said Bharat Mistry, Technical Director at Trend Micro. "However, without adequate detection and response capabilities, they may not have the intelligence to hand in the first place. Financial services leaders recognize they're a top target for ransomware actors. It's time to turn that awareness into action."
In accordance with the research, a quarter (24%) of financial services firms do not share threat information with their partners, 38% do not share with suppliers, and even more (42%) do not engage with the broader ecosystem.
