Technology industry

For tech companies of any size, cybersecurity threats are part of doing business. The typical company’s network will often experience thousands of attempted cyberattacks per day, and as vendor relationships proliferate, the average attack surface only continues to grow. But are your defenses prepared to handle this onslaught and prevent a data breach? Keep reading to find out. How are data breach risks evolving for tech companies? Tech companies have always been heavily targeted by cyber attackers. But AI has made it easier than ever for even inexperienced cybercriminals to attempt an attack, while flawed AI-written code has also created new holes to be exploited. Tech companies are also sharing more data than ever with their vendors, which means you can suffer the consequences of a data breach even if your own systems remain secure. Key evolving data breach and cybersecurity risks include: AI-powered attacks: Data privacy breaches and identity threat-based attacks are way up because of AI. For example, AI tools make it easier to pull off a phishing scam with polymorphic emails so attackers can steal credentials needed to access your systems, at which point they can steal valuable data or attempt a ransomware attack. AI makes it simple enough that even children are trying their hand at hacking. Poorly written AI code: Tech companies are increasingly turning to AI coding tools like Claude Code to quickly write new code. However, this code is often implemented without human due diligence or testing, raising the risk that security holes will go undetected until exploited during an attack. Vendor proliferation:  Companies that use multiple SaaS products or AI tools face additional exposure. If one of your vendors gets successfully breached, all the data you shared with that vendor is at risk of compromise, so each additional vendor you use raises your risk level. To make this even more complicated, consider that your vendors could have shared your data with third-party vendors of their own. Practice attacks on smaller companies:  If your business is under a certain size, you might think you’re not worth attacking. But cybercriminals increasingly see small and mid-sized businesses as practice: A way to try out new attack methods and hone their skills before moving on to target a big fish. Complex cybercriminal relationships:  Just as you have vendor relationships, many bad actors do as well. For example, a hacker may attack your business simply as a demonstration to impress a potential client or carry out a successful breach of your systems not to steal any of your data themselves, but so they can sell that access to another party. What kind of damage could a major data breach do to your business? A major data breach can cause financial, reputational and operational harm to your business. Expect both direct damages like operational downtime or the cost to resecure your systems, as well as second-order effects such as lost opportunities or regulatory action. The most damaging cyberattacks involve gaining insider access to your core systems. Attackers sometimes collaborate with a willing insider, like an employee looking to make some extra cash, but will more often get in by tricking a team member into sharing their access credentials through phishing or other social engineering scams. Once inside, attackers often take their time to look around. By some estimates, the typical cybercriminal may remain in your systems for an average of 220 days after first breaking in. That’s a lot of time to find valuables to steal. Insider attacks often cost the company 10-15% more (on the low end) than an external bad actor. Plus, the length of time that an investigation takes usually increases because insiders can cover their tracks more effectively. Expect significant financial losses after a data breach A successful data breach or other cybersecurity incident can quickly become a major drag on your balance sheet. Expect damages like: Sensitive internal and customer data stolen and sold on the black market Ransom payments starting at $60,000 Operational downtime Higher cybersecurity insurance premiums, think 2-3 times what you’re paying now Regulatory blowback, which can include fines, starting at $500,000 Reputational damage, with customers moving to your competition The cost of re-securing your systems after an attack, which could undo five years or more of network investment Ransomware attacks carry especially high financial and operational costs Hackers may simply attempt to steal your data and then vanish. However, once inside your systems, some may launch a ransomware attack instead. During a ransomware attack, an attacker will lock down your core systems or critical data, paralyzing your operations while pressuring you to make a ransom payment. In addition to the financial damages described in the previous section, a ransomware attack can trigger ransom costs that average: $60,000 for small businesses $500,000 for midsize companies $1.5 million for larger firms If these amounts sound lower than you might expect, consider that if the ransoms were too big, nobody would pay. But if they’re tolerable from a cash flow perspective, firms are likely to pay and try to recover later from insurance. A risk-based cybersecurity strategy helps businesses adapt to today’s threats Many tech companies think about cybersecurity strictly in terms of compliance. If you’re a fintech company, for example, you might be tempted to assess your specific regulatory requirements, implement frameworks like PCI and HITRUST to satisfy regulators and then move on. That would be a mistake. Treating cybersecurity as just a compliance exercise still leaves you exposed to potential harm, especially because compliance standards typically don’t account for newer or evolving threats. However, adopting a risk-based cybersecurity strategy can help significantly reduce your potential pain. Under a risk-based approach, you’d go beyond simple compliance to map out the specific threats you face and prioritize them based on likelihood and degree of harm. This can allow you to implement additional defenses to reduce your potential repercussions should you suffer an attack. How tech company CIOs should implement a cybersecurity risk management strategy Tech CIOs or CISOs often benefit from guiding their businesses to adopt a cybersecurity posture built on defense-in-depth. This is a risk-based strategy that deploys multiple layers of protective measures so your systems won’t be compromised by a single point of failure. Using a defense-in-depth approach, an attacker can often be stopped even if they’ve already broken through one or more of your defensive layers. Defense-in-depth also factors in the likelihood of a particular attack, prioritizing defenses based on risk rather than attempting the impossible task of being strong everywhere at all times. Here are key action steps to implement a risk-based cybersecurity approach that incorporates defense-in-depth: 1. Work with a cybersecurity advisor Unless you have a large internal cybersecurity team (10+ people), you’ll typically benefit from working with a third-party cybersecurity advisor who does this every day. An advisor can help you implement a risk-based approach and apply concepts like defense-in-depth to your specific business. 2. Understand your points of failure Map out your points of failure, like breached firewalls, team members clicking on a phishing link or third-party vendors. This will help you figure out where to add additional controls, policies and team training exercises. Your people are probably your weakest link, so you’ll need to account for that as you move forward. 3. Don’t add unnecessary tech Don’t add new tech to your business just because it’s new. Every additional vendor you work with expands your attack surface, so as you integrate more AI and other advances into your existing systems and processes, do so deliberately and with a careful eye on cybersecurity. 4. Limit network access for everyone Higher-than-necessary credentials represent a distinct security threat. Make sure that your team only has the minimum level of network access they need to do their jobs, including your C-suite, who are the most vulnerable to phishing or spear-phishing attacks. 5. Use AI network monitoring to speed up breach detection AI tools can help you implement more effective network monitoring, so you can detect an unusual login or other signs of a breach more quickly. This can help you avoid long-term exposure even if your systems are successfully compromised. 6. Do careful vendor due diligence Talk to your third-party vendors about their own cybersecurity efforts, including whether they take a risk-based or compliance-based approach. To fully understand your vendor risks, you’ll also want to ask about whether any of their own third-party vendors could have access to your data. 7. Implement governance policies and trainings Your whole team needs to be responsible for cybersecurity. Establish clear governance policies, including  for how you use AI , to prevent team members from exposing your data to unauthorized tools. Offer regular training on threats like phishing scams and hold tabletop exercises to practice how your business would respond to an active cyberattack. 8. Set up MFA All of your core systems should use multifactor authentication (MFA) to add an additional layer of protection against unauthorized access. Ideally, this should be done with an authenticator app rather than through a code sent via email or text message, as the latter is easier to compromise. 9. Back up your data To mitigate a worst-case scenario like a ransomware attack (or a strike by  a nation-state actor hell-bent on causing chaos ), regularly back up your data. This will prevent a total loss in the event that an attacker decides to wipe your systems and allow you to resume normal operations more quickly in the aftermath of an attack. Think of cybersecurity as a journey, not a single event Finally, you’ll do a better job protecting your data and your business if you think of cybersecurity as an ongoing process. You don’t have to implement a bunch of new defensive layers all at once. In fact, small but consistent monthly actions to improve your security will often deliver more impact than one big splashy annual upgrade. Bear that in mind as you move forward. Read more The right cybersecurity framework boosts a business’s value Nation-state actors represent a growing cybersecurity threat AI governance framework: Start with intent