Opinion: UK attack rates rise despite record security spend as MDR models stop at containment
An opinion piece by Oliver Spence, CEO of CybaVerse, argues that UK organisations continue to suffer operationally damaging attacks despite rising security investment because managed security models focus on containment rather than remediation. Citing a Hiscox report, it notes 38% of UK organisations suffered a cyber attack in the last year, with the average UK firm spending £44,294 on resilience measures. Government analysis puts the UK cyber services market, including MSSPs, at roughly £8.4 billion annually. The author contends that MDR/SOC providers typically triage alerts, isolate devices and restore environments, but leave root causes such as unpatched vulnerabilities, misconfigurations and weak Microsoft 365 controls intact. The recommendation is to select providers that close the loop by remediating root causes and to measure tangible reduction in exploitable gaps over time.
Remediação
- Distinguish containment (stopping the immediate threat) from remediation (fixing the underlying weakness).
- Require MDR partners to deliver evidence of closed attack paths, patched vulnerabilities and corrected misconfigurations.
- Periodically assess whether the environment is measurably more secure than at the start of the provider relationship.
Linha do tempo
-
Opinion: UK attack rates rise despite record security spend as MDR models stop at containment
ler a análise desta fonte ocultar
An opinion piece by Oliver Spence, CEO of CybaVerse, argues that UK organisations continue to suffer operationally damaging attacks despite rising security investment because managed security models focus on containment rather than remediation. Citing a Hiscox report, it notes 38% of UK organisations suffered a cyber attack in the last year, with the average UK firm spending £44,294 on resilience measures. Government analysis puts the UK cyber services market, including MSSPs, at roughly £8.4 billion annually. The author contends that MDR/SOC providers typically triage alerts, isolate devices and restore environments, but leave root causes such as unpatched vulnerabilities, misconfigurations and weak Microsoft 365 controls intact. The recommendation is to select providers that close the loop by remediating root causes and to measure tangible reduction in exploitable gaps over time.
Remediation
- Distinguish containment (stopping the immediate threat) from remediation (fixing the underlying weakness).
- Require MDR partners to deliver evidence of closed attack paths, patched vulnerabilities and corrected misconfigurations.
- Periodically assess whether the environment is measurably more secure than at the start of the provider relationship.