Amid a tsunami of cyberattacks around the world, the private sector has dramatically ramped up spending on cybersecurity. According to one recent study, firms with more than 1,000 employees spent an average of over $13 million on cyberdefense in the year ending April 2021, up more than 200 percent from just two years prior. And the spending is clearly warranted: last summer, the attack on Colonial Pipeline caused lines at the pump reminiscent of the OPEC oil embargo. A cyberattack on Dr. Reddy’s, a COVID-19 vaccine manufacturer, forced it to shut down critical plants in five countries. And one cybercriminal was recently able to steal $600 million in cryptocurrency held on the Poly Network exchange.
Yet until now, the rapid growth in cybersecurity spending has done very little to avert the threat. Even as companies build out their cyberdefenses, Anne Neuberger, the deputy U.S. national security adviser for cyber and emerging technology, has noted that the “number and size” of ransomware incidents have “increased significantly.” And the FBI’s Internet Crime Report has found that the vast majority of cyberattacks are caused by basic errors, including phishing and slow patching of known vulnerabilities, allowing attackers to employ low-cost methods to penetrate expensive cyberdefense systems.
