Vulcan Cyber announced the latest results of its ongoing research into cyber risk remediation initiatives and risk impact on business operations. In a survey of enterprise IT security executives, 76% of respondents indicated that a security vulnerability had impacted their business in the last year. These findings underscore the pervasive impact security vulnerabilities continue to have on business, as well as the ineffectiveness of traditional approaches to vulnerability management.

Conducted by Pulse, the latest Vulcan Cyber vulnerability remediation survey examines the effectiveness of risk and vulnerability management programs in enterprises today and their impact on cyber hygiene. According to the results, a majority of respondents, 52%, report their organization places only a moderate level of importance on risk-based vulnerability management, compared to 33% who consider risk-based vulnerability management very important.

“There is a clear and widening gap between enterprise vulnerability management programs and the ability of IT security teams to actually mitigate risk facing their organizations,” said Yaniv Bar-Dayan, CEO and co-founder, Vulcan Cyber. “As security vulnerabilities proliferate across digital surfaces, it’s increasingly critical that all enterprise IT security stakeholders make meaningful changes to their cyber hygiene efforts. This should include prioritizing risk-based cybersecurity efforts, increasing collaboration between security and IT teams, updating vulnerability management tooling, and enhancing enterprise risk analytics, particularly in businesses with advanced cloud application programs.”

Other key findings from the Vulcan Cyber survey include:

• The majority of respondents reported average vulnerability dwell times of more than one day (46%) with a significant number of respondents (31%) reporting dwell times of more than a week.
• Among the vulnerability scanners used by IT security teams for infrastructure scanning, Qualys is the most popular, followed by Crowdstrike and AWS Inspector, then Tenable.sc, Tenable.io, Palo Alto Networks Prisma Cloud, Rapid7 InsightVM, Rapid7 Nexpose, Orca, and Aqua Security, in descending order.
• Palo Alto Networks Prisma Cloud is the most popular vulnerability scanner used for applications, followed by Tenable WAS, Rapid7 InsightAppSec, Qualys WAS, Snyk, WhiteHat, Veracode, Micro Focus Fortify, HCL AppScan, WhiteSource, Burp Suite, and Checkmarx, in descending order.
• Overall, 76% of respondents use the same prioritization (risk analytics) model for both infrastructure and application security.
• The majority of respondents (30%) evaluate cyber risk using external, technically oriented models such as ATT&CK in contrast to external, business-oriented models like FAIR (20%). 27% of respondents use a bespoke, home-grown scoring model.

For the complete results of the Vulcan Cyber cyber risk management survey, download the whitepaper, “How Do Businesses Mitigate Cyber Risk?”