Organisations work in the cloud, but not safe enough

The Digital Trust Insights 2024 reveals that organisations are deeply concerned about their cybersecurity. Respondents indicate that the consequences of a cyber attack can be severe, especially because it undermines the trust of customers. In the Netherlands, 54 percent of respondents say they are afraid of damage to their company's reputation and brand. The ‘repair costs’ as a result of cybercrime are also high. Approximately a quarter of respondents who have experienced a data breach in the past three years indicate that it has cost them between one and nine million dollars. The vast majority of survey participants say they will increase their cyber budgets for 2024. The additional resources will primarily be spent on improving existing cyber infrastructure and capabilities.

The respondents of the Digital Trust Insights 2024 are most concerned about cloud-related attacks. Everywhere in the world, including in the Netherlands, they rank this as their top concern. However, what stands out is that only a small portion has a state-of-the-art plan in place to manage the risks: about one-third of the surveyed organisations have a risk plan in place that is regularly updated. In this regard, the Dutch respondents do not differ much from their counterparts abroad.

‘Almost all organisations, nationally or internationally, work in the cloud’, says PwC Netherlands’ cyber expert Angeli Hoekstra. ‘That’s logical because it has great advantages. It makes organisations much more agile, whether it's about the way of working or scaling up the required infrastructure. However, organisations often fail to realise that working in the cloud still means that they are responsible for a large part of the security, even if they have a contract with a service provider. For example, if they host databases in the cloud, they themselves must ensure adequate Identity and Access Management, so that no one has access to that data except for the employees for whom access is relevant.

They also need to take care of encryption themselves if necessary. The responsibility of the service provider is to ensure the availability, reliability and security of the cloud infrastructure. Organisations need to be much more aware of this. Implementing a Zero Trust Security model,  can help achieve a higher level of security. Many organisations are undergoing transformations to remain future-proof, and the cloud is almost always a part of that. When talking about transformations, one must also simultaneously address cybersecurity.’

Almost half of the Dutch respondents plan to use Artificial intelligence (AI) tools in the coming months to defend against cyber attacks. However, the answers from the respondents of the Digital Trust Insights 2024 also indicate that they see AI as a weapon that can be used against them. Dutch respondents seem to be somewhat more moderate than their European counterparts when it comes to both the opportunities and threats of AI.

Hoekstra: ‘Within security we are utilising AI already for some time, but with generative AI the opportunity and threat of it is a real game changer, with for example more advanced phishing attacks, but also increased cyber defence capabilities. In The Netherlands we are a bit more conservative about both the downside as well as the upside of generative AI. I personally like to motivate the people in cyber security in The Netherlands to experiment in a responsible and secure manner with generative AI, for cyber security as otherwise The Netherlands might be at risk with defending against advanced generative AI cyber attacks.’