February 16, 2017

Accenture Security Index: A Majority of Global Organizations Struggle to Identify and Fully Protect Mission Critical Assets from Cyberattacks

Index shows poor performance in critical cybersecurity capabilities across 15 countries and 12 industries

NEW YORK; Feb. 16, 2017 – With the frequency and scope of serious cyberattacks on the rise, nearly three quarters of organizations (73 percent) globally cannot identify and fully protect their corporate high-value assets and processes, finds a new analysis from Accenture (NYSE: ACN). According to the newly released Accenture Security Index, only one in three organizations (34 percent) have the ability needed to monitor for threats to critical parts of their business.

“A turning point has been reached for cybersecurity. While organizations have improved their security over the last few years, progress has not kept pace with the sophistication of highly motivated attackers, said Kelly Bissell, managing director of Accenture Security. “A new approach is clearly needed. One that protects the organization from the inside out and across the entire industry value chain—from the wellhead to the oil pump. And the start of this must be a new, more comprehensive definition of what constitutes cybersecurity success based on impact to the business.”

Majority of global orgs struggle to identify & protect critical assets from cyberattacks. Read more.

To gauge the effectiveness of current enterprise security efforts and the adequacy of their existing investments, Accenture surveyed 2,000 top enterprise security practitioners representing companies with annual revenues of $1 billion or more. The results of this survey were analyzed in collaboration with Oxford Economics to develop the Accenture Security Index, which aggregates scores across 15 countries and 12 industries, providing the ability to compare the relative strength of all organizations to protect themselves from cyberattacks. The index is based on a comprehensive model measuring 33 specific cybersecurity capabilities. It provides a new benchmark to determine what high performance security looks like and what it takes for organizations to establish cybersecurity success.\

Country-Level Performance Weak Across Important Capabilities

• Globally, the average organization has high performance in 11 of the 33 cybersecurity capabilities analyzed. At the top end of the scale, only 9 percent of organizations managed to achieve high performance in more than 25 of the 33 cybersecurity capabilities.
• In the UK, which tops the country roster along with France for cybersecurity performance, the average organization achieved high performance in 44 percent – or 15 out of 33 – capabilities.
• The UK ranks highest overall for cooperation with third-parties during crisis management (52 percent) and communication of cyber incidents as part of business alignment (55 percent).
• In comparison, Spain ranks at the bottom of the performance list with companies claiming high performance in only 22 percent – or seven of 33 cybersecurity capabilities.
• The US is fifth on the list, with the typical company having high performance in 12 of the 33 capabilities. In line with its overall ranking, the US has average performance across the remaining cybersecurity capabilities with the exception of governance and leadership where it ranks second overall in creating a security-minded culture (53 percent) and cooperation with third-parties during crisis management (42 percent).

A Surprising Degree of Variation in Industry-Level Performance

• Communication companies have the highest performance in 11 capabilities including the protection and recovery of key assets (49 percent) and monitoring for business-relevant threats (47 percent).
• Banking organizations have highest performance in eight capabilities including “what-if” threat analysis (47 percent) and third-party cybersecurity in their extended business ecosystem (44 percen t).
• High technology companies rank highest in seven capabilities including the ability to create a security-minded culture (54 percent) and recovering from cyber incidents (48 percent).
• Life Sciences organizations are bringing up the rear with an overall ranking of only 19 percent, meaning organizations exhibited high performance in only six capabilities on average.
• Life Sciences also rank lowest in all but one of the 33 cybersecurity capabilities including the ability to ensure stakeholder involvement (12 percent) and design for the protection of key assets (13 percent).

To learn more about what good security looks like and how to achieve it, visit: www.accenture.com/securityindex.

About Accenture
Accenture is a leading global professional services company, providing a broad range of services and solutions in strategy, consulting, digital, technology and operations. Combining unmatched experience and specialized skills across more than 40 industries and all business functions – underpinned by the world’s largest delivery network – Accenture works at the intersection of business and technology to help clients improve their performance and create sustainable value for their stakeholders. With more than 394,000 people serving clients in more than 120 countries, Accenture drives innovation to improve the way the world works and lives. Visit us at www.accenture.com.

Accenture Security helps organizations build resilience from the inside out, so they can confidently focus on innovation and growth. Leveraging its global network of cybersecurity labs, deep industry understanding across client value chains and services that span the security lifecycle, Accenture protects organization’s valuable assets, end-to-end. With services that include strategy and risk management, cyber defense, digital identity, application security and managed security, Accenture enables businesses around the world to defend against known sophisticated threats, and the unknown. Follow us @AccentureSecure on Twitter or visit us at www.accenture.com/security.

# # #

Contact:

Alison Geib
Accenture
+ 1 703-947-4404
alison.geib@accenture.com