Connect with us

BizNews

Security response planning on the rise, but containing attacks remains an issue – IBM

While organizations surveyed have slowly improved in their ability to plan for, detect and respond to cyberattacks over the past five years, their ability to contain an attack has declined by 13% during this same period.

Published

on

IBM announced the results of a global report examining businesses’ effectiveness in preparing for and responding to cyberattacks. While organizations surveyed have slowly improved in their ability to plan for, detect and respond to cyberattacks over the past five years, their ability to contain an attack has declined by 13% during this same period.

The global survey conducted by Ponemon Institute and sponsored by IBM Security found that respondents’ security response efforts were hindered by the use of too many security tools, as well as a lack of specific playbooks for common attack types.

While security response planning is slowly improving, the vast majority of organizations surveyed (74%) are still reporting that their plans are either ad-hoc, applied inconsistently, or that they have no plans at all. This lack of planning can impact the cost of security incidents, as companies that have incident response teams and extensively test their incident response plans spend an average of $1.2 million less on data breaches than those who have both of these cost-saving factors in place.

The key findings of those surveyed from the fifth annual Cyber Resilient Organization Report include:

  • Slowly Improving: More surveyed organizations have adopted formal, enterprise-wide security response plans over the past 5 years of the study; growing from 18% of respondents in 2015, to 26% in this year’s report (a 44% improvement).
  • Playbooks Needed: Even amongst those with a formal security response plan, only one third (representing 17% of total respondents) had also developed specific playbooks for common attack types — and plans for emerging attack methods like ransomware lagged even further behind.
  • Complexity Hinders Response: The amount of security tools that an organization was using had a negative impact across multiple categories of the threat lifecycle amongst those surveyed. Organizations using 50+ security tools ranked themselves 8% lower in their ability to detect, and 7% lower in their ability to respond to an attack, than those respondents with less tools.
  • Better Planning, Less Disruption: Companies with formal security response plans applied across the business were less likely to experience significant disruption as the result of a cyberattack. Over the past two years, only 39% of these companies experienced a disruptive security incident, compared to 62% of those with less formal or consistent plans.

“While more organizations are taking incident response planning seriously, preparing for cyberattacks isn’t a one and done activity,” said Wendi Whitmore, Vice President of IBM X-Force Threat Intelligence. “Organizations must also focus on testing, practicing and reassessing their response plans regularly. Leveraging interoperable technologies and automation can also help overcome complexity challenges and speed the time it takes to contain an incident.”

Updating Playbooks for Emerging Threats
The survey found that even amongst organizations with a formal cybersecurity incident response plan (CSIRP), only 33% had playbooks in place for specific types of attacks. Since different breeds of attack require unique response techniques, having pre-defined playbooks provides organizations with consistent and repeatable action plans for the most common attacks they are likely to face.   

Amongst the minority of responding organizations who do have attack-specific playbooks, the most common playbooks are for DDoS attacks (64%) and malware (57%). While these methods have historically been top issues for the enterprise, additional attack methods such as ransomware are on the rise. While ransomware attacks have spiked nearly 70% in recent years, only 45% of those in the survey using playbooks had designated plans for ransomware attacks.

Additionally, more than half (52%) of those with security response plans said they have never reviewed or have no set time period for reviewing or testing those plans. With business operations changing rapidly due to an increasingly remote workforce, and new attack techniques constantly being introduced, this data suggests that surveyed businesses may be relying on outdated response plans which don’t reflect the current threat and business landscape.

More Tools Led to Worse Response Capabilities
The report also found that complexity is negatively impacting incident response capabilities. Those surveyed estimated their organization was using more than 45 different security tools on average, and that each incident they responded to required coordination across around 19 tools on average. However, the study also found that an over-abundance of tools may actually hinder organizations ability to handle attacks. In the survey, those using more than 50 tools ranked themselves 8% lower in their ability to detect an attack (5.83/10 vs. 6.66/10), and around 7% lower when it comes to responding to an attack (5.95/10 vs. 6.72/10).

These findings suggest that adopting more tools didn’t necessarily improve security response efforts — in fact, it may have done the opposite. The use of open, interoperable platforms as well as automation technologies can help reduce the complexity of responding across disconnected tools. Amongst high-performing organizations in the report, 63% said the use of interoperable tools helped them improve their response to cyberattacks.

While security response planning is slowly improving, the vast majority of organizations surveyed (74%) are still reporting that their plans are either ad-hoc, applied inconsistently, or that they have no plans at all.

Better Planning Pays Off
This year’s report suggests that surveyed organizations who invested in formal planning were more successful in responding to incidents. Amongst respondents with a CSIRP applied consistently across the business, only 39% experienced an incident that resulted in a significant disruption to the organization within the past two years  compared to 62% of those who didn’t have a formal plan in place.

Looking at specific reasons that these organizations cited for their ability to respond to attacks, security workforce skills were found to be a top factor. 61% of those surveyed attributed hiring skilled employees as a top reason for becoming more resilient; amongst those who said their resiliency did not improve, 41% cited the lack of skilled employees as the top reason.

Technology was another differentiator that helped organizations in the report become more cyber resilient, especially when it comes to tools that helped them resolve complexity. Looking at organizations with higher levels of cyber resilience, the top two factors cited for improving their level of cyber resilience were visibility into applications and data (57% selecting) and automation tools (55% selecting). Overall, the data suggests that surveyed organizations that were more mature in their response preparedness relied more heavily on technology innovations to become more resilient.

BizNews

Want entrepreneurs to work harder? Tell them they’ll fail

Most entrepreneurs – people who start their own businesses – actually identify with the business they’re running. So being told that your business, your idea that you are committed to, will be a failure can almost seem like a personal attack.

Published

on

A new study finds entrepreneurs become more committed to their business ventures when they are told they will fail, increasing their efforts to make those businesses successful.

“Most entrepreneurs – people who start their own businesses – actually identify with the business they’re running,” says Tim Michaelis, corresponding author of a paper on the work and an assistant professor of psychology at North Carolina State University. “So being told that your business, your idea that you are committed to, will be a failure can almost seem like a personal attack.”

“We wanted to see if being told that their business will fail actually gets entrepreneurs to commit even more deeply,” Michaelis says. “We were somewhat surprised that researchers had not already examined this. Most of the literature in this area is from the field of developmental psychology and hadn’t explored potential business implications. Fundamentally, we wanted to know if having an underdog mentality can motivate entrepreneurs.”

To explore the subject, the researchers conducted three studies.

For the first study, the researchers recruited 423 entrepreneurs; of those, 213 were in a control group that was not asked about a time they had been told they would fail. One hundred and seven participants were asked about, but could not recall, a time they were told they would fail. The remaining 103 participants did recall a time they were told they would fail. The researchers then asked all study participants questions designed to capture how committed they were to persisting with their new businesses.

“We found that entrepreneurs who could recall being told their business would fail displayed a deeper commitment to persisting with their business ventures,” Michaelis says.

For the second study, the researchers worked with 579 entrepreneurs. In this study, the control group consisted of 289 participants; 234 participants couldn’t remember being told they would fail; and 56 could recall a time they were told they would fail.

This time the researchers essentially replicated the first study, but rather than asking questions designed to measure persistence, they asked questions designed to measure the extent to which study participants were motivated to prove someone wrong. The 56 participants who could recall being told they would fail were asked about their motivation to prove that specific naysayer wrong – the so-called “underdog effect.” The remaining study participants were simply asked about their motivation to prove something to general stakeholders.

“The results here were consistent with the first study – recalling a time when someone told them they would fail led to increased motivation to persist with their business venture,” says Michaelis.

For study three, the researchers recruited 417 entrepreneurs. The study participants were surveyed once per month for three months. The first month’s survey served to establish a baseline, measuring the extent to which each study participant was motivated to persist with their venture by the underdog effect – a desire to prove any doubters wrong.

The second and third surveys varied slightly, but were essentially designed to assess the extent to which motivation and persistence were driven by the underdog effect. The surveys also accounted for other variables associated with motivation and persistence, such as confidence, past experience, financial benefit and passion for the work.

“The third study reinforced what we found in studies one and two – the underdog effect is a powerful motivator that increases an entrepreneur’s motivation and persistence regarding their venture,” says Michaelis. “In other words, the underdog effect leads to people working harder, focusing on their venture, and really committing to the success of their business.”

But the studies also revealed something unexpected.

“There were a surprisingly large number of study participants who had never been told that they would fail – they had only ever received positive feedback, or possibly no feedback, about their business ideas,” says Michaelis. “And we found that those study participants were less committed to their business ideas and had lower levels of persistence.

“This work offers real insight into what motivates entrepreneurs, and it raises some interesting questions,” says Michaelis.

“How do you give entrepreneurs enough support to encourage their initiative, but enough resistance to help them develop the drive they need to succeed? How can we train entrepreneurs to distinguish between doubts that can serve as motivational fuel and constructive criticism that highlights real flaws in a business plan? These are issues we can explore moving forward.”

The paper, “I’ll prove you wrong! The underdog effect as an antecedent to entrepreneurial action and venture persistence,” is published in the Journal of Business Venturing. The paper was co-authored by Jeffrey Pollack, the Lynn T. Clark II Distinguished Professor of Entrepreneurship in NC State’s Poole College of Management; Jon Carr, the Jenkins Distinguished Professor of Entrepreneurship in NC State’s Poole College of Management; April Spivack of the Hanken School of Economics in Finland; Nicholas Smith of Northern Illinois University; and Alexander McKelvie of Syracuse University.

Continue Reading

BizNews

Study shows scaling startups risk increasing gender gaps

Founders with HR‑related education counteract these challenges. In ventures led by founders with HR training, the odds of hiring a woman increase by more than 30 percent, and the odds of appointing a woman to a managerial role increase by 14 percent for the same level of scaling.  

Published

on

When startups scale quickly, founders often make hurried hiring decisions that unintentionally disadvantage women, according to new study from the Stockholm School of Economics in Sweden. The study shows how the pressures of rapid growth increase the likelihood that founders rely on mental shortcuts and make biased decisions. 

Drawing on large‑scale Swedish data, the study shows that scaling—when companies hire far more people than their usual growth trend would predict—puts pressure on founders to decide swiftly, which increases the use of mental shortcuts. These shortcuts can activate gender stereotypes, shaping who gets hired and who moves into managerial roles.  

“During those moments of rapid growth, even well‑intentioned leaders can fall back on familiar stereotypes when assessing who they believe is best suited for the role,” says Mohamed Genedy, co-author and Postdoctoral Fellow at the House of Innovation, Stockholm School of Economics. 

Reduced odds of hiring female managers 

His research analyzes more than 31,000 new ventures founded in Sweden between 2004 and 2018. It finds that in male‑led startups, scaling reduces the odds of hiring a woman by about 18 percent, and the odds of appointing a woman to a managerial position by 22 percent.  

These patterns emerge even in a highly gender‑equal national context, making the findings especially noteworthy.  

Crucially, the study reveals that founders with HR‑related education counteract these challenges. In ventures led by founders with HR training, the odds of hiring a woman increase by more than 30 percent, and the odds of appointing a woman to a managerial role increase by 14 percent for the same level of scaling.  

“When founders have experience with structured hiring practices, the gender gaps shrink, and in some cases even reverse,” Genedy says.  

“This shows that getting the basics of HR right early on really pays off. When things start moving fast, founders with HR knowledge are less likely to rely on biased instincts and more likely to hire from a broader talent pool.”  

Prior experience in companies with established HR practices also helps, though less so. It raises the likelihood of hiring women as the new ventures scale, but does not significantly affect managerial appointments. 

Differences persist in female-led ventures 

The study additionally shows that these patterns are not driven by founder gender alone. Even solo female‑led ventures display similar tendencies when scaling, though to a somewhat lesser degree.  

And in female‑dominated industries, scaling increases the hiring of women for regular roles but still reduces the likelihood that women are appointed into managerial positions.  

“When scaling accelerates, cognitive bias kicks in for everyone,” says Mohamed Genedy. “Female founders are not immune to these patterns.”  

Together, these results point to underlying cognitive mechanisms that shape decisions under time pressure.

The study, Scaling with Bias? The role of founders’ HR knowledge and experience in hiring and managerial appointments, was published in Human Resource Management.

Continue Reading

BizNews

Retail therapy fail? Online shopping linked to stress, says study

Online shopping is more strongly linked to stress than reading the news, checking your inbox or watching adult entertainment. This is something online businesses should know and consider.

Published

on

Planning to save time by doing your shopping online? If so, it’s possible you’re not doing your well-being any favours. A study from Aalto University in Finland has found that online shopping is more strongly linked to stress than reading the news, checking your inbox or watching adult entertainment. The internet can be both a source and a reliever of stress though, according to research –– so do we scroll because we’re stressed, or are we stressed because we scroll?

It’s a complex problem to unravel, according to doctoral researcher Mohammed Belal.

‘Previous studies have shown that social media and online shopping are often used to relieve stress. However, our results show that a rise in social media use or online shopping is linked to an increase in self-reported stress across multiple user groups and across devices,’ he says.

The study found that users of YouTube and streaming services, as well as online gamers, also reported increased stress levels. For people experiencing high-stress, time spent on social media was twice more likely to be linked to stress as compared to time spent on gaming. Meanwhile, across many user groups, those who spent more time reading emails and news, or watching adult entertainment, reported lower stress-levels –– although the researchers note that they looked only at the time spent on news sites, not their content.

‘Somewhat surprisingly, people who spent a lot of time on news sites reported less stress than others. On the other hand, those who already experienced a lot of stress didn’t spend much time on news sites –– and that’s consistent with previous research that shows that stress can reduce news consumption,’ Belal says.

Overall, the study found a strong connection between internet use, in general, and heightened stress, especially among those who already experienced a lot of stress in daily life. Women reported more stress than men, and the older and wealthier the participant, the less stress they experienced. The de-stressing effect of adult entertainment may be explained by the fact that it was usually consumed in small doses, acting as a short-term stress or boredom reliever.

The study, to be published in the Journal of Medical Internet Research on 9 January 2026, recorded the internet usage of nearly 1,500 adults over a seven-month period. After that, data from nearly 47 million web visits and 14 million app usages was combined with users’ self-reported stress.

Issues commonly discussed, yet not well understood

The research comes at a time when the effects of social media on well-being are under increasing scrutiny. For example, a recent ban in Australia on social media for children has the rest of the world watching closely. Yet despite the increasing influence of the internet on our lives, our scientific understanding of the impacts of its use on well-being is remarkably limited, says Belal.

‘It leaves a huge critical gap in understanding how online behaviors impact stress and well-being,’ Belal points out.

With the aim of closing this gap, the study is among the first to use a tracking programme installed on users’ devices, rather than asking subjects to self-report their usage, explains assistant professor Juhi Kulshrestha. The long duration and large sample size of the research also make the findings particularly significant.

However, she points out that further research is needed to disentangle the relationship between stress and well-being and internet usage.

‘Are people more stressed because they are spending more time online shopping or on social media, or are such sites offering them an important support in times of duress? It’s really crucial that we study these issues further so we can solve that chicken and egg problem,’ says Kulshrestha. ‘Putting a blanket ban or upper limits on certain kinds of internet usage may not actually end up solving the issues, and could even take away a vital support for people who are struggling.’

Either way, the researchers see practical applications for the results in the development of well-being and online services. In future, they plan to examine the consumption of different types of news, such as political, entertainment, or sports news, and how it relates to stress and other well-being variables. The hope is that better data will lead to helping internet users maintain a healthy balance.

‘As we gain increasingly accurate information about people’s internet usage, it will be possible to design new kinds of tools that people can use to regulate their browsing and improve their well-being,’ says Kulshrestha.

Continue Reading
Advertisement
Advertisement

Like us on Facebook

Trending