CISOs, CIOs, and CTOs are under increasing pressure to adopt innovative approaches in securing their organizations from cyber risks, and protecting the confidentiality, integrity, and availability of the company’s information systems.
Security breaches are increasing in number, scale, and cost. Networks and their connected devices are especially vulnerable and under constant attack by cybercriminals. According to a 2024 CEO Global Digital Trust Insights Survey by PwC, the percentage of companies reporting costs of $1 million or more for their worst breach in the past three years rose to 36% from 27% last year. Less than a quarter of executives globally believe they have fully mitigated risks from cloud adoption, remote work, use of endpoints, such as computers, servers, and mobile devices, Internet of Things, and other digitization efforts.
Quantifying the Cost of Data Breaches
Cybercrime is expected to cost the world $9.5 trillion in 2024, according to research by Cybersecurity Ventures. Cyberattacks cause substantial harm to both a company and its customers. The financial consequences impact every corner of the business, including network downtime, service disruption, breach investigation, legal actions, reputation damage control, loss of productivity, and the effort spent to improve security measures.
Once threat actors gain unauthorized access to systems and networks, they often create widespread disruption. For example, what might start as a breach in a cloud system can escalate into an advanced persistent threat with attackers remaining inside your system, targeting endpoints, collecting data, and exploring other ways to do harm. They might extract your data, initiate a ransomware attack, and even leak the data, irrespective of whether the ransom is paid.
Each incident poses a significant problem independently. However, when considered collectively, they have the potential to severely impact business operations and damage brand reputation.
Regulatory fines: Sizable fines assessed for data breaches suggest that regulators are getting more serious about organizations that don’t properly protect consumer data. For example, Marriott was hit with a $23.98 million fine for its 2018 data breach, Equifax paid a minimum of $575 million for its 2017 breach, and T-Mobile agreed to pay $350 million in fines for its cyberattack in 2021.
Ransomware: Ransomware is a particularly destructive form of malware that has, in recent years, become the weapon of choice for cybercriminals. Cybersecurity Ventures predicts that ransomware will cost its victims around $265 billion annually by 2031, up from $42 billion in 2024 and $20 billion in 2021. Recent examples include CNA Financial, which paid $40 million in ransom after a cyberattack in March 2023, and in September 2023, Caesar’s Entertainment paid $15 million in ransom to prevent disclosure of stolen information.
Lost revenue: The most visible costs associated with data breaches are typically related to the reacting and repairing of the damage caused by the attack, mostly seen above the surface. But there are many other costs below the surface. Declines in annual revenues are one of the biggest detriments to a business. Revenue loss can occur in many forms, such as customer attrition, lost memberships, or canceled contracts. Growth rate for new customers also declines. To mitigate the impact of an incident, a company may lower its premiums, ultimately leading to a significant loss in revenue spanning several years.
Brand reputation and customer trust: It’s hard to put a price on customer trust which can take years to build, however it can be damaged in an instant after a security breach. In a PwC Consumer Trust Survey, 79% of consumers say protecting their data is very important to building trust, and 91% of business executives say their ability to build and maintain trust improves their bottom line.
Endpoint Security Risks Are Rising
The widespread use of mobile devices, the prevalence of cloud computing, and the rise of remote work has permanently transformed how consumers and businesses utilize technology. While this has paved the way for tremendous efficiency gains and competitive advantage, it is also turning endpoints into a company’s weakest security link. According to Deloitte, the total average cost of a successful endpoint attack is $5 million in lost productivity, system downtime, data theft, IT infrastructure damage, brand damage, and fines. As businesses continue to move to a digital business model, understanding how to protect its endpoints, data, and critical assets shared among the organization, its partners, and customers is critical.
To counter these threats, companies must adopt a multi-layered strategy for cybersecurity, integrating a variety of security controls that complement and support each other. Frameworks such as Network Detection and Response (NDR), Managed Detection and Response (MDR), and Endpoint Detection and Response (EDR) can work together as a cohesive safety net, catching anything that might slip through the cracks.
What is Endpoint Detection and Response (EDR)?
EDR solutions are focused specifically on endpoint devices in a network, including all servers, desktops, laptops, smartphones, and similar devices. EDR solutions provide four primary functions: detect security incidents, investigate security incidents, contain the incident at the endpoint, and provide remediation guidance.
EDR uses advanced analytics and machine learning (ML) to monitor activities on these devices. It can detect and respond to threats in real-time, providing in-depth visibility into endpoint activities and threats that may evade traditional antivirus solutions.
How EDR Works
EDR collects data directly from the endpoints, such as system logs, process executions, registry changes, and file system activities, and correlates the data, helping to link various activities on a device and identify complex attack chains. It can also integrate with endpoint-specific threat intelligence, aiding in the identification of device targeting threats.
EDR solutions can take actions like quarantining malware-infected systems, killing malicious processes, or rolling back system changes. Every endpoint, server, mobile device, network, and operating system is protected against any type of attack. EDR facilitates swift response at the endpoint level, allowing for the isolation or remediation of compromised devices to safeguard the network and ensure that attacks are identified and blocked before damage occurs.
Measuring the ROI of EDR
Security leaders are struggling to communicate the value of investing in cybersecurity into clear returns for the business. Likewise, business leaders are struggling to balance the value of implementing new technology with the potential for increased cyber risk in their organizations.
So how does one measure the return on investment (ROI) of EDR?
The bottom line is that security solutions should be viewed as an investment in a business’s future, rather than as an expense. While cybersecurity investments don’t generate revenue, they function to mitigate potential costs of damages. The ROI should therefore be based on how much loss the organization could avoid through the investment in cybersecurity.
A simple formula is to take the average cost of an EDR solution and compare it to the average cost of a threat like ransomware. For instance, if the cost of the EDR solution is $30,000 and the cumulative cost of ransomware is $250,000, considering reputational damage, loss of sales, regulation fines, and so on, the ROI is $220,000. It’s clear that the investment in EDR is only a fraction of the cost of a security threat.
Investments in cybersecurity will save money by reducing ongoing costs in IT security operations, increasing security team efficiency and productivity, reducing remediation times, helping organizations comply with data privacy regulations, lessening business disruption and downtime by reducing incidents, and enabling organizations to pursue new business opportunities to gain a competitive advantage in the market.
EDR Is a Proactive Investment. Make the Shift Now.
According to Cybersecurity Ventures, more than half of all cyberattacks are committed against small-to-mid-sized businesses, and 60% of them go out of business within six months of falling victim to a data breach or hack. In other words, the vast majority of businesses underpinning the U.S. economy are at serious risk of cyberattacks.
To be successful, small-to-mid-sized businesses need to demonstrate resilience, take a proactive stance, and prevent data breaches by adopting a multi-layered approach to cybersecurity and implementing a next-generation EDR solution.
Hughes offers EDR protection through its MDR solution based on multiple layers, including a prediction and prevention first approach, followed by detection and response against known and unknown cyber threats. To learn more about Hughes EDR, visit our website.