Enterprise Cloud Index

Furthermore, ECI respondents rank ransomware protection and data security as their organization’s biggest data management challenge. Unfortunately, there is no single action, software solution, or security control that can completely safeguard your organization from the threat of ransomware. The best solution is often a multi-layered approach designed to prevent, detect, mitigate, and recover from malicious attacks when they happen. It is also critical that an organization’s ransomware/malware defense remains flexible and iterative enough to accommodate new applications and workloads, as well as novel attack methods. This ability to continuously improve the organization’s security capabilities is a key to long-term success. Many organizations are cognizant of this, with 92% of ECI respondents saying their organization needs to make improvements to its current ransomware protection stance. The good news is that many organizations are prioritizing investments to support this continuous improvement: 78% of respondents say they will increase investments in ransomware protection over the next 12 months.

Understanding the Impact of Malware and Ransomware Attacks

Ransomware attacks affect all sizes of business across all industries and geographical locations. However, some industries are more at risk of malware and ransomware attacks than others because of the massive volumes of sensitive data they have or the blast radius of how an attack would cause damage in terms of data loss/downtime. The most targeted industries are typically banking and financial services, healthcare, manufacturing, energy and utilities, governmental agencies, and education.

Given the pervasiveness of ransomware attacks, the 6th annual ECI report focused specifically on gaining a better understanding of organizations’ ability to respond to these attacks. 89% of survey respondents admit their organization has experienced a ransomware attack in the past 3 years. Given that some ransomware attacks go undiscovered, and some organizations may not be able to disclose attacks publicly, it is likely that this percentage is even higher.

But even more concerning is the fact that 96% of organizations affected by ransomware experienced some sort of negative impact to their operations. In other words, very few organizations came out of a ransomware attack/event unscathed. And once targeted, only 29% of organizations were able to recover within hours, with the vast majority of organizations (71%) taking days, weeks, or months to fully recover from a ransomware event (see Figure 4).

Interestingly, while improving security posture and meeting regulatory requirements are the top reasons why applications are moved to different environments overall, for DevOps and Platform Engineering respondents, the top reason is to improve data access and speed (40%) tied with improving security posture and meeting regulatory requirements (40%), followed by integrating with cloud native services (37%).

The key is for organizations to plan for and enable this eventuality. One way to do so is by embracing new application deployment paradigms like hybrid multicloud. But in many cases this is easier said than done: 35% of ECI respondents say workload and application migration is a significant challenge when using their current IT infrastructure. Furthermore, 89% of organizations believe moving workloads to a different cloud environment is costly and time consuming. Despite these challenges, we recommend organizations begin establishing processes and operations to manage data and applications across environments, especially if these processes can be included as part of a larger IT modernization initiative.

Infrastructure Decisions and Cost

Managing cloud costs continues to be top of mind for most, with 85% of ECI respondents saying their current IT infrastructure makes cloud cost control a challenge. However, cost does not seem to be the main driver of infrastructure decisions. For example, respondents ranked cost second to last when looking at the reasons why organizations choose to move applications to a different environment. Cost ranked last when asked about top drivers of infrastructure decisions as well as top challenges when managing data.

While cost continues to be top of mind for IT teams, its low ranking when compared to more strategic choices like security, data protection, performance, accessibility, and scalability, is indicative of how the perceived value of infrastructure solutions has changed over the last decade. Decision makers aren’t just picking the cheapest solution, they are thoroughly evaluating a range of variables associated with solution deployment that go beyond baseline cost, extending to more intangible considerations like the potential cost of downtime or data loss associated with choosing an inadequate solution.

Drivers of Infrastructure Choice: The rank order of primary drivers of infrastructure choice track closely between the Americas and the global average. However there are some key differences across other global regions. In EMEA, data sovereignty and privacy increases in rank to be tied for the #1 reason driving infrastructure choice. This is in stark contrast to the Americas, where data sovereignty and privacy was ranked lowest (see Figure 8).