Security NIST 6-12 Report

Organized attackers make every business a target

The report describes a criminal ecosystem with recruiting, training, finance, development, and negotiation teams. Ransomware groups partner with specialists in initial access, lateral movement, and payload delivery, while using threatened disclosures and reputational damage to pressure victims into paying.

Leaked Conti communications illustrated commission-based negotiations and discounts for quick payment. Attackers research revenue and may search stolen contracts, insurance records, and financial reports to set ransom demands. Victims cited in the report included businesses with annual revenues of around $20 million, underscoring that smaller organizations are not exempt.

Financial motives dominate, but espionage, destructive attacks, and insider activity also matter. The report cites internal employees as the root cause of 39% of healthcare breaches, including intentional and unintentional actions. Its examples of Lazarus and Conti also show how criminal activity and geopolitical interests can overlap.

Breach costs extend well beyond the ransom

IBM and the Ponemon Institute’s Cost of a Data Breach Report 2021 put the global average breach cost at $4.24 million, up 10% from $3.86 million in 2020. The US average rose from $8.64 million to $9.05 million over the same period.

Lost business accounted for 38% of total breach costs, including customer turnover, downtime, difficulty winning new business, and reputational damage that raises acquisition costs. The AVANT report states that ransom payments represent only about 15% of the overall burden of ransomware.

Regulatory penalties and litigation add further exposure. Examples cited include Equifax’s minimum $575 million settlement, First American’s $487,616 SEC penalty, Pearson’s $1 million SEC penalty, and Minted’s $5 million class-action settlement fund. These cases involved different circumstances and should not be treated as interchangeable penalties for late reporting.

The report also cites Gartner’s forecast of $150.4 billion in worldwide information security and risk management spending for 2021, with services representing 48%, or almost $72.5 billion. Rising spending makes disciplined prioritization more important, not less.

Reporting obligations bring cybersecurity into the boardroom

The report highlights the 2022 Cyber Incident Reporting for Critical Infrastructure Act and its reporting timeframes of 72 hours for major cyber incidents and 24 hours for ransom payments by covered critical infrastructure entities. These are presented as part of the report’s September 2022 regulatory context, not as a current compliance checklist.

It also discusses the SEC’s March 2022 proposal for material cybersecurity incident reporting and disclosures about risk-management processes, management responsibilities, board expertise, and oversight. At publication, these were proposed requirements. The broader message is to establish accountability and reporting processes before an incident or regulatory deadline forces action.

Threat intelligence should reflect industry and operational risk

The report’s discussion of Verizon’s 2022 Data Breach Investigations Report identifies web application hacking and email as leading incident vectors, with partners and software updates also prominent. System intrusion, social engineering, and basic web application attacks represented 88% of breaches in the cited summary.

Manufacturing illustrates how cybersecurity becomes an operational and supply-chain issue. The report contrasts 585 incidents and 270 confirmed disclosures in 2020 with 2,337 incidents and 338 confirmed disclosures in 2021. Its 2022 examples include ransomware-related disruption at Bridgestone and Denso, and a cyberattack at Kojima Industries that disrupted Toyota production; the timing of geopolitical events does not establish attribution.

Availability and resource theft also require attention. DDoS attacks can target networks or applications and may distract defenders from other activity. Cryptomining campaigns exploiting Log4Shell illustrate the persistence of internet-facing vulnerabilities and the need for ongoing patching and exposure management.

Use the NIST framework to organize decisions, not just products

The version of the NIST Cybersecurity Framework discussed in this 2022 report has five core functions: Identify, Protect, Detect, Respond, and Recover. These functions are intended to operate simultaneously and continuously, providing a common language for risk, investment, and responsibility.

The framework can help mature programs find weaknesses and give resource-constrained organizations a practical starting point. It focuses attention on what must be achieved before teams decide how to implement it. Security should also be considered from the beginning of digital transformation projects rather than added after new applications and infrastructure expand the attack surface.

Zero Trust, SASE, and individual products are not interchangeable with a complete security program. Zero Trust assumes resources and identities may already be compromised and limits access accordingly. SASE combines networking and security capabilities, while Security Service Edge focuses on security capabilities such as secure web gateways, cloud access security brokers, and Zero Trust Network Access. ZTNA addresses a specific access requirement, not the whole Zero Trust concept.

Identify: understand assets, business priorities, and gaps

Organizations cannot protect assets they do not know exist. Identify covers asset management, business context, governance, risk assessment, risk-management strategy, and supply-chain risk. Inventories must keep pace with hiring, departures, acquisitions, equipment changes, and new services.

Assessments should begin with how the organization earns revenue and which risks threaten those outcomes. Technical discovery can then include interviews, scans, penetration testing, and framework-based gap analysis. The result should be a prioritized roadmap rather than an unstructured list of tools.

A virtual chief information security officer can help align stakeholders, simplify a fragmented vendor environment, and develop a multiyear security plan. AVANT’s assessment data found that 40% of surveyed companies had completed a penetration test or security assessment within the previous year, 21% had not done so in over a year, and 11% had never conducted one.

• Risk assessments evaluate business exposure and priorities for reducing it.
• Gap analyses compare existing protection with required or desired controls.
• Penetration tests emulate attacker behavior to evaluate controls at a particular point in time.

Protect: reduce exposure and limit the impact of compromise

Protect covers identity and access management, awareness and training, data security, information-protection processes, maintenance, and protective technology. The objective is both to reduce the likelihood of compromise and to limit the damage when an attack succeeds.

The report identifies multifactor authentication, endpoint protection, firewalls, and DDoS mitigation as relevant technologies. Defense in depth extends beyond the perimeter to data, devices, infrastructure, and development pipelines, requiring collaboration among security, IT operations, networking, and developers.

Employee education remains essential alongside technical controls. Training should cover email, passwords, and social media risks. Product choices should reflect business needs and operating capacity, particularly when organizations move from hardware appliances to cloud-delivered services.

Detect: turn monitoring into actionable intelligence

Detect encompasses anomalies and events, continuous monitoring, and detection processes. Relevant capabilities include endpoint detection and response, managed detection and response, SIEM and log management, vulnerability scanning, behavior analytics, dark web monitoring, and threat hunting.

Continuous monitoring requires people as well as technology. The report highlights difficulty hiring and retaining round-the-clock security talent and warns that excessive false positives can lead teams to tune tools until meaningful alerts disappear. Managed security services can provide additional coverage, but buyers must verify the actual service scope.

Only 17% of companies in the cited AVANT research used a third-party managed security service provider or security operations center. The report also cautions that the word ‘response’ in a product name may mean little more than alerting or limited blocking, rather than comprehensive incident management.

Respond: prepare decisions, communications, and specialist support

Respond includes planning, communications, analysis, mitigation, and improvement. Plans should distinguish routine anomalies from situations requiring coordinated escalation, with clear ownership across security, IT, business leadership, and communications teams.

The report recommends rehearsing response plans quarterly and reviewing communications with marketing annually. An incident response retainer can establish access to specialist assistance before a crisis, reducing the need to select and contract with a provider while an attack is unfolding.

Cyber insurance is not a substitute for preparedness. Coverage may depend on following required procedures and maintaining preventative measures. Organizations should clarify insurer requirements, response-provider arrangements, and decision-making authority before an incident rather than assuming all costs or preferred providers will be covered.

Recover: restore operations and strengthen continuity

Recover focuses on restoring data and normal business operations after a breach. IT stakeholders generally lead this work, coordinating recovery planning, improvements, and communications with the broader incident response effort.

Backup as a Service and Disaster Recovery as a Service can support restoration and failover requirements. Incident response and forensics span both response and recovery by investigating compromise and supporting remediation. Recovery capabilities should be aligned with business continuity needs rather than treated as an isolated backup purchase.

Move from reactive tools to adaptive security

Owning products in every framework category does not establish maturity. The report notes that NIST’s four Implementation Tiers are not themselves a maturity model and points to the US Department of Energy’s Cybersecurity Capability Maturity Model as one way to benchmark capability and set improvement goals.

AVANT also describes a Trustwave-pioneered progression from reactive to proactive to adaptive security. Reactive programs rely on foundational defenses such as antivirus, firewalls, intrusion detection or prevention, email gateways, and logs. Proactive programs add intelligence and high-impact alerting; adaptive programs use capabilities such as threat hunting and behavior analytics to drive better outcomes.

Self-reported confidence is not evidence that controls work. Organizations should assess actual capabilities, integration, and operating practices, then measure progress against a roadmap. Layering complementary controls can close gaps, but additional tools alone do not guarantee resilience.

Make advisory support accountable to business outcomes

The report positions trusted advisors as a bridge between business priorities, security capabilities, and provider selection. In AVANT’s cited survey of 500 US enterprise decision-makers, more than 40% considered their internal teams less than highly qualified across the full range of infrastructure responsibilities; 67% reported engaging trusted advisors for managed security services assistance.

A vendor-neutral evaluation should ask which business problem needs solving, how existing controls integrate with newer SaaS applications and remote work, whether services scale with the workforce, and who owns detection, containment, recovery, and improvement. The goal is a coordinated security program with measurable outcomes, not a purchase justified by terminology or a single product’s promises.