Vectra identifies healthcare as the industry most targeted by cyber attacks

Vectra Networks, the leader in automating the hunt for in-progress cyber attacks, announced the results of its Post-Intrusion Report, outlining key cybersecurity trends from Q1 2017. The research is based on data from a sample set of nearly 200 opt-in Vectra enterprise customers, looking at the prevalence of command-and-control (C&C), reconnaissance, lateral movement, and exfiltration attacker behaviors across thirteen industries.

Vectra discovered healthcare to be the most frequently targeted industry, with 164 threats detected per 1,000 host devices, followed by education and media, which had 145 and 123 detections per 1,000 host devices, respectively. By comparison, the food and beverage industry came in as the least targeted industry with just 17 detections per 1,000 hosts.

Additional findings include:

• Attack rates are increasing across the board: The average number of reconnaissance, lateral movement and exfiltration detections have all increased, by more than 265 percent.

• Hackers want what the media has: Media organizations experienced the highest rates of exfiltration, with 34 detections per 1,000 host devices. The industry’s high rates of exfiltration attempts can likely be attributed to its decentralized supply chain made up of small businesses with limited IT staff.
• Entertainment experiences the most diverse attacks: The entertainment industry experienced above-average rates of the five attack behaviors measured. Only the food and beverage industry experienced below-average detections for all activity measured.

• Setting the stage for WannaCry: Reconnaissance detections were up by 333 percent when compared to 2016. Internal reconnaissance is a necessary first step for ransomware campaigns. The sharp increase in reconnaissance detections may be an early indicator of the recent rise of attacks such as WannaCry.

• Finance and technology prove most resilient: These industries have below-average detection rates, with 37 and 38 detections per 1,000 hosts, respectively. This indicates the presence of stronger policies, mature response capabilities, and better control of the attack surface.
• Automated detection frees up valuable workers: Vectra customers achieved a 29x workload reduction for Tier-1 security analysts in detection, triage, correlation and prioritization of security incidents, enabling them to focus on remediating compromised hosts that pose the highest risk.

The data in the Post-Intrusion Report is based on anonymized metadata from Vectra customers who have opted to share detection metrics. Over 90 days, Vectra monitored 2,145,708 hosts. On these hosts, Vectra detected 1,805,188 different network behaviors that were condensed to 140,341 detections. These detections were then triaged down to 62,119 hosts, with 10,710 hosts prioritized as high or critical business risk.

About Vectra Networks

Vectra Networks is the leader in automating the hunt for in-progress cyber attacks. Using artificial intelligence, Vectra correlates threats against hosts that are under attack and provides unique context about what attackers are doing so organizations can quickly prevent or mitigate loss. Vectra prioritizes attacks that pose the greatest business risk, enabling organizations to make rapid decisions on where to focus time and resources. In 2016, Vectra was named “Most Innovative Emerging Company” in the Dark Reading Best of Black Hat Awards. InformationWeek also named Vectra one of the Top 125 companies to watch in 2016. Vectra investors include Khosla Ventures, Accel Partners, IA Ventures, AME Cloud Ventures and DAG Ventures. The company is headquartered in San Jose, Calif. and has European regional headquarters in Zurich, Switzerland.

# # #

Vectra, the Vectra Networks logo and Security that thinks are registered trademarks and the Vectra Threat Labs and the Threat Certainty Index are trademarks of Vectra Networks. Other brand, product and service names are trademarks, registered trademarks or service marks of their respective holders.