Over half (52%) of cybersecurity professionals are experiencing an increase in cyber-attacks compared to a year ago, according to new research from ISACA. Despite the increased attacks, companies are failing to regularly assess cyber risk, with less than one in ten (8%) of organizations completing cyber risk assessments monthly and only two in five (40%) conducting them annually.

As businesses face more complex challenges including evolving regulations, a hybrid workforce, and technological advancements, they need to not only understand the changing risk landscape but also have robust risk management programs in place to keep their organizations safe from cyber attacks. 

To help, we’ve compiled a list of statistics that underscore the importance of risk management. You’ll learn more about what the top risks are according to executives, the rising costs of insider risk, the increased exposure to third-party risk, and more.

Risk management statistics

The statistic below will provide more insight into the risk landscape as well as different types of risk management, including third-party and insider risk. 

Risk landscape statistics

The risk landscape is constantly evolving. See what risks are top-of-mind for risk executives and how their risk exposure has changed over time. 

1. 41% of organizations reported that they experienced three or more critical risk events in the last 12 months. (Forrester)

2. In 2022, 41% of organizations that had been attacked in the past year said their risk exposure has increased. (Hiscox)

3. 65% of senior finance leaders agree that the volume and complexity of corporate risks have changed “mostly” or “extensively” over the last five years. (AICPA and NC State University)

4. 35% of risk executives said compliance and regulatory risk, among other operational risks, presents the greatest threat to their company's ability to drive growth. Another 35% said cyber or information risk was. (PwC)

5. 61% of risk executives said data protection and privacy regulations were the biggest priorities for their company in 2022. (PwC)

6. Cybercrime was consistently assessed as one of the top five risks by most risk executives (58% and increasing), now and in the coming three years. (McKinsey)

7. The top three risks which most concerned the CROs in a recent survey by McKinsey were direct financial impact, harm to customers, and reputational damage. Each of these risks were ranked first by approximately 30 percent of responding CROs. (McKinsey)

8. Poor data quality was reported as the data-related risk of greatest concern by 58% of risk executives. (McKinsey)

Risk management program statistics

Many organizations have a risk management program in place. Check out the statistics below to understand what challenges risk professionals are facing and what outcomes they’re focused on.

9. Just under two-thirds (63%) of executives believe that their organization’s risk management processes provide “no” or “minimal” competitive advantage. (AICPA and NC State University)

10. When asked to identify the most significant outcomes their company has already achieved from the use of tech applications, 57% of risk professionals said they’re seeing significant “quality” outcomes, including better decision-making based on risk insights. (PwC)

11. Fewer risk professionals say they’re seeing significant “efficiency” outcomes such as lower compliance costs (30%) and personnel costs (25%) as a result of tech applications. (PwC)

12. 54% of risk professionals want stronger relationships with senior executives for greater influence. (PwC)

13. Risk professionals cited other keys to improving relevance and exerting greater influence on strategic decisions, including upskilling of risk workforce on emerging technologies (47%), leadership support for collaboration across the three lines, ie. CEO, the board, and senior leadership (45%), more organized data infrastructure and governance (38%), and more budget (37%). (PwC)

Risk response statistics 

A key part of risk management is responding to risks. Learn what processes and plans organizations have in place. 

14. Nearly three-quarters of organizations said they had an incident response (IR) plan, while 63% of those organizations said they regularly tested the plan. (IBM)

15. The organizations with an IR team that tested an IR plan saved $2.66 million in breach costs on average versus those with no IR team and IR plan testing — a 58% cost savings. (IBM)

16. Almost three-fourths (75%) of executives believe there will be significant changes in their organization’s approach to business continuity planning and crisis management. (AICPA and NC State University)

Third-party risk management statistics

Nearly every company does business with — or uses the products of — a third party that has suffered a data breach. Learn more about the importance of vendor risk management.

17. 31% of risk executives said third-party risk, among other operational risks, presents the greatest threat to their company's ability to drive growth. (PwC)

18. 64% of organizations stated that third-party risk management was viewed as an organizational strategic imperative by their boards of directors and executive teams. (ProcessUnity and CyberGRX)

19. Over 81% of individuals said they were able to quantify and communicate the value of their third-party risk management program to business leaders and stakeholders. (ProcessUnity and CyberGRX)

20. 98% of organizations have vendor relationships with at least one third party that has experienced a breach in the last two years. (Cyentia Institute and SecurityScorecard)

21. The IT sector has relationships with the most third parties, with an average of 25, while the finance sector had the fewest, at 6.5. (Cyentia Institute and SecurityScorecard)

22. First parties are two times more likely to achieve the highest security rating, while third

parties are five times more likely to exhibit poor security. (Cyentia Institute and SecurityScorecard)

Insider risk management statistics

As the cost of insider risk grows, more organizations are investing in insider risk management. Learn how organizations are dealing with insider risk.  

23. The average annual cost of an insider risk has increased to $16.2M – a 40% increase over four years. (DTEX Systems)

24. The average number of days to contain an insider incident in 2023 has increased to 86 days. (DTEX Systems)

25. Almost half (46%) of organizations are planning to increase their investment in insider risk programs in 2024. (DTEX Systems)

26. 77% of organizations have started or are planning to start an insider risk program. (DTEX Systems)

27. 88% of organizations spent less than 10% of their total IT security budget on insider risk management. (DTEX Systems)

28. Organizations had an IT security budget of $2,437 per employee, yet only 8.2% was allocated specifically to insider risk programs and policies. That’s the equivalent of $200 per employee. (DTEX Systems)

29. 91.8% of IT security budget was spent on external threats, despite more than half of organizations attributing social engineering as a leading cause of all outside attacks. (DTEX Systems)

30. 58% view current spending on insider risk programs as inadequate and 46% expect funding to increase in the next year. (DTEX Systems)

31. Only 10% of insider risk management budget (averaging $63,383 per incident) was spent on pre-incident activities, including monitoring and surveillance and ex-post analysis. The remaining 90% (averaging $565,363 per incident) was spent on post-incident activity, with the most spent on containment ($179,209 per incident) and remediation ($125,221 per incident). (DTEX Systems)

How to create a risk management plan

A risk management plan can help you identify, assess, and mitigate risks. Here's a step-by-step guide on how to create one.

1. Define the purpose.

Clearly state the purpose of your risk management plan. This purpose should include defining how risks associated with your business or a specific project will be identified, analyzed, and managed and outlining how these activities will be performed, documented, and monitored.

2. Assign roles and responsibilities.

Next, assign roles and responsibilities to key stakeholders. For example, you may assign one or multiple risk owners to be responsible for determining which risks require mitigation and contingency plans, creating those, and performing a cost benefit analysis for each proposed strategy. They may also be responsible for monitoring and updating the status of the risk throughout the risk management lifecycle.

3. Define the risk identification process. 

Now it’s time to define the risk management process, starting with how you identify risks. List the factors that you’ll consider, like environmental factors and organizational culture, as well as any methods you’ll use, like a SWOT (strengths, weaknesses, opportunities, and threats) analysis. 

4. Define the risk assessment and analysis process. 

Explain how you’ll assess the likelihood and impact of each identified risk and use a risk matrix or scoring methodology to assign quantitative or qualitative values to these factors. This will help prioritize risks based on their significance. Risk = Likelihood x Impact.

5. Define the risk response planning process.

Outline the strategies you’ll select from when deciding how to respond to each identified risk. The main outcomes are accept, avoid, mitigate,transfer, and resolve. Also, it’s important to include next steps once a risk response strategy has been selected. For example, if you opt to accept a major risk then a course of action should be outlined in the event that the risk does materialize in order to minimize its impact.

6. Define the risk monitoring and reporting process.

Finally, establish a system for ongoing risk monitoring. This should detail who is responsible for tracking existing and new risks, assessing any changes in likelihood or impact, evaluating the effectiveness of the risk response strategy, and adapting it if it isn’t. 

You should also develop a reporting structure to keep management informed of important changes to the status of risks or any changes in the organization’s risk profile.

7. Review and update the plan and risk tracker regularly.

New risks will emerge, and existing risks will evolve over time so it’s crucial that you periodically review and update your risk management plan and tracking documents to account for changes in your business environment and industry. 

How Secureframe can help

Secureframe makes it easy to build and maintain robust risk management processes. With our all-in-one GRC solution, you can:

• Monitor risks 24/7: Get complete visibility into critical security and privacy issues with continuous monitoring across your tech stack. 
• Track risks in a single platform: Easily maintain a comprehensive and up-to-date risk register as you introduce new products and services, your tech environment changes, or to incorporate findings from internal or external audits. 
• Assign risk owners: Assign risk owners and set up notification reminders to review and update risks on a regular basis ensure accountability. 

Learn more about Secureframe's risk management features and how we can help you build a strong risk management program by scheduling a demo today.