70 percent of major breaches caused by overlapping risks
New research from business risk specialist Panaseer shows that major breaches are being caused by toxic combinations -- overlapping risks that compound and amplify each other, until they form a critical vulnerability.
The company analyzed 20 major breaches that have occurred over the past five years. In 14 of the 20 cases, it found clear evidence of compounding risks forming toxic combinations that magnified the overall impact.
Examples include the AT&T breach in 2024 which started with credentials being harvested by an infostealer. This was compounded by a cloud database that didn’t have 2FA, the undetected use of reconnaissance tools to find high-value datasets, and undetected exfiltration of large volumes of data.
This breach led to both reputational and financial damage. AT&T has since been ordered to pay customers $2,500 each if they can prove they were impacted.
Similar chains of events mark breaches at MGM Resorts in 2023, Okta and Uber (both in 2022), and the Colonial Pipeline breach in 2021.
What these findings indicate is that a single vulnerability is rarely the only thing behind a major breach. The problem is that although individual issues don’t look that severe on their own the combination of issues adds up to a major problem.
Panaseer’s senior product leader Nick Emanuel writes on the company’s blog, “Organizations need the ability to see these patterns forming. That requires more than human intuition. It calls for data-driven analysis across millions of assets and signals. This is where platforms like Panaseer’s Cyber Control Management (CCM) can help make a difference. Panaseer helps identify high-risk scenarios where multiple weaknesses in cybersecurity defences overlap. Panaseer’s compound risk metrics instantly reveal areas with higher exploitability across multiple cyber domains, combined with business context, so you can focus on the most critical risks first.”
You can see more detail about the breaches on the Panaseer blog.
Image credit: Elnur_/depositphotos.com