VANCOUVER, British Columbia — June 25, 2020 — Absolute® (ABT.TO), the leader in Endpoint Resilience™, today announced it has published new research underscoring the massive amount of complexity plaguing today’s enterprise endpoint environments. Expanding on last year’s first annual edition, the findings in ‘The 2020 State of Endpoint Resilience Report’ re-emphasize that the number of agents piling up on enterprise endpoint devices – up on average – is hindering IT and Security’s ability to maintain foundational security hygiene practices, such as patching critical vulnerabilities, which may actually weaken endpoint security defenses.
The report also found that critical endpoint controls like Encryption and Antivirus agents, or Virtual Private Networks (VPNs), are prone to decay, leaving them unable to protect vulnerable devices, data, and users – with more than one in four enterprise devices found to have at least one of these controls missing or out of compliance. In addition to heightening risk exposure, the failure of critical endpoint controls to deliver their maximum intended value is also resulting in security investments and, ultimately, wasted endpoint security spend.
According to Gartner, Inc., “Boards and senior executives are asking the wrong questions about cybersecurity, leading to poor investment decisions.” Further, “It is well-known to most executives that cybersecurity is falling short. There is a consistent drumbeat directed at CIOs and CISOs to address the limitations, and this has driven a number of behaviors and investments that will also fall short.”1
“What has become clear with the insights uncovered in this year’s report is that simply increasing security spend annually is not guaranteed to make us more secure,” said Christy Wyatt, President and CEO of Absolute. “It is time for enterprises to increase the rigor around measuring the effectiveness of the investments they’ve made. By incorporating Resilience as a key metric for endpoint health, and ensuring they have the ability to view and measure Endpoint Resilience, enterprise leaders can maximize their return on security investments.”
For the first time in this report, Absolute has also leveraged its unique endpoint intelligence to measure Application Resilience™, defined as the health or state of decay of endpoint security controls as well as their ability to react to collision or damage. Understanding the health and behavior of commonly deployed endpoint applications, as well as app pairings, is integral to enabling IT and Security teams to maximize app effectiveness and return on investment (ROI) – and, ultimately, ensure the highest levels of Endpoint Resilience.
Key insights from this year’s report include:
Without the ability to self-heal, critical controls suffer from fragility and lack of resiliency. Our data shows that ‘Best-in-Class’ enterprise customers using Absolute’s patented Persistence® technology to self-heal their critical security applications when they’re disabled, altered, or otherwise made vulnerable see vast improvements in app health and compliance. The average compliance rates for Encryption agents and VPNs for organizations with Application Persistence™ turned on were 98 percent and 91 percent respectively, versus 76 percent and 59 percent for those who did not.
Endpoint Resilience is dependent not just on the health of single endpoint applications, but also combinations of apps. The massive amount of complexity Absolute’s data has uncovered means that even the most well-functioning endpoint agents are at risk of collision or failure once deployed across today’s enterprise endpoint environments. IT and Security teams need intelligence into whether individual endpoint controls, as well as various combinations of controls, are functioning effectively and maintaining Resilience in their own unique endpoint environment.
Single vendor application pairings are not guaranteed to work seamlessly together. In applying the criteria for Application Resilience to same-vendor pairings of leading Endpoint Protection and Encryption apps, we found widely varied average health and compliance rates among these pairings. The net-net here is that sourcing multiple endpoint agents from a single vendor does not guarantee that those apps will not ultimately collide or decay when deployed alongside one another.
In addition to highlighting the criticality of Endpoint Resilience, other observations included:
Much progress made in Windows 10 migration, but fragmentation and patching delays leave organizations potentially exposed. Our data showed that while more than 75 percent of endpoints had made the migration to Windows 10 (up from 54 percent last year), the average Windows 10 enterprise device was more than three months behind in applying the latest security patches – perhaps unsurprisingly, as the data also identified more than 400 Windows 10 build releases across enterprise devices. This delay in patching is especially concerning in light of a recent study that shows 60 percent of data breaches are the result of a known vulnerability with a patch available, but not applied.
Fragile controls and unpatched devices are being relied on to protect remote work environments. With the rise of remote work environments in the wake of the COVID-19 outbreak, as of May 2020, one in three enterprise devices is now being used heavily (more than 8 hours per day). The data also shows a 176 percent increase in the number of enterprise devices with collaboration apps installed as of May 2020, versus pre-COVID-19. This means the average attack surface, and potential vulnerabilities, has expanded significantly across enterprises.
Absolute’s EVP of Product Management, Ameer Karim, along with guest speaker, Chris Sherman, an industry-leading Security & Risk analyst from Forrester, will also discuss the findings of the report during a live webinar on Thursday, July 9, 2020 at 10AM PT / 1PM ET. Register for the webinar here.
To learn more about how Absolute’s undeletable digital tether enables Endpoint Resilience, Self-Healing Endpoint® security, and always-connected visibility, visit www.absolute.com.
1Gartner, The Urgency to Treat Cybersecurity as a Business Decision, Paul Proctor, 12 February 2020. (Gartner subscription required)