Concern about artificial intelligence (AI)-enhanced malicious attacks has once again topped research and consulting company Gartner Inc.’s list of emerging risks for enterprises in the second quarter of 2024.
The rising anxiety over these sophisticated cyber threats highlights the growing challenges that organizations face in maintaining cybersecurity. New concerns regarding soft ransomware targets have surfaced, marking a significant point of interest in enterprise risk management.
“Similar to AI-enhanced malicious attacks, soft ransomware targets require minimal experience and cost to cause significant financial and reputational damage,” said Gamika Takkar, director, research in the Gartner Risk & Audit Practice.
In the second quarter of 2024, Gartner surveyed 274 senior risk executives and managers to document and compare emerging risks. The results revealed that 3 of the top 5 most cited risks are technology-related, with soft ransomware targets appearing in the rankings for the first time. Political polarization, which first emerged as a concern in the fourth quarter of 2023, maintained its position as the third most cited risk. Concerns about misaligned organizational talent profiles moved from fifth to fourth place.
Ransomware-as-a-service
Soft ransomware targets refer to systems that are particularly vulnerable to ransomware attacks due to underinvestment or technical debt. These systems often face longer disruptions in business operations when attacked. The concept of ransomware-as-a-service (RaaS) has lowered the barrier to entry for cybercriminals, enabling those with minimal technical skill to deploy attacks at low cost. Takkar pointed out that RaaS allows inexperienced attackers to disrupt business operations significantly, leading to severe impacts.
“Ransomware-as-a-service lowers the barrier to entry for inexperienced cybercriminals who know just enough about how to attack and disrupt business operations, creating worse impacts than usual when attacks occur,” said Takkar.
The potential consequences of attacks on soft ransomware targets are multifaceted. They range from operational disruptions and delays in services to increased exposure to multi-extortion. Multi-extortion includes ransom demands followed by threats of selling, publishing, or permanently deleting data. The financial burdens from such attacks include direct costs like ransoms, remediation, litigation, and public relations efforts, as well as indirect costs such as reputational damage and loss of intellectual property.
“While operational disruption and increased costs are dire consequences of soft ransomware targets, the exposure to extortion can impact not just the organization itself, but any and all associated third-parties as well, further underscoring the importance of understanding and preventing such risk,” said Takkar.