Did Cybersecurity Predictions for 2023 Come True? Here’s What We Found

This past January, we asked Illumio experts and business leaders to share their thoughts on what to expect from the cybersecurity industry in 2023.

Now that we’re closing in on a new year, it’s the perfect time to look back at the last 12 months.  

Here are three key predictions for 2023 and how they played out this year.

Prediction: “Just as physical crime rates increase in times of crisis, economic uncertainty will create more opportunities for cyber criminals who will take advantage of an unstable market. Ransomware will continue to have major impacts on businesses, governments, and critical infrastructure.” – Andrew Rubin, Illumio CEO and cofounder

As predicted, economic uncertainty continued throughout 2023, impacting cybercriminals’ opportunities for attacks. For another year in a row, breaches and ransomware attacks increased, adding to the list of some of the largest-ever breaches.

Just this year, there were nearly 1,000 known and reported breaches which allowed threat actors access to an astounding 5 billion sensitive records, according to IT Governance. That of course doesn’t account for all the breaches that are yet unnoticed or were not reported.  

One of the largest breaches this year was MOVEit. Security experts estimate that over 2,000 organizations worldwide have been affected with 60 million people’s records exposed. In fact, breaches related to MOVEit are still being discovered, and it’s likely that more will come to the surface in 2024.  

MOVEit showed just how far-reaching the fallout from security vulnerabilities can be — and how easy it is for threat actors to find vulnerabilities. Each new breach proves that cyberattacks are unavoidable and will often come from the most unexpected places. Breach containment technologies like Zero Trust Segmentation (ZTS) remain the best way to prepare for the next inevitable attack.  

Prediction: "As breaches become part of daily life, cyber resilience will become an industry-recognized metric for all companies to achieve and measure against. Stringent testing and the development of industry-wide metrics to benchmark what 'success' looks like will force organizations to think about their appetite for risk.” – Raghu Nandakumara, Senior Director of Industry Solutions Marketing

During the year, we saw resilience become a more important part of cybersecurity conversations — and even be built into new government legislation and customer requirements.  

This change is likely related to organizations increasingly adopting a Zero Trust security model in 2023. Based on the number of breaches in 2023 alone, the attack surface is ever-expanding and threat actors are getting increasingly sophisticated and targeted. Breaches are ever more catastrophic, with MOVEit’s impact a perfect example.  

Zero Trust says that breach detection, response, and recovery are no longer sufficient — containment is essential — and effective containment begins with an "assume breach" mindset which, in turn, drives a least-privilege approach to building security controls.

Zero Trust promotes resilience, rather than prevention and detection alone, as key to proactively preparing for the next breach.  

Illumio customers including Lion and NIBE saw cyber resilience as a key motivation to implement Zero Trust Segmentation as part of their Zero Trust architecture:

• “After a ransomware attack, you become obsessed with building a more resilient organization. Your top priority is getting ahead of the problem and proactively stopping attackers before they impact your operations or your customers,” said Jamie Rossato, Chief Information Security Officer at Lion
• “We recognized the growing ransomware risk facing manufacturers and wanted to strengthen our defenses.” – Fredrik Olandersson, Network Administrator at NIBE

This Zero Trust approach was also built in to new 2023 cybersecurity legislation:  

• SEC updates to Form 8-K rules: In July 2023, the SEC adopted new rules requiring organizations to disclose cybersecurity incidents in addition to annual information on their cybersecurity risk management, strategy, and governance. These updates reflect the assumption that breaches will inevitably happen and, in response, organizations must be proactive in their security strategy and implementation. The SEC effectively built resilience requirements into their updates.
• U.S. National Cybersecurity Strategy and Implementation Plan: Earlier this year, the Biden Administration released the National Cybersecurity Strategy, followed by the National Cybersecurity Strategy Implementation Plan. These include a strong vision for strengthening the nation’s cyber resilience. In fact, resilience is the key focus of the strategy, with the implementation plan providing much-needed guidance for organizations on improving cyber resilience. While these documents are specifically directed to U.S. federal agencies, their guidance emphasizes resilience strategies for both public and private sector organizations worldwide.  
• CISA 2023-2025 Strategic Plan: CISA, the U.S. Cybersecurity and Infrastructure Security Agency, released their first comprehensive strategic plan for cybersecurity this year. The plan's goal? To reduce risk and build resilience. This shows one of the most important federal agencies for building cybersecurity awareness promoting cyber resilience as the central goal and benchmark for security success.  

Prediction: "As cloud adoption continues to accelerate, we'll see more organizations leverage a lift-and-shift approach, tremendously increasing the attack surface in the cloud. Because of this, in 2023, we could witness an uptick in attacks targeting cloud infrastructure." – Mario Espinoza, Illumio Chief Product Officer

Accelerated by the pandemic era, the cloud has transformed how many organizations operate, offering convenience, flexibility, and scalability. 2023 was no different — more organizations adopted the cloud or accelerated their cloud adoption in 2023.  

According to new research by Vanson Bourne, almost all organizations are using cloud-based services in 2023. But as cloud adoption grows fast, attacks on the cloud have also grown at an alarming rate this year. In fact, 47 percent of breaches in the last year originated in the cloud.

Watch an overview of the report in this video:

Security leaders are aware of these increasing security gaps — 63 percent said their organization’s cloud security isn’t prepared for attacks — and are looking to Zero Trust security strategies to build resilience in the cloud.  

Zero Trust Segmentation (ZTS) is a key pillar of Zero Trust; you cannot achieve Zero Trust without it. The Vanson Bourne report showed that security leaders are turning to ZTS to solve their cloud security challenges:

• 93 percent of IT and security decision makers believe that segmentation of critical assets is a necessary step to secure cloud-based projects.  
• 100 percent of organizations would stand to benefit from proper ZTS implementation.  

Illumio CloudSecure supports the unique challenges organizations face in the public cloud, where visibility and control of the connections between dynamic applications and workloads are critical.  

With CloudSecure, security teams can visualize cloud workload connectivity, apply proactive segmentation controls, and proactively contain attacks on applications and workloads in their public cloud environments, across servers, virtual machines, containers, and serverless computing.    

By extending ZTS to the cloud, security teams can be confident that inevitable cloud attacks will be stopped and contained at their source.  

Learn more about Illumio CloudSecure:

Get started with Illumio Zero Trust Segmentation in the new year. Contact us today for a free demo and consultation.