Company Cybersecurity System: Assessment, Risks and Expectations

Abstract

Abstract The consequences of Industry 4.0 have adverse side effects on cybercrime growth, which requires creating an effective cybersecurity system for companies. Therefore, this study aims to develop a composite indicator of company cybersecurity to assess its development needs. For this purpose, the authors modified Porter’s method by constructing a superposition matrix based on the growth rates of cyber threats and risks, calculating their quantitative characteristics and a composite indicator. The computations are based on indicators for 2016-2022 characterizing cybersecurity vulnerabilities and the consequences of cyber threats: the share of companies experiencing one, six or more successful cyberattacks, considering the likely and very likely success of cyberattacks on them in the next 12 months, security threat and concern indices, the share of companies with a growing security budget affected by ransomware and experiencing a shortage of skilled IT security personnel, the cost of stolen or compromised credentials. As a result, cybersecurity needs increased significantly for 2020-2022, mainly due to digital transformation and the cyber threats growth after the COVID-19 pandemic. A comparative analysis of the proposed indicator with those characterizing the development of Industry 4.0 showed that the need for a reliable cybersecurity system is much more important than the active development of modern technologies. Spending on IT is also increasing, but not enough to meet the needs of cybersecurity development, except for the 2022 results. The proposed indicator is defined for companies worldwide, but its versatility allows the methodology to be applied to enterprises of various industries and sizes.