The single biggest drop in risk assessment this year is web applications, which fell 18 points from 80% (B-) in 2016 to 62% (D-) in 2017. The ability to access these services online and from mobile phones puts them right at users’ fingertips, but also creates new security challenges. “If application-centric security is the future, we have a long way to go,” the scorecard report said.

The assurance reports card revealed the constantly evolving and multiplying threat landscape — cited for the second year in a row as the number one challenge for security pros — heightened technological complexity and creating even more opportunity for attackers to exploit gaps in security coverage. This leaves all organizations vulnerable to compromise and breach, regardless of the size of their security investments.

The report found accelerated adoption of cloud and mobile computing, combined with the emergence of DevOps, where software teams collaborate through increased consistency and automation practices, and containerization platforms, virtualization methods used to accelerate innovation cycles and reduce time-to-market, increased the complexity and decentralization of enterprise IT. This makes it harder for security teams to see everything on their networks and accurately assess cyberrisks.

Additional concerns centered on low-security awareness among employees and the lack of network visibility, particularly in the use of bring-your-own-devices and shadow IT, technology used inside organizations without explicit authorization.

The U.S. grade dropped from a B- in 2016 to a C+, indicating less confidence when it comes to cybersecurity assurance. Although the overall score in the U.S. dropped by two points, it is still well above the 70% global average. When it comes to security assurance in the U.S., the highest grades achieved were for measuring security effectiveness (A-) and conveying risks to executives and the board (B+). However, the U.S. showed poor performance when it comes to being able to assess the risk of newer technologies such as containerization platforms (F), and DevOps (D) and IT security pros admit they still don’t have a handle on managing the risks associated with mobile devices (D).

Other key global findings:

• Cloud software as a service and infrastructure as a service were two of the lowest scoring risk assessment areas in the 2016 report. For the 2017 survey those new cloud environments, combined with platform as a service component, scored 60% (D-), a seven-point drop compared to last year’s average for IaaS and SaaS.
• Risk assessment for mobile devices, identified alongside IaaS and SaaS in last year’s report as one of the biggest enterprise security weaknesses, dropped eight points from 65% (D) to 57% (F).