Dive Brief: 

• Enterprises that proactively refresh their technology and maintain modern IT security infrastructures can avoid major security incidents by staying one step ahead of bad actors, according to a new report from Cisco. More than 4,800 active IT, security and privacy professionals in 25 countries were surveyed by YouGov, which was contracted by Cisco to conduct the 2021 Security Outcomes Study. The Cyentia Institute conducted an independent analysis of the survey results on behalf of Cisco.
• Companies that allowed their security technology to remain stagnant found themselves vulnerable to data breaches and other security problems, the report shows. 
• Enterprises with a "best-of-breed" technology refresh strategy were 12.7% more likely to report success in their overall security strategies. Other important factors included having a well-integrated technology stack, helping companies recruit and retain the best security talent.

Dive Insight: 

The report takes a deep dive into the security practices of major companies in a bid to help capture which practices lead to the best outcomes. IT and security experts are asked about 11 high level security outcomes that are organized under three top objectives: enabling the business, managing risk and operating an efficient organization.

"Those companies that reported doing proactive refreshes of their technology also reported high levels of success in a wide variety of security outcomes," Wendy Nather, Advisory CISO at Cisco told Cybersecurity Dive in an email. 

The study did not examine which particular technologies enterprises were actually refreshing, so that would be an excellent jumping off point for additional research, Nather said. One might ask whether refreshing certain types of IT or security infrastructure matter more than other types. 

"For example, do you see better outcomes when you refresh user devices or when you keep databases up to date?" she asked. "How does upgrading from one operating system to another differ from simply keeping up with patches in the current version?"

Companies need to use after-action reports as an effective way to recover from major data breaches and avoid repeating the same mistakes in the future, according to the report. 

"When it's done right, an after-action report can identify problems with knowledge, procedures, technology and business roles," Nather said. "Addressing those issues can not only prevent the breach from happening again but also improve response time and lower costs overall."