Over a third of organisations across UK critical national infrastructure anticipate a rise in cyber crime as a direct result of the current economic crisis, according to new research, as the impacts of economic hardship are spilling over into the cyber sphere, with employee sabotage, social engineering attacks and reduced cyber budgets emerging as the top threats to security.

Bridewell's Cyber Security in CNI: 2023 research report, which surveyed 500 cyber security decision makers across UK CNI, found that concern is particularly high in the utilities sector – including energy and gas – with 41% of respondents predicting a surge in cyber crime as a result of financial hardship.

With the rising cost of living putting employees under increased financial strain, over a fifth of CNI decision makers polled by Bridewell now rank employee sabotage among the biggest risks to their organisation’s IT environment. The mean number of security incidents relating to employee sabotage has already increased by 62% within CNI over the last 12 months – from 13 instances per organisation to an average of 21.

A third of decision makers also believe that the prevalence of phishing and social engineering attacks will grow due to the economic downturn, suggesting that threat actors could prey on employees’ vulnerabilities and financial fears to gain illicit access to CNI data and systems.

Bridewell CEO Anthony Young commented: “The threat of insider sabotage has always been high across CNI, but current economic pressures are making it easier for criminals to exploit the vulnerabilities of both employees and organisations. Reducing security budgets will exacerbate the issue. Decision makers need to invest in strengthening their cyber defences from the inside out. This should encompass the robust monitoring and testing of systems and access controls, investment in data loss prevention, and the continuous education and training of employees to raise awareness of cyber security best practices.”

These findings reflect a longer-term rise in cyber security risk from insiders (both malicious and negligent) over the past three years, with two-thirds of CNI decision makers reporting an increase in insider threats since 2020.

Share Story: