More than 5-in-10 organisations in SEA still use outdated, unpatched software

While vulnerabilities are inevitable in any software, regular patching and updates can minimize the risk of exploitation. That’s why users are always advised to install the latest software versions as soon as they are available, even if these updates can sometimes be difficult or a time-consuming task for organizations.

However, a fresh study from Kaspersky revealed more than half (54%) of organisations in Southeast Asia (SEA) have work to do regarding this crucial task. The recent Kaspersky report, ‘How businesses can minimize the cost of a data breach’ showed that 38% of SMBs (small and medium businesses) and a whopping 48% of enterprises from SEA are still working with unpatched operation systems.

Besides, 33% of SMBs and 43% of enterprises from the region are still guilty of using out-of-date software.

SMBs in SEA can also save 9% of the attack costs if they use updated and legal software, with $94k being the toll of a single data breach against a small-to-medium-sized organisation with obsolete operating systems.

Aside from the additional cost in case of a data breach, almost half (49%) of both SMBs and enterprises from the region also admitted to experiencing cyberattacks because of unpatched vulnerabilities in the software applications and devices they use. This is nine percent more than the global average of 40%.

The top reasons why organisations in SEA remain guilty of using such tools are,

Some line employees refuse to work with new software and devices, so we made an exception for them (57%)
We have in-house apps that cannot run on new devices or operating systems (52%)
They belong to C-level staff and we exclude them from our update plan (45%)
We don’t have enough resources to update everything at once (17%)

To save money and minimize the risk of data breaches as a result of software vulnerabilities, Kaspersky suggests the following measures,

Ensure the organization is using the latest version of its chosen operating systems and applications, with auto-update features, enabled so that the software is always up to date.
If it is not possible to update software then organizations are advised to address this attack vector through a smart separation of vulnerable nodes from the rest of the network, along with other measures.
Enable the vulnerability assessment and patch management feature in an endpoint protection solution. This can automatically eliminate vulnerabilities in infrastructure software, proactively patch them and download essential software updates.
It is important to boost security awareness and practical cybersecurity skills for IT managers, as they are at the frontline of IT infrastructure updates. A dedicated Security for IT Online training course can help.
For critical IT or operational technology systems, it is important to always be protected regardless of any available software updates. This means they should only enable activity that is predetermined by the purpose of the systems.