Cyberattacks Frequently Spread Beyond Initial Breach Point

"Eighty-six percent of distributed enterprises experienced a cyberattack in the past 12 months," according to research released by VikingCloud.

Attacks commonly spread beyond the initial system

VikingCloud's research found that among distributed enterprises that were hit, 77% reported that the incident moved beyond where it began — reaching other brand locations, corporate systems, or shared vendor relationships. The finding frames these incidents less as contained compromises and more as multi-site or multi-domain events that can affect franchises, headquarters functions, and third-party relationships alike.

Franchise networks without unified standards see the greatest spread

The study drilled into organizations where independent franchisees operate some or most sites and found a sharp difference tied to corporate policy. Where corporate does not set a unified security standard, attacks spread in 89% of cases. Where the corporate entity mandates a single security standard, spread occurred in 64% of cases. Yet only 51% of surveyed organizations mandate one security standard across every location today; the remainder operate with fragmentation — 33% give individual locations discretion in how they apply corporate guidelines, and 15% let each location set its own cybersecurity policy independently.

Formal policies are nearly universal, but technology adoption is uneven

Nearly all enterprises (98%) report having a formal cybersecurity policy that covers their location footprint. That ubiquity of formal policy, however, sits alongside modest current technology adoption: the average organization in the research has 5.6 of the 13 security technologies measured. Respondents expect to increase that footprint substantially, planning to nearly double their technology investment to 11 of the 13 tools over the next 12 months.

Confidence among leaders runs high despite exposure

Despite the high incidence of attacks and frequent spread, 83% of cybersecurity leaders describe themselves as confident or very confident in their organization's security posture. That confidence coexists with the study's other data points — widespread policy coverage, gaps in mandated standards across locations, and a low current average of implemented security technologies — presenting a contrast between perceived readiness and indicators of operational fragmentation and limited tooling.

What this means for technologists, procurement leaders, and franchise operators

• Technologists and security teams: The numbers point to the operational consequence of inconsistent standards — networks where corporate does not mandate one standard experienced substantially higher spread (89%). Teams will likely focus on enforcing or harmonizing configurations and controls across sites to reduce lateral movement inside a brand footprint.
• Procurement leaders: With organizations planning to increase the count of security technologies from an average of 5.6 to 11 of 13 measured tools in the next 12 months, procurement will be a central actor in converting stated policy into deployed capability.
• Franchise operators and local managers: The research highlights that when local sites retain policy discretion or independence (33% and 15% respectively), the overall risk profile for the brand is higher; local decisions about security implementation appear to correlate with wider spread in incident outcomes.

The VikingCloud findings sketch a simple but consequential dynamic: formal policies are nearly universal and investment intentions are strong, yet fragmentation of standards across location footprints and limited current tooling create pathways for incidents to propagate. Whether planned investments and a push toward unified standards will translate into fewer multi-site compromises will be the critical test in the next 12 months.

Original story