CIOs feel they are losing the cyber war, naming end users and more sophisticated hackers as key factors.

The study, carried out by Vanson Bourne, surveyed 400 CIOs from large enterprises in the US, the UK and Germany, with most respondents claiming that the industry is losing the battle against cybercriminals.

The most significant results from the study, found that 60% of CIOs surveyed felt they are losing the battle against cybercrime.

85% said that end users – human beings – are the weakest link in security, ignoring or forgetting the education, policies and procedures enterprises have put in place to prevent risky behaviour.

It also revealed a lack of faith in current security tools, as 68% believe that because attackers have become more sophisticated, endpoint security tools are less effective

>See also: The cyber security industry is losing the cyber war

“It’s no wonder so many CIOs feel they are on the losing side of the battle against cybercrime; the detect-to-protect approach is the moral equivalent of sending SOC teams into a gunfight with a knife,” explained Gregory Webb, Bromium CEO.

“We need to accept that it’s unfair and futile to put the onus on users to defend the enterprise; prohibition is not the way. HR needs to be able to open attachments, a marketer needs to look at social media without having to worry; it is simply impractical to lock people down or expect them to be the last line of defence.”

The lack of faith and vulnerability to attack are symptomatic of the prohibition-based ‘detect-to-protect’ approach to security that companies been following to date.

The problem will never be solved if businesses maintains the same practice. Hackers are evolving and so must organisations. A new approach is needed.

To this end, Bromium has today launched it’s Secure Platform, which, according to Bromium, fundamentally changes the rules of cyber security so that insecure behaviour doesn’t matter anymore – you can just let malware run.

With CPU-enforced micro-virtualisation on endpoint devices, any malware that launches is trapped in a completely isolated environment, so end-users can open as many nefarious email attachments or click on as many suspicious web pages as they want, without creating any risk to security.

Allowing malware to run also enables security teams to watch what it does and gather threat intelligence, so they can scan the rest of their environment for tell-tale signs that it is present elsewhere.

>See also: It’s war: the cyber arms race

“Like the war on drugs, despite all the resources focused on user education and behaviour modification, cybercrime continues to grow. That’s because trying to control user behaviour is futile,” explains Simon Crosby, co-founder and Bromium CTO.

“We have to accept changing human behavior isn’t the answer. Outsmarting the bad guys is and virtualisation-based security is where to start. It allows us to protect and enable – rather than blame – the biggest threat and greatest asset our companies have – people.”

“Even polymorphic threats that are currently missed by detect-to-protect solutions, from traditional and next-generation AV through to the latest EDR, are isolated with our platform.. It’s time to stop slowing innovation and let your end users work freely and productively without companies being afraid of getting owned.”

It is a valid point: malicious data will always get through in some way or another. Perhaps this method of containment will help even the field in the cyber war.