Executive Summary

Our Sensitive Content Communications Privacy and Compliance Report provides IT, cybersecurity, and risk and compliance leaders with data insights from their peers. The objective is to help you ensure the sensitive content you send and share through various communication channels, such as email, file sharing, managed file transfer, secure file transfer protocol (SFTP), and web forms, is protected. At the same time, this helps ensure your sensitive data shares and sends remain compliant with various data privacy regulations and moreover your communication systems adhere with stringent security standards and validations.

This year’s survey was conducted by Centiment during the February–March 2024 time frame, which consisted of 33 questions on a variety of different topics related to data security, privacy, and compliance. Some of the questions are “blasts from the past”—repeats from the surveys conducted in one or both of the previous two years—while others were added to capture details on new trends. A total of 572 survey responses were received from IT, cybersecurity, and risk and compliance leaders in North America, Europe, Middle East, and Africa (EMEA), and the Asia-Pacific regions.

Some of the questions we asked to pinpoint trends and facilitate insights included:

• How the number of communication tools affect risk management
• The ongoing impact of data breaches on litigation costs
• What data types pose the greatest risk and why
• How regulatory compliance and security standards are driving better data protection by creating baseline security standards and more comprehensive data privacy regulations
• How advanced security capabilities in communication tools translate into lower risk
• Why and how legacy and inadequate approaches to sensitive content communications create inefficiencies and incur greater privacy and compliance risks

Introduction

Welcome to the third annual Kiteworks Sensitive Content Communications Report! This is where we conduct an in-depth survey on how well organizations are doing in protecting the privacy and security of their sensitive content and complying with data privacy regulations and security standards.

We use the term “sensitive content” to refer to a wide variety of content types that are targets of malicious actors—and pose significant risk to a legitimate organization if these bad actors get their hands on them. It is what is compromised when all-too-frequent news headlines contain the term “data breach.” Sensitive content contains the data of customers and employees—personally identifiable information (PII), protected health information (PHI), and payment card industry (PCI) data. It also includes an organization’s intellectual property (IP), legal communications and documents, financials, mergers and acquisitions data, and other types of private and confidential information.

Security Risks

From a security perspective, the problem with sensitive content is that it does not stay in one place. During daily operations, it is shared among employees but also between employees and partners, suppliers, contractors, legal counsel, accountants, auditors, and more. For organizations to move forward, this information must move in a frictionless way between the organization and thousands of third parties. And as we will see, this occurs over multiple communication channels.

As a result, organizations must protect their content—not only where it is stored but also as it travels through various communication channels to third parties. Unfortunately, in recent years, cybercriminals discovered vulnerabilities in the software supply chain give them access to hundreds or even thousands of organizations and millions of sensitive data files. This year’s Data Breach Investigations Report (DBIR) by Verizon corroborates this trend, revealing a year-over-year 180% increase in software vulnerability exploits and revelation that software supply chain data breaches jumped 68% year over year—comprising 15% of all data breaches.¹ Last year’s Clop ransomware attacks on Progress Software’s MOVEit² and Forta’s GoAnywhere³ managed file transfer (MFT) solutions demonstrate the risk.

AI Cyber Risks

In addition to protecting content communication channels, enterprises and government entities have another increasingly urgent priority that has grown over the past 18 months. As artificial intelligence (AI) explodes in both technical advancement and popular use, it is critical that they keep their sensitive content out of large public language models (LLMs) that may now be routinely used by their employees and partners.

According to Gartner, the top three risk-related concerns about the usage of GenAI LLMs include access to sensitive data by third parties (nearly half of cybersecurity leaders), GenAI application and data breaches (40% of respondents), and erroneous decision-making (over one-third).⁴ The risks associated with employees placing sensitive data into GenAI tools is real. Nearly one-third of employees in a survey completed late last year admitted to placing sensitive data into public GenAI tools. Unsurprisingly, 39% of respondents in the same study cited the potential leak of sensitive data as a top risk to their organization’s use of public GenAI tools.⁵

At the same time, lower barriers to entry that have brought AI use to the masses have also opened doors to less sophisticated cybercriminals to launch increasingly complex attacks.⁶ It adds to the sense that nation-state threat actors and cybercriminals are in an escalating “arms race” with legitimate organizations—with what could be existential implications.

Compliance Risks

Unless your company does business in a single jurisdiction, the difficult thing about regulatory data privacy compliance is the patchwork of requirements from place to place—which adds to the complexity and cost of being compliant—and documenting that compliance. The rise in new regulations and evolution in existing ones prompted 93% of organizations to rethink their cybersecurity strategy in the past year.⁷ The European Union’s General Data Protection Regulation (GDPR), implemented in 2018, unified its 27 member states under a single data privacy standard.

For the rest of the world, things are not that simple. United Nations data shows that 137 out of the world’s 194 countries now have data privacy laws—but they naturally vary greatly.⁸ In the United States, the most stringent federal legislation is the Health Insurance Portability and Accountability Act (HIPAA)—which covers PHI but not PII. With Congress unable to pass a national standard, individual states have stepped into the fray—starting with the passage of the California Consumer Privacy Act (CCPA) in 2018. Since then, an additional 17 states have enacted comprehensive data privacy laws—with legislation moving through the process in an additional 10.⁹ While it is good that more U.S. citizens and residents are being protected by such laws, it exacerbates the patchwork for those who need to comply.

The different bodies managing these data privacy regulations continue to apply pressure on organizations to comply. Fines and penalties for GDPR noncompliance in 2023 hit $2.269 billion (€2.1 billion)—exceeding the fines and penalties issued in 2019, 2020, and 2021 combined.¹⁰ The amount per fine and penalty is spiraling upwards as well; $4.75 million (€4.4 million) per violation last year compared to $540,000 (€500,000) per violation in 2019. Fines and penalties behind HIPAA are just as daunting, hitting $4.176 billion last year.¹¹

In addition to data privacy regulations, cybersecurity standards and rules have been a key focus area for governmental and oversight bodies. Some of the major new cybersecurity regulations introduced in the past year include the SEC’s Cybersecurity Risk Management and Incident Disclosure rules for public companies, Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), the Cyber Resilience Act (CRA) and Digital Operational Resilience Act (DORA) in Europe, and the National Institute of Standards & Technology (NIST) Cybersecurity Framework (CSF) 2.0, among others.

Human Risks

The human risk element in data security and compliance remains a serious problem and the cause behind many sensitive data breaches. The DBIR found that end-users account for 68% of errors leading to breaches.¹² This occurs in various ways, including employees and third parties sending sensitive information to the wrong recipients, failing to properly secure data, or falling victim to social engineering attacks like business email compromise and phishing. Lack of visibility and governance around sensitive content communications is a leading factor, in addition to deficient security infrastructure and controls.

Methodology for This Study

This year’s Kiteworks Sensitive Content Communications Report is based on a comprehensive survey of 572 professionals working in IT, cybersecurity, and risk and compliance management at organizations with more than 1,000 employees. Our analysis reports on respondent feedback for the overall cohort, compare it with our survey results from 2023 and 2022, and cross-analyze it according to various demographic details.

Diverse Pool of Respondents

Respondents come from eight countries globally, with representation from North America (34%), Asia-Pacific (18%), and Europe-Middle East-Africa regions (48%) (Figures 1 and 2). They represent a broad range of enterprise-level company sizes, with 54% having between 1,000 and 10,000 employees and 46% having more than that (Figure 3).

The cohort comes from a wide range of industries, with security and defense (15%), manufacturing (12%), healthcare (12%), and financial services (12%) organizations seeing the highest representation (Figure 4). More than two in 10 participants (22%) work in government or education, while one-quarter work in financial, legal, and professional fields and 10% work in the energy industry.

In terms of job function, the survey pool includes professionals at different levels in their organizations, with 31% in executive positions and 69% in mid-level management roles (Figure 5). And they are split between the risk and compliance (26%), IT (42%), and security (31%) functions.

Data Types and Classification

Insight: Unable to Track and Control All Their Data Exchanges

An already exponential growth in data accelerated further over the past 18 months with the adoption of generation AI (GenAI) large language models (LLMs). When content leaves an application such as email, file sharing, SFTP, managed file transfer, or web forms, it is important that organizations can track and control access to that content.

Organizations need to understand their data types, where it resides, and where it is being sent and shared. To identify which unstructured data should be controlled, it is necessary for a classification system to be in place. When asked how much of their unstructured data is tagged or classified, less than half of respondents (48%) claim that this is the case for 75% or more of their data (Figure 14). Among industries, 65% have achieved this level in healthcare, 56% in financial services, and 55% in legal (Figure 15).

Notwithstanding, organizations indicated not all unstructured data needs to be tagged and classified. 40% of organizations said 60% or more of unstructured data needs to be tagged and classified. And the larger an organization, the more unstructured data needs to be tagged and classified. For example, those with more than 30,001 employees expressed such: 15% indicated all data needs to be tagged and classified, and another 20% said over 80% needs to be tagged and classified (Figure 16). Regionally, more North American respondents said it must be tagged and classified; 10% said all unstructured data must be tagged and classified and another 16% noted 80% or more (Figure 17). Federal government respondents said all data must be tagged and classified in the highest number (24%), with 17% more saying 80% or more must be tagged and classified (Figure 18).

Assessing the Risks of Data Types

As delineated above, sensitive content exists in different forms across organizations. Each does not pose the same level of data breach risk. Per IBM’s annual cost of a data breach study, PII is the costliest and most common record compromised. PII was also the most breached record type in 2023, comprising 52% of all data breaches, a spot it also claimed the prior two years.¹⁵ IBM’s findings align with those in the latest DBIR, where 50% of all data breaches were tied back to PII.

When this is overlaid against our respondent rankings, there are variances. For example, based on the research data from IBM and Verizon, one would assume respondents would cite PII as their top content type concern. But that was not the case. Instead, they named financial documents (55%), intellectual property (44%), and legal communications (44%) as their top three concerns (Figure 19).

Some corroboration of the IBM and Verizon data was found in our cross-analysis of PHI, where those who pinpointed it as one of their three data type concerns experienced a higher rate of malicious data breaches than those who ranked other data types. For example, 43% of those who ranked PHI in their top three data type concerns said they experienced over seven data breaches (in contrast with the 32% across all respondents who reported seven or more breaches) (Figure 20). The second data type with the highest rate of data breaches was IP (35% said they experienced seven-plus data breaches).

Strikingly, half of all North American respondents named GenAI LLMs as a top-three concern, ranking behind financial documents (Figure 21). By industry, LLMs are an especially big concern in oil and gas (62%), pharmaceuticals (61%), federal (61%) and state government (58%), and law firms (58%).

There is substantial variance across data types and industries as to which one is considered the highest risk:

• GenAI LLMs were selected most often by energy and utilities firms and security and defense sector firms at 50%.
• PII was cited most often by higher education firms at 50%.
• PHI was cited most often by healthcare at 58%.
• CUI and FCI were cited most frequently by manufacturers at 79%.
• Legal communications were cited most often by oil and gas companies (62%) and federal government agencies (61%).
• Merger and acquisition details were identified most often by pharmaceutical and life sciences firms (40%).

Cybersecurity and Risk Management

Insight: Protecting Sensitive Content Communications Remains a Big Challenge

For the security team, sensitive content is at the center of what they need to protect in their corporate IT systems. And the 2024 respondents to our survey are much less likely to claim that no improvement is needed in their management of content security than their 2023 counterparts (Figure 40). Only 11% made that claim this year, but the percentage that said significant improvement is needed also declined. This leaves more than half (56%) who say that some improvement is needed. We can perhaps take heart that organizations are making some progress—while being more realistic about the need for further improvement.

But these percentages were not uniform across the different groups. 30% or more respondents in Saudi Arabia, the United Arab Emirates, North America, and Asia-Pacific indicated significant improvements are needed (Figure 41). The same is true of professional services (47%), financial services (43%), oil and gas (42%), federal government (41%), manufacturing (36%), and healthcare (34%) (Figures 42 and 43).

Progress Toward Zero Trust

Zero trust in organizations reflects a significant adoption and integration across various security layers. Zero-trust principles at the network layer are being enforced through microsegmentation and strict access controls to minimize the lateral movement of threats. Endpoint security under zero trust involves deploying advanced threat protection and endpoint detection and response (EDR) solutions to ensure all devices accessing the network are continuously authenticated and monitored. For identity and access management, multi-factor authentication (MFA) and privileged access management (PAM) are critical components, ensuring that user access is tightly controlled and continuously verified. At the content layer, organizations are implementing data encryption and real-time monitoring to secure sensitive information. Despite organizations prioritizing zero trust, nearly half (48%) report difficulties integrating zero trust across both on-premises and cloud environments.¹⁹

Our interest for this report obviously focuses on the content security layer (Figure 44). Our first observation is the regrettable 45% of companies that have not yet achieved zero trust with content security. Second, there are some demographic areas where performance was even worse. Only 35% of U.K. respondents met this benchmark and 39% in both the Middle East and Asia-Pacific (Figure 45). By industry, state government (21%), oil and gas (33%), and pharmaceuticals and life sciences (39%) are lagging on zero trust protection for content (Figure 46).

Advancing Security to Protect Sensitive Content

For organizations that admitted they do not use advanced security capabilities for sensitive content communications, a much higher percentage (36%) indicated they do not know how many data breaches affected their organizations—compared to those who said they employ advanced security for some content communications or all content communications (8% respectively for both) (Figure 47). This reveals a serious risk gap. Across industry segments, findings highlight the biggest challenges in legal (55% use them for some or none), local government (50%), federal government (48%), and healthcare (44%). These contrast with the 41% from the global cohort that do so. Strongest industry performers include professional services (71% use them for all), state government (71%), and higher education (65%) (Figure 48).

Tracking, Classifying, and Controlling Sensitive Content Access

When content leaves an application such as email, file sharing, SFTP, managed file transfer, or web forms, it is important that organizations can track and control access to that content. While only 16% of respondents can do this every time, 45% indicated they can do so around three-quarters of the time (Figure 49). This percentage is better for certain segments—70% for North America, 79% for manufacturing, and 73% in healthcare (Figures 50 and 51). On the flip side, higher education (31%) and oil and gas (34%) fared worse.

To identify which unstructured data should be controlled, it is necessary for a classification system to be in place. When asked how much of their unstructured data is tagged or classified, less than half of respondents (48%) claim that this is the case for 75% or more of their data (Figure 14). Things are slightly better in North America, where 56% have achieved this (Figure 52). Among industries, 65% have achieved this level in healthcare, 56% in financial services, and 55% in legal (Figure 53).

Using Security Tools for Sensitive Content

All enterprises have multiple security tools that they use across their networks, endpoints, and cloud applications. Whether these are used to protect internal and external sensitive content communications is another question.

When asked whether they use capabilities like multi-factor authentication, encryption, and governance tracking and controls for such communications, results are mixed (Figure 54). Nearly six in 10 (59%) say these protections are always in place for external sensitive content communications. Almost everyone else says that they are in place some of the time. North American respondents have the highest security posture, with 67% reporting they do so all the time versus 57% for Asia-Pacific and 53% for EMEA respondents.

Maturity of measuring and managing sensitive content communications security remains a key focus area for organizations: only 11% indicated no improvement is needed compared to 26% in last year’s survey (Figure 55). A higher percentage of organizations this year noted some improvement is needed (56% to 37% in last year’s survey).

While the numbers were the same for the whole cohort, there were interesting differences when the question is analyzed by different groups. For internal communications, 71% of state government and professional services both said they always use these tools (Figure 56). Two-thirds (67%) of North American respondents said the same, while only 53% did so in EMEA (but 63% in the U.K.) (Figure 57). Interestingly, law firms (45%) did the worst with internal communications. For external communications, pharmaceuticals and life sciences (78%) and higher education (72%) were high performers, as were North American organizations (69%) (Figure 56).

Conclusion

Findings from this year’s Sensitive Content Communications Privacy and Compliance Report underscore the critical need for organizations to take proactive measures in safeguarding their sensitive content. One key takeaway is to consolidate communication tools onto a single platform. By reducing the number of disparate tools used for content communication, organizations can significantly lower the risk of data breaches and improve operational efficiency. Specifically, organizations with fewer communication tools experience fewer breaches, indicating a correlation between tool consolidation and enhanced security.

The report also emphasizes the substantial risks associated with untagged and unclassified data. Organizations that fail to implement robust data tagging and classification systems are at a higher risk of data breaches, as they lack the necessary visibility and control over their sensitive content. The exponential growth of data, further accelerated by the adoption of GenAI, makes it imperative for organizations to prioritize data classification to mitigate these risks effectively.

Implementing zero-trust principles and advanced security capabilities are critical for enhancing sensitive content communications security. Report findings highlight significant security gaps and the need for strict content-defined zero trust that includes attribute-based access controls, comprehensive encryption, real-time monitoring, and data loss prevention. As our findings show, certain industry segments and regions and countries have larger gaps than others.

The data also highlights significant risks associated with sensitive content exchanges with third parties: the more third parties with which respondents send and share sensitive content, the more data breaches and higher litigation costs they experience. As a result, organizations must ensure they have comprehensive governance tracking and controls as well as advanced security capabilities in place to mitigate third-party risks.

On that note, a final comment is worth including on the cost of data breaches, particularly that connected with litigation. This year’s survey revealed that many organizations incur significant legal costs that are often not accounted for in traditional breach cost estimations. Damaged brand reputation, lost revenue, and disrupted operations are only one aspect resulting from data breaches. Compliance fines and penalties as well as extended litigation costs often have a long-tail effect felt over extended time frames. This underscores the importance of vetting and selecting sensitive content communication tools that adhere to security standards like FedRAMP, ISO 27001, SOC 2 Type II, NIST CSF 2.0, and others.