---
title: Are Threat Actors Winning the Cybersecurity Arms Race?
description: Even though spending on cybersecurity solutions has increased exponentially, the damage done by cybercrime has not diminished. It's almost as if threat actors are winning the cybersecurity arms race.
image: https://www.morphisec.com/hubfs/Threat%20Actors%20Winning%20Cybersecurity.png
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# Are Threat Actors Winning the Cybersecurity Arms Race?

Posted by [Daniel Petrillo](https://1534169.hs-sites.com/author/daniel-petrillo) on March 18, 2021

- [Tweet](https://twitter.com/share)

![Threat Actors Winning Cybersecurity](https://www.morphisec.com/hubfs/Threat%20Actors%20Winning%20Cybersecurity.png)Ever since the [Morris Worm](https://www.fbi.gov/news/stories/morris-worm-30-years-since-first-major-attack-on-internet-110218) infected 10 percent of internet-connected computers in 1988, endpoint security has become a critical asset for organizations and endpoints themselves a top target for threat actors. However, in recent years, the arms race between cybercriminals and businesses has reached a fever pitch. Even though spending on cybersecurity solutions has increased exponentially, the damage done by cybercrime has not diminished. Estimates now show that by 2025 global cybercrime will cost [over $10 trillion per year](https://cybersecurityventures.com/hackerpocalypse-cybercrime-report-2016/) — equivalent to half the United States' current GDP. 

While an increasingly digitized world raises the stakes for cyberattacks, another key driver of this rising cost is the proliferation of devastating ransomware. The most frequently used tool for cybercriminals right now, ransomware attacks happen every 11 seconds. As of this year, the average ransom payment has also [increased by 57 times since 2015](https://www.rpc.senate.gov/policy-papers/the-threat-of-ransomware). However, while the damage that cyberattacks pose to organizations is growing, enterprises also have access to a greater variety of "next-generation" solutions than ever before. With that in mind, it's worth asking why it looks like cybercriminals are gaining the upper hand.

## The Problem with Modern Cybersecurity

The increasing danger posed by cyberattacks is partly due to the continued use of outdated cybersecurity approaches. Traditionally, cybersecurity has been built on a perimeter-based and fragmented approach. In the increasingly borderless digital environment where modern enterprises operate, this approach is ineffective. 

Threat actors have learned to seek out and exploit both fragmented security stacks and misconfigured server environments to bypass enterprise firewalls and propagate malware and ransomware. Accordingly, cloud infrastructure misconfigurations alone have been responsible for [more than 30 billion](https://www.technewsworld.com/story/87018.html) record leaks in the recent past. Most enterprises find out too late that many of their security solutions do not protect them against fileless attacks and in-memory exploits that propagate laterally across their networks. 

On the other hand, relying on siloing important assets also doesn't work. As illustrated by the [Stuxnet virus's dramatic success](https://spectrum.ieee.org/telecom/security/the-real-story-of-stuxnet) in 2010, no system, no matter how critical, can be hermetically sealed from threats. With everything from cars to medical devices now forming potential endpoints, IoT devices have also opened up [new attack vectors](https://www.prnewswire.com/news-releases/evolution-of-iot-attacks-study-exposes-the-arms-race-between-cybercriminals-and-cybersecurity-301066116.html) for cybercriminals. While the pandemic has undoubtedly highlighted the importance of endpoint security for this growing target area, protection solutions are often too heavy or opaque for modern enterprise environments. Meanwhile, the human element of endpoint security [remains underappreciated](https://securityboulevard.com/2021/02/ciso-talk-the-human-side-of-cybersecurity/).

## Cyberattack Innovation Continues Its Acceleration

While cracks in enterprise defenses continue to expand, cybercriminals are rapidly innovating. Previously the reserve of criminal gangs with a high level of technical savvy, ransomware-as-a-service has made high-end ransomware easily accessible. [Ransomware strains](https://intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/) such as DoppelPaymer can now be "licensed" by affiliates in return for a percentage payment of their ill-gotten gains. [![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/c7b2a274-35d7-4a6f-893f-4c3314722220.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/c7b2a274-35d7-4a6f-893f-4c3314722220)

Threat actors are also on track to leverage developments in machine learning technology. Far from a dystopian science fiction story, the prospect [of self-learning phishing scams](https://www.zdnet.com/article/ai-is-changing-everything-about-cybersecurity-for-better-and-for-worse-heres-what-you-need-to-know/) and AI-powered ransomware attacks is unnervingly close to becoming a reality. The combination of intelligent targeting, where machine learning algorithms change out words until they find the most effective combination for phishing emails, and intelligent evasion designed to make it easier to bypass detection-centric tools is a powerful risk that could easily overwhelm even the savviest defenders.

Further, the proliferation of [state-sponsored cybercrime](https://www.helpnetsecurity.com/2021/02/24/state-sponsored-cyberattacks/) means that while many businesses face increasing danger from persistent threats, more virulent ransomware strains are filtering down into the hands of profit-driven cybercriminals. The privateering nature of highly capable gangs such as Evil Corp, who recently conducted a [massive ransomware attack](https://home.treasury.gov/news/press-releases/sm845) on Garmin, also shows how the line between state sponsorship and profit-driven opportunism is blurring.

## Companies Need to Adopt a Proactive Approach to Reduce Their Cybersecurity Risks

To counter the growing capability of threat actors, the cybersecurity industry presents endless opportunities for organizations to deploy more complex collections of solutions. Regrettably, the cybersecurity industry is rife with marketing jargon where real security is needed. While solutions that use buzzwords such as "next generation" or "[machine learning](https://1534169.hs-sites.com/machine-learning-cant-protect-you-from-fileless-attacks)" sound innovative, they ultimately [fail to protect](https://1534169.hs-sites.com/artificial-intelligence-for-security-real-limitations) against the growing number of unknown, evasive attacks.

The only reliable way for organizations to counter increasingly capable adversaries is to refocus on what works. A less diverse array of effective solutions is a far better bet when it comes to solutions stacks. At the same time, more effort and investment need to be directed towards protecting the endpoints where ransomware can gain a beachhead in the first place. This concept means improving cyber hygiene through proactive measures such as device hardening and privilege restriction while working towards a zero-trust approach propagated throughout the enterprise.

Only [29 percent of information security professionals](https://www.globenewswire.com/news-release/2021/02/08/2171365/0/en/Proofpoint-s-State-of-the-Phish-Report-Reveals-Ransomware-and-Phishing-Attack-Trends-Underscores-Need-for-Tailored-Security-Awareness-Training-Particularly-for-Remote-Workers.html) in a recent InfoSec survey reported training employees on safe remote working practices. Unfortunately, this finding highlights the inherent weakness in many enterprises — its people. It's vital to remember that employees are frequently the [weakest link](https://www.enzoic.com/employee-cybersecurity-weak-link/) in any security posture. The key to shoring up this critical security weak point is up-to-date training and resources that help individuals spot and avoid phishing attacks and social engineering scams that allow most attacks access to your network. 

## Final Thoughts

Instead of responding to malicious actors' growing capability by loading up on increasingly complex solutions stacks, enterprises should leverage a [proactive cyber defense](https://1534169.hs-sites.com/what-is-proactive-cyber-defense) strategy. While the key to this approach is making security an inherent operational asset, refining the enterprise security stack is also vital. Taking a proactive approach, rather than a reactive one of responding to threats once they’ve breached critical systems, enables even the most resource-constrained teams with a reduced attack surface and lowered risk of attack.  

To achieve a simple and effective security solution stack that offers protection from known and unknown threats, you leverage a [deterministic solution like Morphisec](https://www.morphisec.com/ransomware-protection) Guard that enhances visibility into and control over the OS-native security tools inherent in Microsoft Windows 10. Bolstered with a more effective security posture, enterprises shouldn't lose hope. Even if cyber criminals may win the battle, there is no reason they should win the war. 

[![morphisec-guard-save-20-percent-off-what-you-are-paying-for-antivirus](https://no-cache.hubspot.com/cta/default/1534169/836bec48-092e-47c3-a17a-7cfb4b6c15cb.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/836bec48-092e-47c3-a17a-7cfb4b6c15cb)

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/are-threat-actors-winning-the-cybersecurity-arms-race#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Daniel Petrillo",
    "url" : "https://1534169.hs-sites.com/author/daniel-petrillo"
  },
  "dateModified" : "2021-04-09T09:55:02.234Z",
  "datePublished" : "2021-03-18T12:00:00.000Z",
  "headline" : "Are Threat Actors Winning the Cybersecurity Arms Race?",
  "image" : [ "https://www.morphisec.com/hubfs/Threat%20Actors%20Winning%20Cybersecurity.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/are-threat-actors-winning-the-cybersecurity-arms-race",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```