IBM’s annual X-Force Threat Intelligence Index shows how cyber criminals took full advantage of global uncertainty in 2021, especially in the manufacturing industry

Today, IBM Security released the results of its annual X-Force Threat Intelligence Index. As cyber criminals become increasingly innovative in leveraging global uncertainty, more than ever companies and policy makers need to join forces to share threat intelligence, best practices and improve standardization and innovation to combat cyber threats.

 

By Julian Meyrick, Managing Partner & Vice President, Security Strategy Risk & Compliance, Security Transformation Services Software, IBM Security

 

In 2021 cybercriminals took full advantage of global uncertainty, a weakened supply chain and unpatched vulnerabilities to successfully infiltrate organizations across the globe and make their pay day. IBM’s X-Force Threat Intelligence Index identifies the biggest cyber threats in 2021, and how ransomware and vulnerability exploitations together were able to ‘lock-down’ businesses around the world.

Instead of chasing the money, cyber criminals now chase leverage, all through our supply chains. Last year, manufacturing surpassed the financial industry as the most attacked sector. Manufacturing faced the most attacks in Asia (32%), North America (27%), and Europe (26%), indicating the strategic shift in attackers’ targeting.

With nearly 1 in 2 attacks on manufacturing occurring due to unpatched vulnerabilities, and 2021 also witnessing a 50% increase in disclosed vulnerabilities in Industrial Control Systems, it’s is clear that cyber threats are a growing concern across all industrial sectors.

The Charter Of Trust, a global initiative of leading companies advancing cybersecurity, is calling for both industry and governments to work together and share know-how and best practices, but also to extend operational collaboration to government agencies and other public sector entities.

The need for bringing together the cybersecurity capabilities of public and private sector partners to enhance cyber resilience has never been greater.

Since its inception, the Charter Of Trust has been promoting multilateral efforts in regulation and standardization.

And the sense of urgency to create common security standards and enhance collaboration is growing.

In the European Union, for instance, there is a strong focus on building a cybersecurity ecosystem across the EU Member States, through the EU’s Cybersecurity Strategy for the Digital Decade.

In the US, President Biden’s Executive Order on “Improving the Nation’s Cybersecurity highlights the persistent cyber threat to the United States and calls on the government and private sector to partner to address these ever-evolving cyber threats through requirements on software supply chain security, threat information sharing, and enhanced cybersecurity standards.

But while governments are addressing cybersecurity measures, companies should not wait for regulation to take effect, but rather strengthen their partnerships with other private players as well as with governments. The Charter has always advocated for more joint public-private initiatives across the entire supply chain in various sectors, for a more collective and coordinated readiness to act on threats.

If there’s one thing the 2022 X-Force Threat Intelligence Index shows, it’s that it is essential that industries are prepared for cyber risks – and preparation requires access to information.

Whether in manufacturing, financial services, or the energy sector, cybercriminals are becoming increasingly more resilient, resourceful, and stealthy in their pursuit of businesses’ critical data. It’s paramount that we all recognize that public-private partnership and collaboration on threat sharing will be central to building a coordinated defense against these threats.

Read more about the global and regional results in the X-Force Threat Intelligence Index below:

You may also like

Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act
icon External Engagement

Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act

The Charter of Trust welcomes the opportunity to participate in the European Commission’s public consultation on the revision of the Cybersecurity Act. As a coalition united by the goal of strengthening digital trust, we are pleased to share our consolidated response and recommendations.

We support Policy Option 2, which focuses on targeted regulatory measures that address key challenges without creating unnecessary complexity. In this context, we emphasize the need to enhance the role and resources of ENISA, to ensure effective implementation of both current legislation and the European Cybersecurity Certification Framework (ECCF).

Our recommendations aim to improve transparency, collaboration, and efficiency across the EU’s cybersecurity landscape. These include:

- Introducing clear timelines for the development of certification schemes.

- Enhancing stakeholder engagement throughout the process.

- Establishing more structured communication channels between ENISA, the Stakeholder Cybersecurity Certification Group (SCCG), and sectoral ISACs (Information Sharing and Analysis Centers).

We call for a stronger ECCF, one that is transparent, inclusive, and aligned with international standards to foster global interoperability and ease compliance for organizations across borders. Equally critical is the harmonization of certification practices across EU member states and the mutual recognition of certifications to minimize regulatory fragmentation.

The Charter of Trust advocates for technically robust, standards-based certification schemes, with well-defined roles and responsibilities. We also stress the need for clarity on the interplay between voluntary and mandatory certifications, particularly in relation to the upcoming Cyber Resilience Act (CRA).

To streamline compliance and reduce administrative burden, we propose a unified, risk-based incident reporting regime that consolidates requirements under regulations such as NIS2, CRA, GDPR, and DORA. This would not only simplify reporting for organizations but also enhance the EU’s overall cyber resilience. In addition, we recommend incorporating liability protections and grace periods for incident disclosure.

Finally, we urge the Commission to strengthen supply chain security by adopting a risk-based classification approach and establishing baseline cybersecurity requirements for ICT suppliers.

The Charter of Trust remains fully committed to supporting the European Commission in shaping a secure, resilient, and trusted digital future for Europe. We look forward to continued collaboration in building a cybersecurity framework that meets the needs of all stakeholders, today and in the years to come.
June 19, 2025
Advancing Regulatory Alignment at RSA Conference 2025
icon External Engagement

Advancing Regulatory Alignment at RSA Conference 2025

In the face of rising global cyber threats, over 50 CISOs have called for greater international alignment of cybersecurity regulations to strengthen defenses and reduce fragmentation. This message was echoed at RSAC 2025, where experts from the OECD, European Commission, academia, and industry emphasized the need for principle-based collaboration. The Charter of Trust, a long-time advocate for regulatory harmonization, continues to support coordinated, effective approaches that prioritize clarity over complexity.
May 01, 2025
Richards Skalt takes over the Advocacy Workstream
icon External Engagement

Richards Skalt takes over the Advocacy Workstream

We are delighted to welcome Richard Skalt, Advocacy Manager at TÜV SÜD, as the new Leader of the Advocacy Workstream at the Charter of Trust. Richard steps into the role following María del Pino González-Junco, who recently assumed the position of Chair of the Global External Engagement Working Group.

With a strong background in advocacy and a forward-looking vision, Richard brings renewed energy to our mission of shaping a secure digital future. As he puts it:

“My motivation is to preserve and build upon the strong foundation of advocacy activities we’ve developed over the past years. At the same time, I’m committed to ensuring we’re in a position to shape the policies that will define how our business model and operations evolve in the future – including the cybersecurity of products and systems, the use, deployment, and distribution of robust AI solutions, as well as cloud security and secure datacenters.”

In a world defined by accelerating digital transformation and increasingly complex regulatory challenges, principled leadership and effective collaboration are more vital than ever. Under Richard’s leadership, the Advocacy Workstream will continue to engage policymakers, raise public awareness, and strengthen education around key issues such as cybersecurity, AI governance, and secure digital infrastructures.
April 29, 2025