# BlackNoise Annual Report 2023 · AI summary

> AI-generated summary of *Effectiveness of Operational Security, Second Annual Report* (Erium, January 2024). Refer to the full report for figures and charts.

## Scope
- 300+ attack simulations and 13,000 technical events in 2023.
- 87% of campaigns on IT environments, 7% industrial, 6% cloud.

## Three themes for 2023
1. **Improve the defense strategy:** better CTI flows and shorter MTTD through better detection configuration.
2. **Cyber scoring:** boards want measured indicators instead of declarative statements, accelerated by NIS2, CRA and DORA.
3. **Cost optimization:** automated validation helps allocate audit, tooling and staffing budgets better.

## Key figures
- Detection rate improving year on year (average score 22/100, the baseline later used by the Deep Purple series).
- Main detection sources: EDR 68%, firewall/IPS/IDS 28%, SIEM 24%. "EDR, king of detection": two thirds of adverse actions are detected thanks to it.

## Findings
- Attacks are detected better in the later phases of the kill chain than upstream.
- Data leak risk better addressed than in 2022, but many exfiltration actions remain undetected.
- Relying on EDR alone is a single point of failure.

## Outlook 2024
- Automate reaction (SOAR, EDR), formalize technical response processes, train analysts on incident qualification.
- Roll out technical cyber scoring for executive reporting.