Only half (54 per cent) of businesses are confident in their ability to verify and defend against an attack, according to a study by networking giant Cisco.

Cisco's latest Annual Security Report concluded that this lack of confidence is mostly down to hackers becoming more nimble, resilient and persistent while businesses are struggling to keep up and mount adequate security defenses.

Patching and vulnerability management remain a pain point. The majority (92 per cent) of devices across the internet are running known vulnerabilities. A third (31 per cent) of all devices analyzed are no longer supported or maintained by the vendor. Examples in this category might include aging computers running Windows XP, for example.

While often viewed by corporate security teams as a low-level threat, malicious browser extensions have been a potential source of major data leaks, affecting more than 85 per cent of organizations. Adware, malvertising, and even common websites have led to breaches affecting those who do not regularly update their software, Cisco warns. Nearly 92 percent of "known bad" malware was found to use DNS as a key capability.

Small businesses remain a weak link to enterprise security and the potential source of supply chain weakness, with only 29 per cent using patching and configuration tools in 2015. This is a particular problem because advanced attackers have taken to using flaws in the systems of the third-party suppliers of enterprises to raid enterprise targets.

For example, retailer Home Depot and Target were attacked by hackers who first pwned the systems of a third-party vendor's system. Target was broken into via the firm's HVAC vendor while, outside of the retail sector, an attack on bank JPMorgan happened via a third-party website.

Additionally, direct assaults by cybercriminals, leveraging ransomware alone, put $34m a year per campaign into the hands of hi-tech Fagins, with little sign that these artful dodgers will be constrained any time soon.

Cisco's study also revealed that cybercriminals are abusing legitimate resources to launch attacks – JavaScript and Facebook scams were cited as the most common attack methods – and the number of WordPress domains used by criminals has more than tripled in the latter part of 2015.

Research also revealed that outsourcing is on the rise. As part of a trend to address the skills shortage, enterprises of all sizes are using more consulting, security auditing and incident response services. Small- and medium-sized businesses, which often lack resources for effective security policies, are improving their security approach in part by outsourcing, which is up to 23 per cent in 2015 over 14 percent the previous year.

The report (available here, registration required), published Tuesday, charts the threat landscape across sectors such as healthcare, financial services and government. This blog post from John N. Stewart, senior vice president, chief security and trust officer at Cisco, discusses the main findings of the study.

A stat-heavy infographic can be found here [PDF]. ®