← Back to all briefings
Cybersecurity 5 min read Published Updated Credibility 92/100

Cybersecurity Retrospective — Cybersecurity

A 2020–2022 cybersecurity retrospective charts pandemic-driven attack expansion, zero-trust policy waves, and ransomware economics—guiding security leaders on operational, governance, and sourcing priorities for the next planning cycle.

Kodi C.

Editor & Research Lead

Verified for technical accuracy — Kodi C.

Cybersecurity pillar illustration for Zeph Tech briefings
Cybersecurity threat, control, and response briefings

The period from early 2020 through Q1 2022 reset cybersecurity baselines. Remote work, accelerated cloud adoption, and geopolitical unrest expanded attack surfaces, while landmark incidents such as SolarWinds, Colonial Pipeline, Log4Shell, and Microsoft Exchange ProxyLogon forced governments and enterprises to overhaul practices. Reviewing the past two years highlights lessons for operational resilience, governance, sourcing, and investment priorities as organizations plan 2022–2024 roadmaps.

Timeline of major shifts

2020: The pandemic drove mass remote work, prompting rapid deployment of VPNs, collaboration tools, and cloud services. Threat actors exploited misconfigurations and phishing targeting pandemic themes. Notable events included the SolarWinds Orion supply-chain compromise, compromises of COVID-19 research institutions, and increased ransomware targeting healthcare. Policy responses included the U.S. CISA releasing telework guidance and the UK NCSC promoting remote working security.

2021: Supply-chain attacks and ransomware escalated. The Microsoft Exchange ProxyLogon campaign, Colonial Pipeline ransomware incident, Kaseya VSA compromise, and widespread exploitation of Log4Shell underscored the fragility of software supply chains. The U.S. issued Executive Order 14028 on improving cybersecurity, CISA established the Joint Cyber Defense Collaborative, and multiple governments launched ransomware task forces. Insurance carriers tightened underwriting, requiring MFA and segmentation.

Early 2022: Russia’s invasion of Ukraine triggered global Shields Up advisories. Governments advanced zero-trust mandates (OMB M-22-09 in the U.S., UK’s Cyber Assessment Framework updates), while EU institutions progressed the NIS2 Directive and Digital Operational Resilience Act. Organizations re-evaluated supplier risk, incident reporting, and resilience strategies.

Operational lessons learned

  • Visibility gaps: Incidents revealed limited visibility across hybrid environments. Investments in extended detection and response (XDR), cloud-native telemetry, and asset management became critical.
  • Patch velocity: Log4Shell showed the need for rapid patching and virtual patching. Enterprises adopted risk-based vulnerability management, attack surface management, and continuous scanning.
  • Incident response maturity: Tabletop exercises expanded to include cross-functional teams, communications, legal, and regulators. Playbooks integrated ransomware payment decision frameworks and negotiated response protocols.
  • Business continuity: Colonial Pipeline and other incidents highlighted the need to link IT/OT recovery plans. Organizations invested in network segmentation, manual operations, and redundant systems.
  • Third-party monitoring: The SolarWinds compromise prompted third-party risk programs to require SBOMs, improved logging, and supply-chain attestations.

Governance and policy developments

  • Zero-trust mandates: U.S. federal agencies must achieve specific zero-trust targets by 2024, while allied governments issued similar guidance. Boards now expect zero-trust roadmaps from management.
  • Regulatory reporting: Governments introduced or proposed faster incident reporting—U.S. critical infrastructure reporting within 72 hours (pending legislation), Australia’s Security of Critical Infrastructure Act amendments, and EU NIS2’s 24-hour initial notification.
  • Board accountability: The SEC proposed improved cybersecurity governance disclosures; UK regulators emphasized board engagement through FCA/PRA Dear CEO letters. Directors sought specialized education.
  • Insurance market hardening: Premiums rose and coverage declined unless teams implemented MFA, EDR, and incident response plans. Boards reevaluated cyber risk transfer strategies.
  • International cooperation: Cross-border alliances like the Counter Ransomware Initiative and EU-US Trade and Technology Council fostered joint actions against cybercrime.

Technology priorities for 2022–2024

  • Zero-trust architecture: Implement identity-centric access controls, microsegmentation, continuous authentication, and secure access service edge (SASE) platforms.
  • Security observability: Expand logging across cloud, SaaS, OT, and identity providers. Adopt flexible data lakes and analytics to support threat hunting.
  • Software supply-chain security: Integrate software bill of materials (SBOMs), code-signing protections, dependency scanning, and secure build pipelines aligned with NIST SP 800-218 (Secure Software Development Framework).
  • Automation and orchestration: Use SOAR and security automation to reduce response times, enforce policy, and orchestrate cross-team actions.
  • Resilience engineering: Invest in chaos engineering, backup verification, and site reliability engineering practices to ensure systems can withstand and recover from attacks.

Sourcing and ecosystem considerations

  • Managed services adoption: Organizations now rely on managed detection and response (MDR) and incident response retainers to cover skill shortages. Contracts must define SLAs for threat detection, reporting, and coordination with internal teams.
  • Vendor consolidation versus specialization: Security leaders weigh platform consolidation to reduce complexity against the need for specialized tools targeting OT, cloud, or identity threats. Procurement strategies should evaluate integration costs and resilience benefits.
  • Supplier risk transparency: Expect more requests for SBOMs, vulnerability disclosures, and coordinated vulnerability disclosure programs. Vendors must invest in secure development to remain competitive.
  • Talent pipelines: Workforce shortages drive partnerships with universities, apprenticeships, and internal reskilling. Outsourcing must include knowledge transfer clauses to avoid dependency.
  • Insurance partnerships: Engage brokers and carriers early to align security controls with underwriting expectations, capturing incentives for improved posture.

Key metrics

Boards demand actionable metrics beyond counts of blocked attacks. Organizations are adopting KPIs such as mean time to detect/respond, percentage of privileged accounts with MFA, patch compliance rates for critical vulnerabilities, percentage of critical suppliers assessed, and progress toward zero-trust milestones. Qualitative reporting includes scenario analyzes, tabletop exercise outcomes, and alignment with regulatory frameworks.

Strategic recommendations

  1. Integrate cyber and business continuity planning: Align recovery priorities with operational and financial impacts. Test simultaneous cyber and physical incident scenarios.
  2. Embed security into digital transformation: Require DevSecOps practices, secure-by-design architectures, and privacy engineering for new initiatives.
  3. Strengthen threat intelligence fusion: Combine internal telemetry with government and industry intelligence feeds to anticipate threats and inform investment decisions.
  4. Elevate board engagement: Provide quarterly deep dives, scenario exercises, and training to improve oversight and funding decisions.
  5. Measure supplier resilience: Implement continuous monitoring of critical suppliers, validating incident response capabilities and regulatory compliance.

Outlook

The cybersecurity field will continue to evolve with geopolitical tensions, regulatory demands, and innovation. Organizations that internalize lessons from 2020–2022—prioritizing zero trust, supply-chain security, resilience, and governance—will better withstand the next wave of threats and regulatory scrutiny.

Regional nuances

Regional regulators emphasized different aspects of cybersecurity. The EU advanced the Digital Operational Resilience Act for financial services and proposed critical entities resilience rules, while Germany implemented the IT Security Act 2.0 expanding obligations for critical infrastructure operators. In Asia-Pacific, Singapore’s Cyber Security Agency updated codes of practice for critical information infrastructure, and Japan revised its cybersecurity strategy focusing on supply-chain risks. Latin American governments invested in national CSIRTs and public-private information sharing. Multinationals must tailor programs to local supervisory expectations while maintaining global standards.

Investment outlook

Security budgets are shifting toward preventive capabilities such as identity governance, security automation, and resilience engineering. If you are affected, allocate funding to modernize legacy systems, expand cyber insurance coverage where economically viable, and develop talent pipelines. Partnerships with managed service providers must include transparent performance metrics and knowledge transfer requirements to build internal capability. Continual measurement and storytelling around resilience outcomes will help secure sustained executive support.

See also

Selected articles on related subjects.

Continue in the Cybersecurity pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

  • Cybersecurity Operations Playbook

    Use our research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.

  • Network Security Fundamentals Explained Practically

    A practitioner-focused guide to network security fundamentals covering firewalls, segmentation, IDS/IPS, DNS security, VPNs, wireless security, zero trust architecture, and traffic…

  • Small Business Cybersecurity Survival Checklist

    A budget-conscious cybersecurity checklist built specifically for small businesses. This guide covers foundational security policies, network hardening, employee training, phishing…

Coverage intelligence

Published
Coverage pillar
Cybersecurity
Source credibility
92/100 — high confidence
Topics
Cybersecurity · Incident Response · Regulation
Sources cited
6 sources (nvlpubs.nist.gov, cisa.gov, federalregister.gov, hitehouse.gov)
Reading time
5 min

Cited sources

  1. Zero Trust Architecture — National Institute of Standards and Technology
  2. Emergency Directive 21-01 — Cybersecurity and Infrastructure Security Agency
  3. Improving the Nation’s Cybersecurity — Federal Register
  4. Binding Operational Directive 22-01 — Cybersecurity and Infrastructure Security Agency
  5. Moving the U.S. Government Toward Zero Trust Cybersecurity Principles — Office of Management and Budget
  6. Consolidated Appropriations Act, 2022 — U.S. Congress
  • Cybersecurity
  • Incident Response
  • Regulation
Back to curated briefings

Comments

Community

We publish only high-quality, respectful contributions. Every submission is reviewed for clarity, sourcing, and safety before it appears here.

    Share your perspective

    Submissions showing "Awaiting moderation" are in review. Spam, low-effort posts, or unverifiable claims will be rejected. We verify submissions with the email you provide, and we never publish or sell that address.

    Verification

    Complete the CAPTCHA to submit.