2022 State of Enterprise DFIR

Digital forensics and incident response (DFIR) teams are currently experiencing a fundamental shift. The cyberthreat landscape is evolving rapidly as bad actors discover new ways to breach security perimeters. Insider threats are also greater than ever; and some modern tactics, such as zero-trust environments, simply aren’t designed to protect against a maliciously acting insider.

Data volumes alone create a significant problem for DFIR teams. As of 2020, the world was creating 59 ZBs a year and storing 4.2 ZBs according to IDC’s Global Datasphere. DFIR professionals are dealing with the largest amount of data in history, data that they have to sift through to find evidence they need for their investigations.

Hybrid and remote work are now the norm for the foreseeable future and the volume of audio and video files are expanding with the shift to remote meetings. All of these forces come together and create a dynamic new environment that everyone, including DFIR professionals, must adapt to.

This annual report is about the current state of digital forensics and incident response for today’s enterprises, corporations, and forensic service providers. The aim of this report is to provide market-driven and research-based insight to leaders who are making decisions for their DFIR labs so they can best prepare themselves and their teams for change.

The findings presented are based on a survey conducted by Magnet Forensics in collaboration with IDC which explore the current state of DFIR within the context of the macroeconomic forces surrounding enterprise technology. Readers should be able to evaluate their lab and technology based on the benchmarking reported by their peers to effectively plan for the future.

This report highlights:

• How DFIR teams have been impacted by hybrid work and data volume growth
• The state of DFIR within financial services, healthcare, and technology sectors
• The most concerning security threats now and in the future
• The size, organizational placement, and resource needs of DFIR teams