Thought Leadership
US authorities and companies continue to use security software from the Russian manufacturer Kaspersky even after the ban came into force. A current analysis shows remarkable trends in global use.
According to a new study by security firm Bitsight, around 40 percent of US organizations that were using Kaspersky products before the deadline of 29 September 2024 are still using them – including 19 government institutions. The findings are based on the observation of connections between global IP addresses and Kaspersky update servers.
The analysts emphasize that these findings highlight the need for more effective measures to monitor the use of technology within national borders. This is particularly relevant in light of growing concerns about supply chain security and the trustworthiness of technology providers.
Significant decline worldwide
Despite continued use in the US, the study shows a significant impact of the ban on the global use of Kaspersky products. While Bitsight still registered communication from almost 22,000 organizations and over seven million individual IP addresses with Kaspersky servers in April 2024, this number had fallen to around 8,000 organizations and two million IP addresses by the end of November – a decrease of around two thirds.
Interestingly, the decline was even more pronounced in countries without an explicit ban: Germany saw a 69% decrease, the UK a 70% decrease and Italy a 65% decrease – compared to 58% in the US.
Background
On June 20, 2024, the US Department of Commerce issued a final order prohibiting Kaspersky’s US subsidiary from providing any products and services in the United States. This was based on suspected links to the Russian regime, which the US authorities consider to pose a risk to national security.
Kaspersky rejected the accusations of influence by the Kremlin and initially announced that it would take legal action. In July 2024, however, the Moscow-based company announced that it would cease its business activities in the USA.
The results of the Bitsight analysis now raise the question of how effectively such technology policy measures can be implemented in practice and what challenges exist in terms of enforcement.
