What will it take for business leaders to understand the true value of cyber security?
Business decision makers (BDMs) and IT leaders rarely see eye to eye. Back in 2020, an analyst report revealed that 69% of executives considered cyber security entirely or mostly a technology area. Yet this attitude is increasingly untenable in a world where businesses have to fight for every last contract and every last staff member.
As new research shows, security means business today. But even after coming face to face with this reality, many senior BDMs are proving unsuccessful in making connections. They need to better frame cyber in a positive business context, just as IT and security leaders must work harder to articulate risk in a business context. Hopefully, somewhere in the middle organizations will start to see effective cyber risk management as a differentiator rather than a pressure on profits.
time to reconsider
These are tough times to run a business. After weathering the storm of a pandemic-era global recession, business leaders could be forgiven for thinking the worst was behind them. It would be wrong for them to do so. A pandemic supply chain hangover combined with generous stimulus payments in the US and then the war in Ukraine has put paid to any thoughts of a COVID bounce back.
The IMF projects advanced economies to grow at just 1.2% year-on-year in 2023, with some projected to fall below 1%, dangerously close to a full-blown recession. High inflation, rising interest rates and rising energy costs have hit European businesses and consumers hard. Meanwhile, the jobs market remains extremely tight, with unemployment near record lows in many OECD countries.
BDM must chart a way through this economic storm, ensuring they attract the brightest and best without stopping any of their talent from moving forward. They must keep costs under control while making the right bets in key sectors to drive sustainable growth. Yet very few people see the role of cyber security in this. Traditional views of cyber as a primarily technology-focused part of business prevail. Research shows that nearly half do not see it as a revenue generator, but rather a limited area for threat prevention. An even larger minority (38%) view security as a barrier, as opposed to a business enabler.
Business leaders are confused
These findings are made all the more surprising by the fact that the same research shows that global BDMs are already coming face to face with the reality of security as a strong business enabler. A fifth say the poor security situation has already caused them to lose business, while 71% say the topic is increasingly being raised in conversations with prospects and suppliers. Yet only 57% of BDMs see a strong correlation between cyber and customer acquisition/satisfaction.
The same dichotomy can be seen in talent acquisition and retention, which only two-fifths of BDMs believe is linked to cyber security. Yet in the same breath, three-quarters claim that the ability to work from anywhere has become critical in the battle for talent, and even more (83%) admit that their inadequate security policies have put remote workers at risk. have affected their ability to do their job.
why security matters
The well-worn analogy of car brakes is instructive here. Without them, we’d all be driving slow, or crashing at every turn. Likewise, cyber security is about allowing businesses to move fast, but also to do so securely. Organizations are often afraid to build security into business processes, for fear that they will slow things down. But when done right, cyber business is an essential enabler and driver of resilience and growth. Unfortunately, many companies are choosing to accelerate digital transformation without taking the necessary security measures – making it more likely that they will “crash” with a serious compromise.
This is where security by design comes in handy. It can be as simple as scanning open source code for malware and vulnerabilities before it enters production. or continuously assessing the cloud environment for policy compliance, to ensure that no misconfigured accounts are left open. It could also mean micro-segmentation of the network to protect high-value assets and limit the blast radius of attacks. They all speak to the value of effective cyber security in reducing business risk.
unlock development
The good news is that, despite their reluctance to connect the dots between security and several critical areas of business operations, 64% of BDMs see a strong connection between cyber security and business risk. Yet at the same time, only a third say they report cyber as an occupational risk, while 28% record no cyber risk at all.
While no two organizations are alike, there are some common best practices that will help most to enhance their approach. First, understand the assets that need to be prioritized from a cyber security perspective by calculating the business risk of compromise, loss or unavailability. Second, proactively monitor and mitigate cyber risk in these assets. Third, regularly update the board on these efforts in the language of business risk.
Of course, in practice it is not that simple. But BDMs should not lose sight of the fact that by effectively managing cyber risk, they are going a long way towards managing business risk. It is an increasingly important way to win new business, acquire and retain talent, and help unlock strategic growth.
Source: www.cityam.com
