Somewhere around 2015, the security industry adopted a new mantra, “cybersecurity is a boardroom issue.” This statement was supported by lots of independent research, business press articles, webinars, local events, and even sessions at RSA and Black Hat crowing about the burgeoning relationship between CISOs, business executives, and corporate boards.
At the beginning of last year, I noticed that boardroom buzz about cybersecurity hadn’t really changed over the past 5 years – same old tired rhetoric and hyperbole. Hmm. Certainly, things must have progressed in that 5-year timeframe, right?
To find out, ESG surveyed 365 senior business, cybersecurity, and IT professionals at organizations in North America (US and Canada) and Western Europe (UK, France, and Germany) working at midmarket (i.e., 100 to 999 employees) and enterprise-class (i.e., more than 1,000 employees) organizations.
As it turns out, there’s good news and bad news here. The good news is that cybersecurity is indeed a boardroom level issue. The bad news is that we’ve only taken baby steps over the past 5 years and are nowhere near where we should be. For example:
- Cybersecurity is still perceived as a technology area. Twenty-eight percent of respondents believe cybersecurity is entirely a technology area, while 41% say that cybersecurity is mostly a technology area with some emphasis on the business aspects of cybersecurity. Alarmingly, 11% still think of cybersecurity as a regulatory compliance area alone. All of this means that boardroom-level discussions about cybersecurity center on things like open software vulnerabilities and numbers of incidents detected rather than securing customer communications, getting employees onboard, or building cyber-resilience into critical applications and business processes. Same old priorities with a few more discussions.
- CISOs are viewed as technologists. While just over half of all organizations consider the CISO a business executive, the other half of organizations still perceive CISO as an IT role only. Heck, some firms see CISOs as little more than glorified firewall administrators. CISOs in this camp get little facetime with executives or boards. When they do, it’s usually to answer questions rather than provide any proactive input. Successful CISOs stick to the technology domain, quietly protecting networks and servers.
- Cybersecurity remains antithetical to corporate culture. Under half (44%) of organizations claim that employees’ commitment and buy-in to cybersecurity is “very good.” The other 56% say it is adequate, fair, or poor. So, while CISOs proclaim that “cybersecurity is everyone’s job,” most organizations aren’t pushing this philosophy to rank and file employees. You can bet your bottom dollar that employees are opening phishing emails and clicking on malicious links at these firms.
- Business managers have little to no cybersecurity responsibilities. Similarly, only 29% of organizations claim that non-technical managers have cybersecurity responsibilities like classifying sensitive data, aligning employee roles with access policies, or working with cybersecurity managers on business planning. From my experience, business executives tend to think of these things as checkbox exercises to be done as quickly as possible.
This and other data from the report indicates a cybersecurity dichotomy: Yes, boards and executives are more engaged with cybersecurity but retain an “us and them” mentality. Business executives and boards drive business decisions. CISOs are then tasked with bolting on technical security controls and cleaning up messes as they occur.
We weren’t wrong in 2015 when we declared that cybersecurity was a boardroom issue, but based on the ESG research, it appears that after years of neglect, boards and executives were finally paying attention to cybersecurity around 5 years ago. Since then, the cybersecurity industry has been busy patting itself on the back for any incremental progress.
If your doctor warned you that you needed to lose 50 pounds, you wouldn’t declare victory when you dropped 5 lbs. after a month. Unfortunately, that’s what’s happening with cybersecurity in the boardroom and C-suite. At most organizations, there’s a lot of hard work ahead.
Now, before I come off as Chicken Little, the data also indicates that there are organizations going beyond the basics. These firms have made significant progress with cybersecurity now an essential component of business mission, culture, and strategy. Furthermore, organizations have reaped benefits like stronger security efficacy/efficiency, greater ROI on cybersecurity investments, and improved business flexibility. What’s their secret? More on that soon.
