Cybersecurity: CISO in the Spotlight
“The role of chief information security officer has risen in strategic importance more than any other role in the last decade and is often involved in all levels of business planning and strategic decision-making. Every CISO should be part of the top executive team and if the CISO sits on the management board their effectiveness is much higher. The most effective CISO is someone with a risk or compliance background. This is a pivotal role today and identifying and recruiting the right expertise requires a forensic knowledge and understanding of the talent pool and how it is evolving.”
Andreas Landgrebe
Managing Partner, Austria, Romania, Slovenia and Slovakia
Global Sector Leader, Digital Transformation Leadership
- The increasing number and sophistication of cyber threats have made cybersecurity a top priority for individuals, businesses, and governments.
- At the government level, cybercrime threatens national security and global economic stability. Damages from cybercrime are estimated at US$8 trillion for 2023, and it is projected to cost the world economy US$10.5 trillion annually by 2025.
- Organizations are focusing on various solutions. Gartner predicts that by 2026, companies prioritizing security investments through continuous threat exposure management will see a two-thirds reduction in breaches. To address threats like malware, ransomware, phishing, insider threats, and DDoS attacks, companies focus on critical infrastructure, network, endpoint, application, cloud, information, and mobile security.
- Key cybersecurity technologies and practices include security awareness training, identity and access management (IAM) with multi-factor authentication, attack surface management, and disaster recovery with remote backup. AI-driven technologies are increasingly used for real-time attack identification and response, incorporating tools like SIEM, SOAR, and EDR.
- Strategic, human-centric approaches to security use GenAI to augment human endeavours, implementing a ‘contextually appropriate’ security behaviour and culture program. By 2025, 40% of cybersecurity programs will deploy socio-behavioural principles, such as nudge technologies, to influence security culture, 8x the amount deployed in 2021.
- In turn, GenAI is expected to need greater cybersecurity resources to secure it, prompting a projected 15% incremental spend on security.
- Its strategic importance has made cybersecurity a boardroom priority; 28% of board directors, chairs or NEDs cite the need to strengthen cybersecurity skills in their organisation. At board level, stronger cyber skills are a top three priority.
- While training will play an important role in building these skills, for many leaders it’s really about a mindset shift, knowing when and how to ask the right questions. Leaders don’t need to be cybersecurity experts, but they do need to keep informed and consider cybersecurity implications in each key business decision that they make.
- A snapshot on cybersecurity readiness: Belgium, Lithuania, and Estonia lead, with 14 out of the top 15 spots held by European nations. The US ranks lower with a score of 64.94, facing challenges in achieving comprehensive coverage. The top three countries in market value for the national cybersecurity industry are the United States, China, and the United Kingdom. The US market value is expected to reach US$117 billion by 2028, with China projected at nearly US$41 billion.
- For organizational readiness, structure is key. Cisco research finds that 47% of CISOs report directly to the CEO. This direct reporting line, most prevalent in the US, results in fewer breaches, better funding, and increased cybersecurity awareness among employees.
- The primary value of a CISO lies in assessing realistic risk scenarios and selecting effective safeguards. An effective CISO balances operational needs with cost-benefit considerations.
- More broadly, cyber talent is a major concern. With a global shortage of 3.4 million cyber professionals, the World Economic Forum has convened a special Centre for Cybersecurity, promoting solutions such as building organisational resilience through cyber skills and upskilling or reskilling talent.
- Read more on the topic:
IMB: What is cybersecurity?
Cybercrime Magazine: Cyberwarfare in the C-Suite
International Monetary Fund: IMF Cyber Risk: a growing concern for macrofinancial stability
Sosafe: Cybercrime trends 2024
Gartner: Top trends in cybersecurity for 2024
Boyden Global Executive Survey: Exploring adaptivity through strategy and talent
Express VPN: Cybersecurity spending: how much are countries investing in their digital defences?
World Economic Forum: Bridging the cyber skills gap