Neglecting cybersecurity is becoming increasingly unacceptable for enterprises of all sizes.
According to the Global Cyber Outlook 2023, which was released this week at the World Economic Forum's Annual Meeting in Davos, Switzerland, geopolitical and economic uncertainty around the world is exacerbating the threat of potentially catastrophic cyber-attacks, increasing the risk for businesses across sectors.
While there has been progress in raising cybersecurity knowledge and preparedness, there is still much more that organizations can do to boost resilience, such as strengthening cyber literacy, communication, and information sharing.
Geopolitical risk increases cyber threat
Geopolitical risk has rushed back to the forefront of global politics in the last year, upending supply chains and upsetting major businesses ranging from energy to agricultural commodities. New technologies are also rapidly emerging, bringing with them new weaknesses that attackers – some of whom have strong geopolitical reasons – are typically fast to exploit.
In fact, the new forecast indicated that 93 percent of cybersecurity executives and 86 percent of their business counterparts consider the danger of a catastrophic cyber catastrophe occurring over the next two years as either 'high' or 'moderately high'. Such incidents may include a severe ransomware assault or a breach of important customer data, both of which would create widespread disruption and be financially and reputationally costly.
According to the survey, heightened risk has already driven 50% of respondents to reconsider the nations with whom they do business, while others are concerned about economic interruption and reputational harm as a result of geopolitical-related cyber-attacks.
Interconnected activities introduce additional dangers.
Fear of a big assault reflects, in part, the interrelated structure of activities today. The digital transition is generating technical interdependencies, the magnitude and character of which are frequently unknown.
Consumer data and technology are increasingly being exchanged across supply chains, which implies that a cybersecurity incident can swiftly 'cascade' from one firm to another and across borders.
Third-party risk awareness and apprehension have risen dramatically in the last year. A total of 90% of respondents expressed worry regarding third-party cyber resilience, particularly those with direct links to or processing of organizations' data.
Information sharing is improving but ...
The tech vs non-tech dynamic that has dominated boardrooms for several years is changing, which is encouraging. There is a growing consensus and increased knowledge - notably among boards - not just of what cyber dangers are, but also of their responsibilities in tackling them. Boards are more willing to consider cyber threats and listen to their cyber specialists, according to the survey, which found that 56% of security leaders interact with their board at least once a month.
The challenge that remains is for corporate executives to effectively articulate the risk that cyber concerns bring to their firm. As a result, reaching an agreement on how to appropriately handle the risk becomes more difficult. According to the paper, cyber professionals should explain security risks in language that board-level executives can easily grasp and act on, while business leaders should bear increased responsibilities for overall cyber capabilities.
Skilled requirement remains a problem
Furthermore, identifying the proper personnel to detect, analyze, and manage cyber risk, as well as deal with a large cyber disaster, is critical. However, the long-standing technical skills shortfall must be addressed.
Currently, 64 percent of cyber executives and 59 percent of their business counterparts identify talent recruiting and retention as a major concern in controlling cyber risk. Worryingly, less than half of those polled said they have the proper people with the right expertise to respond to cyber-attacks.
Fortunately, in recent years, there has been a greater understanding of the problem, increasing the likelihood that the requisite talent recruiting programs will be implemented. This will contribute to the development of a broader, more diversified pool of diverse talent, including those with crisis management abilities as well as the capacity to think creatively and differently about challenges. It will also help to debunk the myth that cybersecurity is a highly technical endeavor, which is not often the case.
According to the survey, corporate leaders (76%) and cyber executives (70%) increasingly see data privacy laws and cybersecurity regulations as a useful instrument for managing cyber risk. Compliance can be difficult, but regulation, along with the extra pressure of shareholder expectations, is motivating cyber security action.
This is encouraging because, in order to foster a security-focused culture, businesses must develop a common vocabulary as well as metrics that convert cybersecurity data into something that can be easily evaluated and analyzed.
This is encouraging because, in order to foster a security-focused culture, businesses must develop a common vocabulary as well as metrics that transform cybersecurity data into something that can be easily evaluated and analyzed.
To do this, cybersecurity specialists must enhance their communication and data delivery, while executives must better understand what cyber risk entails for corporate governance and investment decisions. Talk to us now to learn more.
