4 ways security has failed to become a boardroom issue

Somewhere around 2015, the security industry adopted a new mantra, “cybersecurity is a boardroom issue.”  This statement was supported by lots of independent research, business press articles, webinars, local events, and even sessions at RSA and Black Hat crowing about the burgeoning relationship between CISOs, business executives, and corporate boards.

Has anything really changed since then?

To find out, ESG surveyed 365 senior business, cybersecurity, and IT professionals at organizations in North America (US and Canada) and Western Europe (UK, France, and Germany) working at midmarket (i.e., 100 to 999 employees) and enterprise-class (i.e., more than 1,000 employees) organizations.

As it turns out, there’s good news and bad news here.  The good news is that cybersecurity is indeed a boardroom level issue.  The bad news is that we are nowhere near where we should be.  For example:

• Cybersecurity is still perceived as primarily a technology issue. Twenty-eight percent of respondents believe cybersecurity is entirely a technology area, while 41% say that cybersecurity is mostly a technology area with some emphasis on the business aspects of cybersecurity.  Alarmingly, 11% still think of cybersecurity as a regulatory compliance area alone.  All of this means that boardroom-level discussions about cybersecurity center on things like open software vulnerabilities and numbers of incidents detected rather than securing customer communications, getting employees onboard, or building cyber-resilience into critical applications and business processes.  Same old priorities with a few more discussions. 
• CISOs are viewed as technologists. While just over half of all organizations consider the CISO a business executive, the other half of organizations still perceive CISOs as an IT role only.  Heck, some firms see CISOs as little more than glorified firewall administrators.  CISOs in this camp get little facetime with executives or boards; when they do, it’s usually to answer questions rather than provide any proactive input. 
• Cybersecurity remains antithetical to corporate culture. Under half (44%) of organizations claim that employees’ commitment and buy-in to cybersecurity is “very good.”  The other 56% say it is adequate, fair, or poor.  So, while CISOs proclaim that ‘cybersecurity is everyone’s job,’ most organizations aren’t pushing this philosophy to rank and file employees.
• Business managers have little to no cybersecurity responsibilities. Similarly, only 29% of organizations claim that non-technical managers have cybersecurity responsibilities like classifying sensitive data, aligning employee roles with access policies, or working with cybersecurity managers on business planning.  From my experience, business executives tend to think of these things as checkbox exercises to be done as quickly as possible. 

This and other data from the report indicates a cybersecurity dichotomy:  Yes, boards and executives are more engaged with cybersecurity, but they retain an “us and them” mentality.  Business executives and boards drive business decisions; CISOs are tasked with bolting on technical security controls and cleaning up messes as they occur.

We weren’t wrong in 2015 when we declared that cybersecurity was a boardroom issue: Based on the ESG research, it appears that after years of neglect, boards and executives finally started paying attention to cybersecurity around 5 years ago.  Since then, the cybersecurity industry has been busy patting itself on the back for any incremental progress. 

If your doctor warned you that you needed to lose 50 pounds, you wouldn’t declare victory when you dropped 5 lbs. after a month.  Unfortunately, that’s what’s happening with cybersecurity in the boardroom and C-suite.  At most organizations, there’s a lot of hard work ahead. 

Now, before I come off as Chicken Little, the data also indicates that there are organizations going beyond the basics.  These firms have made significant progress with cybersecurity as an essential component of business mission, culture, and strategy.  Furthermore, some organizations have reaped benefits like stronger security efficacy/efficiency, greater ROI on cybersecurity investments, and improved business flexibility.  What’s their secret?  More on that soon.