Digital Trust Insights Pulse Survey

CISOs surveyed said they invested in eight different areas, on average, over the past two to three years. The ones that paid off the most during the crisis were investments related to three capabilities. Critical to the sudden large-scale shift to remote work were investments such as VPN, VDI, mobile device management, endpoint security and identity-based network architecture. Helpful for crisis management were investments in resilience capabilities, such as business continuity and disaster recovery planning and managed detection and response services. Investments in data-driven risk management — such as real-time threat intelligence, use of data analytics and quantification of cyber risk — were also helpful as information evolved quickly during the crisis.

Takeaway:

Was making the right investments just a matter of good luck, or was it due to foresight? The answer lies beyond the scope of this Pulse Survey. But we know this from our 2019 Digital Trust Insights study on business-driven cybersecurity: Only about 25% of cybersecurity organizations had reframed their team’s mission to align with the company’s strategic goals. Business-driven cybersecurity leads to cyber investments that are more likely to yield tangible returns.

During the pandemic, a CISO needed to be a tactical/operational CISO, as well as a transformational leader, a post-breach CISO, and a compliance and risk guru (four of the six types of CISOs described by Forrester Research). On average, nearly one-third of the CISO’s time was allocated to crisis management, as expected. But nearly as much time was focused on business-as-usual operational tasks, and nearly one-fourth was devoted to strategic cyber projects.

Half of the CISOs surveyed increased cybersecurity training and awareness for the full workforce, helping employees defend the organization from phishing attacks and remote-work– related risks. More CISOs increased cyber spending (35%) than reduced budgets (15%), but some adjusted staffing through furloughs (23%), headcount reduction (16%) or shifts to managed services providers (33%).

In the past, CISOs were often not included in strategic and business decisions and plans, even those with significant security and privacy implications. The pandemic may have changed all that. CISOs were significantly involved in decision-making around pandemic responses that were both operational and transformational: enabling remote work or work-from-home for the workforce (81%), setting up systems to monitor and report remote workers’ productivity (70%), planning for and coordinating return-to-work solutions for essential workers (71%), and implementing systems or apps to enable the monitoring of employee health and safety (65%). 

Increased collaboration with business and risk functions during the crisis was reported by half of the CISOs, another sign of a turning point in CISO interactions.

Takeaway:

Crises precipitate new approaches; that’s how leading organizations emerge stronger from them. Greater integration with the business during this crisis is one such positive change that CISOs should sustain. Leading cyber teams bring greater value when they are connected on strategy, on a risk-based approach and in execution. They are twice as likely to work in strategic partnership with other functions that manage risk in their organizations and one-and-a-half times as likely to have a common understanding of how cyber risks fit within enterprise risk management.

CISOs have shown that business executives can be ambitious about the speed and scale of their digitization plans if they collaborate with their security and privacy chief from the start. It’s a way of operating that can also boost cyber teams’ professional satisfaction and purpose at work, and improve their ability to help their organizations. In a tight market for cybersecurity talent, two points that attract and retain talent are business leaders' commitment to cybersecurity and CISOs who are actively engaged with the business, according to ESG ISSA's 3rd annual survey.

A majority of CISOs have interacted more frequently with their CEOs (65%) and the boards (50%) during the crisis. This trend points to a reset in CISOs’ interactions emerging from the crisis, and it should continue. In 2019, only 33% of all business and IT executives said that their cyber team communicates effectively with the board and senior executives about cyber risks and adjacent risks. But 71% in leading organizations (ones with business-driven cyber teams) report effective communications, according to that study on business-driven cybersecurity.

Effective communications with the board and CEOs requires many leadership skills that will be invaluable in the coming months.

The reopening of workplaces means new and different milestones for organizations to accomplish. CEOs are leading with an eye on both the pragmatic and urgent (how do I contain cost) and the new and long term (how do I apply tech to deliver better customer experience, and do things smarter and more efficiently) There’s repair to be done (how do I close security gaps in remote work setups) and a rethink-and-reconfigure to consider (what’s the office for when most of my employees can work in a distributed model).

This is the new arena where CIOs, CISOs and other business leaders will play in the next six months and beyond. A key question is, will cybersecurity and privacy be strategically woven into every consequential or bold move that corporate chiefs are contemplating?

CISOs love a good challenge. But can they do it under the toughest economic and financial situation in this lifetime? This is where imagination and influence will be required. What is the right cyber strategy to support their company’s reboot? What are the cyber priorities that can create competitive advantage for their company?