The state of cybersecurity leadership

Resilience should matter to business and IT leaders. No organisation is 100% breach proof, so what matters increasingly is their ability to anticipate, withstand and recover, while containing the threat and carrying on as close to business as usual as possible. As we’ve discovered, the cost of remediation, response, downtime and disruption can be significant. A ransomware attack can be an existential incident for some SMEs. And even for well-resourced businesses, the financial and reputational impact of a serious incident can be significant.

On the other hand, get resilience right and the business and its leadership benefit immensely. Compliance with information security standards that help organisations build resilience can drive time savings, better business decisions, improved reputation and customer retention, while reducing the risk of regulatory fines. According to our data, it can also help to develop streamlined security infrastructure that is easier and less costly to manage (27%), increase sales opportunities (25%) appeal to investors (23%) reduce IP theft (21%) and lower insurance premiums (19%). Respondents also cite direct cost savings from a reduced number of incidents (26%), and tangible benefits from improved employee awareness training.

So far, so good. So why then does accountability at the very top of organisations appear to be lacking? Some 86% of respondents agree that every organisation should have someone responsible for cyber at a board level. Yet who this person is varies considerably. A third (34%) of respondents cite the CEO, 17% the CIO and 11% the CISO. A further 29% say the board collectively owns cyber risk, although this is far more common in the UK (34%) than the US (21%).

There’s nothing wrong with the board collectively overseeing cyber risk. But a named and accountable individual is vital to provide ownership, and take the important decisions. They are the ones that should be asking the difficult questions of information security leaders, and ensuring cyber is treated just as seriously as financial, regulatory and other business risks. Cyber crosses so many organisational boundaries that when a breach happens or a ransomware incident threatens to shut down operations, you need to know where the buck stops.

It’s disappointing therefore that over 53% of respondents claim leadership still treats security compliance as an afterthought, and only 36% have discussed emerging threats at a board level. Nearly a fifth (17%) complain that getting buy in from the leadership team is one of their biggest current challenges.

NIS2 arguably goes even further with senior accountability. It mandates that management bodies must not only approve and oversee implementation of risk management, but also “can be held liable for infringements”. Members of management bodies must also undergo cybersecurity training. And as a last resort, where earlier enforcement steps have proved ineffective, regulators can seek a temporary ban preventing anyone with managerial responsibility at CEO or legal representative level in an essential entity from exercising those functions.

The consequences for the organisation are just as serious. Only one in ten of our respondents say regulatory fines were the largest cost of their most significant incident, but that may not hold as these regimes take hold. NIS2 requires member states to set maximum fines of at least €10m or 2% of global annual turnover, whichever is higher, for essential entities, and at least €7m or 1.4% for important entities. In the most serious cases, regulators can temporarily suspend an essential entity’s certification or authorisation to provide some or all of its services. DORA leaves the level of penalties to individual member states, but sanctions can reach individual members or the management body where national law allows, and member stats can also impose criminal penalties. Depending on the industry, then, failing to meet regulators’ expectations can mean anything from a large fine to restrictions on how a business operates, or even its right to operate at all.

Although the UK Cyber Security and Resilience Bill was still being finalised at the time of writing, the European model certainly represents the direction of travel for UK regulators. As drafted, the Bill would raise the maximum penalty for the most serious breaches to £17m or 4% of worldwide turnover, whichever is higher, up from a flat £17m today. The government has argued that the current ceiling can be absorbed by larger organisations as a ‘cost of doing business’. The ministerial letter and Cyber Resilience Pledge both request that organisations make cyber a board-level priority. And both cite the government’s Cyber Governance Code of Practice, Cyber Governance Training and Cyber Security Toolkit for Boards as a good place to start.

It remains to be seen whether these will one day be mandatory. But the status quo is not sustainable. At the very moment the stakes are rising, fewer respondents strongly agree they understand which regulations apply to them (41% down from 52% last year). Just a quarter (24%) of respondents say their security and compliance team is currently experiencing greater board-level scrutiny. And only a fifth plan on improving visibility and reporting of security risks to leadership.

Yet there’s another dimension to consider. Accountability at a board level is one thing, but over a quarter (27%) of respondents say AI security accountability is shifting from the security team to individual staff. And a growing share (73% versus 67% last year) say AI is blurring traditional security roles. As more consequential decisions are made by AI users, and the agents they delegate tasks to, ensuring there are named owners and strict governance frameworks in place will be more important than ever.

This ultimately brings us back to where we started. AI is the great disruptor. To fully harness its transformative potential, organisations must think carefully about the frameworks they put in place to govern its use. There’s no time to waste.