What cyber risks will cripple my business? Do my security people know what is going on?
These two questions can set your course to become cyber safe in 2025.
A "cyber safe" company manages cyber risks as business risks. Today's business leaders embrace this concept at a broad level, knowing that they should support security training, technologies, and digital business resilience practices such as backups and better passwords.
Yet, cybercrime keeps growing, threatening costs exceeding $15 trillion by 2030, and cybersecurity costs keep rising. Businesses need to focus on security fundamentals if they want to remain secure and maintain reasonable security budgets. Those two questions will help you achieve both outcomes.
Prioritise security with business risks
You are spending more and more on security, yet you are not necessarily safer than before. You focus on cyber risks, but have you asked:
"What cyber risks will cripple my business?"
Not all cyber risks pose the same threats, yet most companies try to address all (or most) of them at once through lavish spending and compliance box-checking. These approaches feel better because you experience quick delivery and satisfaction. But soon enough, a new risk requires more spending and implementation. Are you really safer?
Cybercrime statistics suggest you are not because you try to take care of everything. New frameworks such as Gartner's Continuous Threat Exposure Management (CTEM) instead advocate prioritising cybersecurity spending and solutions based on their crucial business impact.
Identify and mitigate risks that are most likely to harm operations. For example, look at executive correspondence:
What damage can it cause if those messages land in the wrong hands?
Who has access to those systems, and are they trained in appropriate security knowledge?
Are their devices (laptops, PCs, mobile devices) secured comprehensively?
Are the affected messaging systems (email servers, messaging platforms) secure?
Can security and technology teams monitor those systems?
You will achieve more by focusing most of your efforts on such critical areas instead of trying to cover most cyber risks. Over time, you'll expand to manage lesser risks as well. But ultimately, criminals are after your most crucial business areas. Identifying cyber risks around critical business areas is much more effective and efficient than a wholesale security approach.
Increase visibility for your IT and security teams
If you don't lock your doors, someone might sneak in. If you don't invest in your assets, they start to underperform and break down. Such risks are physically apparent and relatable. But cyber risks exist in a complex, layered, and convoluted virtual landscape. While companies pursue a digital risk agenda, they don't always enable their people to monitor those abstract areas. Thus, the second crucial question is:
"Do my security people know what is going on?"
Most cyberattacks use known exploit vulnerabilities (KEVs). Often, a simple patch or reconfiguration can prevent those exploits, yet companies fail to enact those changes. Why? They are often not aware of the flaw in their systems, they struggle to find windows of opportunity to address those problems, or they are concerned that fixing the flaw will have negative knock-on effects on other systems or business processes.
All three cases relate to a lack of visibility that technology teams, system stakeholders, and company leadership can use to craft calculated responses to security risks and threats. A common issue is that security and technology teams rely on monitoring tools with limited scope and delayed output. Most monitoring tools are not agnostic and only focus on specific vendor technologies, creating reporting silos and oversight blind spots.
There are several telltale signs of such issues:
Teams cannot provide accurate numbers of active devices and services.
It takes days, weeks, or longer to consolidate logs and reports.
Security professionals spend most of their time on reporting.
There is a considerable and growing backlog of system patches and updates.
The company has a patchwork of legacy, outdated, and isolated security systems.
You can change this dynamic with agnostic attack surface management (ASM) security monitoring and reporting tools. Such tools, such as Performanta's Encore ASM platform, draw information directly from security appliances and services, radically improving audit and awareness, not to mention saving time.
Two questions for 2025
Cybercrime threats are growing. So are cybersecurity costs. But by asking, "What cyber risks will cripple my business?" and "Do my security people know what is going on?" you can improve the value and impact of your security investments while reducing their overall costs.
Performanta embraces this philosophy. We have developed in-house and integrated security systems that support prioritised risk discovery and mitigation. This includes our Risk Operations Centre, a collective of business and security skills and systems that help our clients become sustainably cyber safe.
Comments