ESG study reveals prevailing problem of under-prioritized security technology

HONG KONG SAR - Media OutReach - 29 January 2021 - (;), the leader in cloud security, shared results from a sponsored study conducted by the Enterprise Strategy Group (ESG)[1] that reveals systemic challenges with security integration into business processes. The report includes the top ways to drive engagement and agreement around cybersecurity strategies within an organization.

Read a full copy of the report, Cybersecurity in the C-suite and Boardroom (https://resources.trendmicro.com/rs/945-CXD-062/images/ESG-eBook-TrendMicro-Cyber-C-Suite-Boardroom-Dec2020.pdf), or watch this webinar to learn more (https://resources.trendmicro.com/WBN-ESG-Cybersecurity-Boardroom.html?linkId=109490866).

The study found that only 23% of organizations prioritize the alignment of security with key business initiatives. Here are three key recommendations to remedy this core challenge:

1. Add a Business Information Security Officer (BISO) to improve business-security alignment.
2. Build a top-down, measurable program to help CISOs better communicate with their boards.
3. Change reporting structures so CISOs report direct to their CEO.

The study also found that when board members are more educated and engaged in the cybersecurity function, they ask tougher questions, dig deeper into issues, and are more likely to make the leap from technical to business issues.

The vast majority (82%) of survey respondents claimed that cyber risk has increased in the past two years, thanks primarily to a rise in threats, an expanding corporate attack surface and the fact that business processes are more dependent than ever on technology.

Yet despite the rapid adoption of digital transformation processes in the past year, security is still viewed as primarily (41%) or entirely (21%) a technology area.

The lack of cybersecurity prioritization is particularly true in the boardroom. Although 85% of respondents claimed that the board of directors are more engaged in security decisions and strategy than two years ago, often those executives are passively drawn in because of a major breach, new compliance requirements or the creation of a security program by a CISO.

In fact, 44% of respondents indicated that their board of directors have limited involvement in many critical cybersecurity operations. This lack of engagement means many boards are only prepared to fund the bare minimum to meet requirements for compliance and protection.

"Striving for 'good enough' security is frankly not good enough given today's cyber risk landscape. This report mirrors many of my conversations with CISOs highlighting that lack of boardroom engagement can lead to poor cyber hygiene, and security that is not properly integrated into business processes," said Ed Cabrera, chief cybersecurity officer for Trend Micro. "We can only create a culture of cybersecurity if CEOs and corporate directors lead by example. This encourages every employee to believe they have a role in protecting the organization."