Security tools fail to translate risks for executives
Organizations are struggling with internal communication barriers, which hinder their ability to address cybersecurity threats, according to Dynatrace.
The results indicate that CISOs encounter challenges in aligning security teams with the C-suite, resulting in organizational gaps in understanding cyber risk. As a result, they find themselves more exposed to advanced cyber threats, at a time when AI-driven attacks are on the rise.
The report was based on a global survey of 1,300 CISOs and ten interviews with CEOs and CFOs in enterprises with over 1,000 employees.
CISOs face organizational challenges with C-level executives
CISOs struggle to drive alignment between security teams and the C-suite, with 87% of CISOs saying application security is a blind spot at the CEO and board level.
Seven out of ten C-suite executives interviewed say security teams talk in technical terms without providing business context. However, 75% of CISOs highlight the issue is rooted in security tools that cannot generate insights that C-level executives and boards of directors can use to understand business risks and prevent threats.
Addressing this technology and communications gap is becoming more critical as the rise of AI-driven attacks and cyber threats significantly increase business risk.
Against this backdrop, 72% of CISOs say their organization has experienced an application security incident in the past two years. These incidents carry significant risk, with CISOs highlighting the common consequences they’ve experienced, including impacted revenue (47%), regulatory fines (36%), and lost market share (28%).
“Cybersecurity incidents can have devastating consequences for organizations and their customers, so the issue has rightfully become a critical board-level concern,” said Bernd Greifeneder, CTO at Dynatrace.
“However, many CISOs are struggling to drive alignment between security teams and senior executives because they’re unable to elevate the conversation from bits and bytes to specific business risks. CISOs urgently need to find a way to overcome this barrier and create a culture of shared responsibility for cybersecurity. This will be critical to improving their ability to respond effectively to security incidents and minimize their risk exposure,” added Greifeneder.
CISOs emphasize DevSecOps automation in risk mitigation measures
The need to drive closer engagement between security teams and the C-suite is becoming more important as the rise of AI exposes organizations to added risk. CISOs are concerned about AI’s potential to enable cybercriminals to create new exploits faster and execute them on a broader scale (52%). They are also concerned about AI’s potential to allow developers to accelerate software delivery with less oversight, leading to more vulnerabilities (45%).
As they look for a solution, 83% of CISOs say DevSecOps automation is more important to manage the risk of vulnerabilities introduced by AI. Additionally, 71% of CISOs say DevSecOps automation is critical to ensuring reasonable measures have been taken to minimize application security risk.
A further 77% of CISOs say current tools such as XDR and SIEM solutions cannot manage cloud complexity, as they lack the intelligence needed to drive automation at scale, and an additional 70% of CISOs say the need for multiple application security tools drives operational inefficiency due to the effort needed to make sense of disparate sources of data.
“The growing use of AI is a double-edged sword, creating efficiency gains for both digital innovators and those seeking to breach their defences. On the one hand, there’s a greater risk of developers introducing vulnerabilities through AI-generated code that has not been adequately tested, and on the other, cybercriminals can develop more automated and sophisticated attacks to exploit them,” continued Greifeneder.
“Adding further pain, organizations must also comply with emerging regulations such as the SEC mandate, which requires them to identify and report on the impact of attacks within four days. Organizations urgently need to modernize their security tools and practices to protect their applications and data from modern, advanced cyber threats. The most effective approaches will be built on a unified platform that drives mature DevSecOps automation and harnesses AI to deal with distributed data at any scale. These platforms will provide the insights the entire business can rally behind and use to demonstrate compliance with stringent regulations,” concluded Greifeneder.
“CISOs’ focus on technical intricacies may obscure the broader context of business strategy and risk management. Conversely, the C-suite often views cybersecurity as just one of many operational concerns. CISOs need to develop a holistic understanding of cybersecurity’s significance in support of the organization’s business imperatives ( e.g. revenue generation ) rather than working under an assumption that the business needs to operate in support of a cyber security agenda. It does not! Both the C-Suite and CISOs must transcend their perspectives to understand cybersecurity’s role in a wider business context. Only then will progress be made in any meaningful sense,” Chris Denbigh-White, CSO at Next DLP, told Help Net Security.