RiskLens CEO Nick Sanna on Cyber Risk Quantification in 2023

Cybersecurity budgets under pressure…regulators tightening risk disclosure rules…breakdown in the cyber insurance market. As 2022 ended, a series of trends lined up that will set the agenda in 2023 for cyber risk and security leaders. At RiskLens, we hear from CISOs all the time with a consistent message: They need the risk measurement, management and communication tools that will position their organizations in front of the challenges ahead.

Those tools must be based on proven cyber risk quantification (CRQ) methodologies such as the Factor Analysis of Information Risk (FAIR™) to enable communicating risk in the financial terms that business leaders and regulators demand to know. With the right set of CRQ solutions, CISOs can:

• Discuss cybersecurity initiatives in terms of strategic business objectives

• Advocate for cybersecurity budget based on return on investment (ROI) for risk reduction

• Compare risk levels to industry benchmarks

• Present quantitative proof points to regulators that material risks are understood and being managed

Let’s look at the landscape for CRQ in 2023, both the opportunities and the challenges, and how RiskLens can help you:

Opportunities 

Macroeconomic Environment 

As companies face recessionary forces and pivot from growth to profitability, cybersecurity organizations are being forced to be more cost-effective. Many CISOs are being asked to trim or delay initiatives and face stronger scrutiny of existing programs. The justification required for all levels of spend is increasing, pressuring CISOs to up their game in building stronger business cases with the CIO, the CFO, and the business executives, which clearly speak to the business impact of cybersecurity initiatives.

New Regulatory Requirements in the US and Abroad 

Proposed rule and enforcement changes on cyber risk disclosures and board governance obligations by the Securities and Exchange Commission (SEC), the New York Department of Financial Services (NYDFS) in the US, the Australian Prudential Regulation Authority (APRA) as well as several European regulatory bodies, are expected to go into effect in 2023, and will require organizations to run formal cyber risk assessment programs, describe to the regulators how their programs work to identify material cyber incidents and measure the adequacy of security controls to drive risk down to an acceptable level.

Cyber Insurance Premiums on the Rise 

The explosion of cyber attacks during the pandemic broke the cyber insurance equation as claims exceeded premiums paid. This led to a major readjustment and increases in pricing that are forcing chief risk officers and CISOs to re-evaluate their coverage and to more diligently assess their coverage needs, including possibly self-insuring.

Availability of New Outsource Solutions and Benchmark Data for CRQ 

Many organizations do not have the competence, level of staffing or data to build cyber risk quantification programs in-house and need to rely on specialized third parties to benefit from CRQ.

New Controls Analytics Model Will Combine Automation, Defensibility, and Trust 

Traditionally, CRQ programs have relied on analysts’ interpretation of controls status for input into their CRQ calculations, based on telemetry from cybersecurity tools or on results of audit and testing. CISOs have been asking for ways to automatically analyze telemetry and factor it in cyber risk quantification to reduce reliance on risk analysts’ estimates whenever possible.

Challenges

Compliance activities sucking the air from everything else

Many CISOs share that the majority of their cybersecurity efforts are still focused on compliance, versus proactively managing risk, as regulators and internal IT audit continue to command their attention and resources to resolve those never-ending lists of findings, especially in regulated industries. Without a method to prioritize and triage those findings, many feel that they are never able to get their heads above water.

Seeing cyber risk quantification and management as a tool issue

The purchase of a CRQ tool alone will not ensure success, as it fails to recognize that the biggest challenge for the adoption of cyber risk quantification for many organizations is cultural. Moving to a more analytical, data-driven, and business-aligned way of measuring, managing, and communicating cyber risk is a big change in behavior for them and needs to be treated as a true program, with an organizational commitment that starts from the top.

Bad CRQ models

The emergence in the marketplace of “black box” CRQ tools that promise an “easy button” solution to quantitative analysis, in fact yielding unreliable, indefensible results from flawed risk models can be a distraction for organizations that are looking for trusted analytics that they can use for key reporting and decision-making.

Nick Sanna is CEO of RiskLens and President of the FAIR Institute.

*** This is a Security Bloggers Network syndicated blog from RiskLens Resources authored by RiskLens Resources. Read the original post at: https://www.risklens.com/resource-center/blog/risklens-ceo-nick-sanna-cyber-risk-quantification-in-2023