New research finds that despite being more engaged with cybersecurity, business executives and board members continue to view cybersecurity as a technology domain rather than a business concern. Credit: robynmac / Getty Images Somewhere around 2015, the security industry adopted a new mantra, “cybersecurity is a boardroom issue.” This statement was supported by lots of independent research, business press articles, webinars, local events, and even sessions at RSA and Black Hat crowing about the burgeoning relationship between CISOs, business executives, and corporate boards.Has anything really changed since then?To find out, ESG surveyed 365 senior business, cybersecurity, and IT professionals at organizations in North America (US and Canada) and Western Europe (UK, France, and Germany) working at midmarket (i.e., 100 to 999 employees) and enterprise-class (i.e., more than 1,000 employees) organizations. As it turns out, there’s good news and bad news here. The good news is that cybersecurity is indeed a boardroom level issue. The bad news is that we are nowhere near where we should be. For example: Cybersecurity is still perceived as primarily a technology issue. Twenty-eight percent of respondents believe cybersecurity is entirely a technology area, while 41% say that cybersecurity is mostly a technology area with some emphasis on the business aspects of cybersecurity. Alarmingly, 11% still think of cybersecurity as a regulatory compliance area alone. All of this means that boardroom-level discussions about cybersecurity center on things like open software vulnerabilities and numbers of incidents detected rather than securing customer communications, getting employees onboard, or building cyber-resilience into critical applications and business processes. Same old priorities with a few more discussions. CISOs are viewed as technologists. While just over half of all organizations consider the CISO a business executive, the other half of organizations still perceive CISOs as an IT role only. Heck, some firms see CISOs as little more than glorified firewall administrators. CISOs in this camp get little facetime with executives or boards; when they do, it’s usually to answer questions rather than provide any proactive input. Cybersecurity remains antithetical to corporate culture. Under half (44%) of organizations claim that employees’ commitment and buy-in to cybersecurity is “very good.” The other 56% say it is adequate, fair, or poor. So, while CISOs proclaim that ‘cybersecurity is everyone’s job,’ most organizations aren’t pushing this philosophy to rank and file employees.Business managers have little to no cybersecurity responsibilities. Similarly, only 29% of organizations claim that non-technical managers have cybersecurity responsibilities like classifying sensitive data, aligning employee roles with access policies, or working with cybersecurity managers on business planning. From my experience, business executives tend to think of these things as checkbox exercises to be done as quickly as possible. This and other data from the report indicates a cybersecurity dichotomy: Yes, boards and executives are more engaged with cybersecurity, but they retain an “us and them” mentality. Business executives and boards drive business decisions; CISOs are tasked with bolting on technical security controls and cleaning up messes as they occur.We weren’t wrong in 2015 when we declared that cybersecurity was a boardroom issue: Based on the ESG research, it appears that after years of neglect, boards and executives finally started paying attention to cybersecurity around 5 years ago. Since then, the cybersecurity industry has been busy patting itself on the back for any incremental progress. If your doctor warned you that you needed to lose 50 pounds, you wouldn’t declare victory when you dropped 5 lbs. after a month. Unfortunately, that’s what’s happening with cybersecurity in the boardroom and C-suite. At most organizations, there’s a lot of hard work ahead. Now, before I come off as Chicken Little, the data also indicates that there are organizations going beyond the basics. These firms have made significant progress with cybersecurity as an essential component of business mission, culture, and strategy. Furthermore, some organizations have reaped benefits like stronger security efficacy/efficiency, greater ROI on cybersecurity investments, and improved business flexibility. What’s their secret? More on that soon. Related content analysis 5 things security pros want from XDR platforms New research shows that while extended detection and response (XDR) remains a nebulous topic, security pros know what they want from an XDR platform. By Jon Oltsik Jul 07, 2022 3 mins Intrusion Detection Software Incident Response opinion Bye-bye best-of-breed? ESG research finds that organizations are increasingly integrating security technologies and purchasing multi-product security platforms, changing the industry in the process. By Jon Oltsik Jun 14, 2022 4 mins Security Software opinion SOC modernization: 8 key considerations Organizations need SOC transformation for security efficacy and operational efficiency. Technology vendors should come to this year’s RSA Conference with clear messages and plans, not industry hyperbole. By Jon Oltsik Apr 27, 2022 6 mins RSA Conference Security Operations Center opinion 5 ways to improve security hygiene and posture management Security professionals suggest continuous controls validation, process automation, and integrating security and IT technologies. By Jon Oltsik Apr 05, 2022 4 mins Security Practices PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe