Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Biggest Challenge in Cybersecurity

30 Jun 2022 · 4 min

Watch on YouTube

3:31

In this presentation, the speaker argues that the most pressing challenge for cybersecurity leaders in the coming years will not be a specific technical threat but the ability to convincingly convey the business value of security to executives and boards. He highlights two accelerating pressures: a global economic downturn that tightens non‑revenue‑generating budgets, and a relentless rise in cybersecurity spending—historically 12‑20% annually and recently spiking 60% in a single year. Because security is often viewed as a cost center, these forces threaten sustainable funding. The speaker stresses that security must be aligned with broader business outcomes, optimized for efficiency, and clearly articulated as a strategic asset. Failure to do so risks losing executive backing, leading to a downward spiral of under‑investment, increased vulnerability, and reactive funding only after incidents occur. He promises to explore this theme further through articles, blogs, videos, and conference talks (e.g., Sphere 2022 in Helsinki) and invites the audience to follow his Cybersecurity Insights channel for deeper analysis.

Chapters

In the next few years, the biggest challenge in cybersecurity won't be dealing with a specific threat, but rather conveying a meaningful value proposition throughout the organization, and especially to the C-suite and the board. It's key to the sustainability of cybersecurity and perhaps our biggest blind spot. Articulating value has always been hard, but two major factors are emerging to exacerbate the problem. First, the economy is in a downturn, and we can expect a tightening of budgets and spending not related to revenue generation. Now, this is a problem for cybersecurity and privacy, which are often seen as a cost center or an expense that can be trimmed during lean budgetary times. Now, the second issue is the cost of cybersecurity continues to rise every single year. We typically see in the 12 to 20% annual budget increases, and now a recent study showed a shocking 60% growth in budget for last year. This financial demand is not sustainable year over year for businesses. It just simply isn't. And Realistically, we don't see an end in sight. Quantifying the value of security has always been difficult, but now more than ever, cybersecurity must align itself to enable and deliver meaningful contributions to the overall business goals and definitively convey this value to secure continued investment and support. Failure to do so will undermine executive backing, and that's a downward spiral when faced with ever-growing threats. It's a road that'll lead to disaster, disillusionment, blame, and further disruption to the capacity to prevent future impacts from follow-on cyberattacks. That is why cybersecurity leadership across all sectors needs to begin maneuvering to optimize efficiencies, align to deliver outcomes that contribute to the business goals, and clearly articulate the overall value proposition. Those who fail will be fighting an uphill battle for funding and executive support that really only shifts when bad things happen. And that's not a good business model. I'm going to be talking more about the challenges of communicating cybersecurity value in articles, blogs, videos, and when speaking at conferences like I did recently during the Sphere 2022 conference in Helsinki, because it is so crucial to the durability of cybersecurity. This will be the next big challenge for CISOs, and there's a lot to unpack around the risks and opportunities. As always, come join me on the Cybersecurity Insights channel for more discussions and industry analysis. The link is below.