Cybersecurity Must Deliver More Value

Cybersecurity has a growing problem that will force an evolution across the industry. It needs to deliver more recognizable value. Cybersecurity must justify its growing costs by evolving from a solely protective function to also being a competitive advantage and contributing to the core goals of the organization. There is increasing pressure on cybersecurity as costs continue to rise every year. Over the long term, cybersecurity becomes insanely expensive. Global spending on cybersecurity products and services is estimated to be more than $1.75 trillion cumulatively between 2021 and 2025. Budget costs increase every year. Cybersecurity budgets typically go up by double digits, ranging from 9 to 15% every year. Let's take a moment to look at why cybersecurity costs continually go up. Cybersecurity deals with intelligent attackers, and those attackers bring innovation across technology, people, and process to the table. So they're constantly adapting to get around or undermine defenses to pursue their objectives. Cybersecurity has to constantly adapt. They have to be agile and understand the new attacks and then figure out good ways to either prevent or detect and respond to them. Now, new vulnerabilities are continually being discovered in systems that we use every day. Security researchers are hard at work trying to uncover those, and there are an insane number of vulnerabilities. On average, we see at least 7 new vulnerabilities in modern technology discovered every single day. And for each one, organizations need to figure if that applies to them, identify those systems, and then go off and patch or remediate them. Now, the computer environment that cybersecurity protects is also changing as the organization adopts new technology. So moving to the cloud, entirely new landscape. Moving to different operating systems, different vulnerabilities and problems arise there. Expanding to a new geography, you get the idea. Anytime IT makes a change, cybersecurity needs to figure out what those ramifications are from a security perspective. That takes time, effort, and maybe even new tools. Then you've got the rising consumer expectations for security, privacy, and safety. It wasn't that long ago that, well, consumers really didn't care all that much, but now it is becoming a purchase criteria that drives higher expectations and performance from executives to make sure that they're not undermining the trust of their customers. Now, there are also increased expectations from business partners. Typically nowadays, when you're establishing your supply chain, you're working with your suppliers and your vendors, or you are a supplier to somebody, there is an exchange of security questions. They want to know your posture, you want to know theirs, and if you do not have good security, there can be problems. Either no deal will be struck, or there could be some compensating controls that need to be put in place for that. Along those lines, cyber insurance— the requirements there are getting higher. If you want to have a policy, you don't want your premiums to be sky high, then you need to show that you've got a good security program. If it's not as good as the rest, your premiums are going to go up. If it's really poor, they simply may not insure you. And then we have to worry about all the regulations across all the countries and states and provinces all over the globe, because there are more cyber regulations that are coming out for protection or recovery or privacy, things of that sort. And again, cybersecurity has to deal with that and plays a role in all those different areas. And lastly, we have to worry about the scarcity of talent coming into the industry. There are millions of jobs open right now across the globe, and there's not enough cybersecurity talent to go around. When you don't have enough people to fill the jobs, what tends to happen is the competition, the prices go up, and now organizations have to do two things. One, they have to spend more money to bring new talent into their organization to meet security needs. But on the other hand, they also have to spend more money and time and effort on the people that are currently there so that they're not harvested by outside sources and leave the company. So this all drives up operating costs. And these factors aren't going to subside anytime soon. And additionally, cybersecurity policies, tools, and processes can create friction that slows down the organization, and nobody likes that. Often cybersecurity is looked as an impediment to the business. Managing cyber risks is balanced with those costs, and that acceptable level of friction to users and workers. And those costs and friction are very apparent and can definitely be measured. You know those pain points. However, quantifying the value of reducing risks is very problematic, which leads to unfair debates when it comes down to budgets. Every year, organizations fight over budget allocation, and it is a zero-sum game. And you're fighting for resources, scarce resources, limited resources against profit centers, and they have hard numbers to show what they're contributing to the organization. Security, on the other hand, is really about avoiding loss.— and measuring something that does not occur because you successfully avoided it or deterred it is near impossible. And if something bad does happen, is it a lesser version because of security? It's really difficult to tell. The result is often no clear and absolute justification for spending, but rather qualitative descriptions of value. And although those are good, they tend not to stand up very well against profit centers when they can come in with clear, hard numbers showing how they're contributing to the bottom line. So security is destined to be unappreciated, which is a downward spiral that leads to more negative impacts. Thereby undermining the group's reputation, and the cycle accelerates further. It is a vicious situation and not sustainable in the best of times, and especially not tenable during a global economic downturn. Cybersecurity is often one of the first to experience cuts or denial for budget increases even for those that will maintain risk parity with the growing challenges. Something must give. Darwin stated that the most adaptable survive. This general rule is true in business, conflicts, and cybersecurity. To remain effective and appreciated, savvy cybersecurity leaders are transforming their organizations to provide more value and command equitable respect among competing business groups. In today's digital age, where businesses and individuals are becoming more reliant on technology, the threats posed by cyber attackers are escalating and driving consumers to view security as a purchase criterion. Now, this opens new opportunities for cybersecurity to play a crucial role in tapping into consumers' growing demands. Cybersecurity can help close deals, provide compelling marketing content for sales and brand elevation, open doors for advantageous partnerships, allow entry into new markets, grow market share, raise average selling prices, enhance profit margins, and in some cases generate new revenue streams. Cybersecurity must purposefully adapt to deliver outcomes that support business goals. Cybersecurity must evolve from a cost center to a profit center if possible. Cybersecurity is often architected and run to be a cost center, a necessity where the goal is to spend the absolute minimum because it doesn't directly contribute to the bottom line like profit centers do. However, there are growing opportunities as consumers begin to recognize and appreciate security, privacy, and safety. It becomes a purchase criterion, and anytime something can motivate people to spend money, it has a value story. Expanding beyond entry-level compliance and protection to avoid losses may be the adaptation that elevates cybersecurity to a new level, fundamentally changing how the organization is appreciated. The next logical step is becoming an enabler of the business for a competitive advantage story, followed by additional incremental value, and finally the pinnacle for some organizations organizations is to leverage cybersecurity to generate new revenue. And yes, it is possible for many organizations. The scope of each has a different value story and beneficial impact. The first block is compliance, doing the minimum necessary to meet regulations and contract requirements. The focus is on meeting an attestable requirement and is often greatly detached from the concepts of actually managing cyber risk. Regulatory compliance is not managing cyber risks. It's not the same thing. The second block, which should be closely intertwined with the first, is avoiding loss. Now, this is the traditional block and tackling that most cybersecurity organizations focus on. It is intended to prevent or lessen the effects of cyber attacks like data breaches, ransomware, digital fraud, things of of that sort. And compared to compliance, risks are better understood and controls are instituted to more effectively manage those risks. There are often untapped opportunities even in this area, which can clearly showcase value, such as the cost savings from lower cyber insurance premiums and negotiating lower costs for vendor or partner agreements. Because better security posture and resilience does make a difference. The third block is competitive advantage. This is where emphasis and resources are committed specifically to helping current profit centers achieve revenue goals. Efforts are often directed at brand uplift, competitive feature parity, market messaging enhancement, operational stability, resilience, and product differentiation. For example, refining compelling marketing messages which highlight security features that consumers are interested in to improve sales totals and deal closure rates. Security can also enable the opening of new markets which have stringent regulations for digital security, privacy, and attestability. The fourth block is adding value, enhancing current products and services with desirable security features, incremental associated benefits, and a better reputation for operational trustworthiness. These efforts are designed to help increase the average selling price of offerings. Directly contribute to gaining market share, and positively impact profit margins. For example, integrating meaningful security features to enhance competitive differentiation. In some cases, security, privacy, and trust can be used for non-traditional brand campaigns that give a decisive advantage in resonating with target audience. Apple recently did this where their marketing campaign shifted away from the speed of their processor, the amount of memory, or the interface resolution, and moved to start talking about how privacy was important and that their products and their ecosystem respected the privacy of their customers. Apple's competitors had nothing to say about that. They simply could not compete in those terms. Another way is to prepare for opportunistic moments when competitors, let's say with less commitment to security, suffer outages due to cyber attacks. And this becomes an opportunity to grow market share if you can show how your customers didn't suffer because of the security features and yet the customers of your competitor did. You can attract some of those fleeing customers and grow market share. The fifth block here is about profit generation, and these are exclusive security features that can drive new revenue as part of a good, better, best strategy, such as moving customers from maybe a freemium tier to a paid subscription model. Or establishing a higher tier that just includes security assurances. It can also manifest in producing entirely new adjacent security products and services that may be brought to market. Revenue from these types of offering can be directly attributed to security. It is important to note that in some sectors, it's unlikely or not applicable for cybersecurity to bring in revenue, such as government agencies, or potentially education sector. But there are opportunities for most businesses to greatly improve their relevance and contributions now and in the not-so-distant future. CISOs can pursue such transformations to attain a more compelling position for budgetary considerations and internal political clout. Evolving to provide more meaningful business value results in far different conversations about budgets, prioritization, and potential cutbacks. Being a competitive advantage, adding value, and generating profit is the core language for business executives' attention. It can solidify respect for the security teams, showcase leadership, and contribute to the bottom line value of the company. So change is inevitable. The cybersecurity industry is not currently positioned for long-term success. We must recognize what we are doing wrong. We are challenged with year-over-year increasing spending, even if we want to maintain our risk posture. Having a cost centers group's budget increase double digits each year is not sustainable. It could eat away all profit and become a major impediment to business survivability. Cybersecurity is challenged with clearly quantifying how losses are avoided while profit centers can showcase revenue. Lastly, we often do not build our organizations to be an active and direct contributor to the overall business goals. It needs to be done with forethought. It needs to be a very succinct connection. Now, without adaptation to reconcile these issues, we may wither and die over time. Cybersecurity must balance risks and opportunities. Cybersecurity is a trust builder and can be an innovation sandbox. Those purposely making the shift and beginning to embrace cybersecurity as a competitive advantage can also benefit from enhanced business innovation and growth. By integrating security into the core of the product design and business operations, organizations can enable the deployment of new products and services. When customers see that a vendor prioritizes security, they are more inclined to engage in critical transactions or those involving sensitive information. Trust is fostered, and that can pay dividends. This opens up opportunities for new revenue streams and expansion into previously untapped markets. By embedding cybersecurity practices throughout the organization's value chain, from product design to customer customer support, it becomes a catalyst for business growth and a source of differentiation from competitors. I will close with an important insight that this value transformation, it really requires visionary leadership. It is not easy, and for most CISOs, it doesn't even seem natural. Beyond the compliance and protection from cyberattack-related benefits, Cybersecurity transformations can enable the business and contribute to profitability. Capable leadership is essential to meet this goal. Making the transition is as tough as climbing a mountain, but it is being done by visionary leaders right now. These people have looked beyond the risks and are also evaluating the opportunities. Trailblazing CISOs are purposefully maneuvering their organizations to contribute value in new and unexpected ways to showcase the potential contributions of cybersecurity in the digital age. A value transformation is inevitable in the future of cybersecurity. It is part of the brutal evolutionary cycle that culls the weak and stagnant while permitting the most adaptive to survive. Those who do not make the transition successfully will be starved of resources, undervalued, and blamed for high costs and ineffectiveness. The loss of morale will ensure a turnover that will be high, and without solid foundations, cybersecurity withers and dies. Eventually, in a spectacular fashion. Consequently, customers' trust in the company then follows after that. Cybersecurity must re-envision itself to both protect and become an active contributor to the overarching business goals. Embracing this transformation is crucial for long-term success in the ever-changing cybersecurity landscape.