COMMENTARY: Ideally, cybersecurity leaders should act as a bridge between business and technical worlds, discussing ransomware attack patterns with security analysts one minute and budget priorities with board members the next.In practice, even experienced leaders can struggle to communicate risk in a way that resonates with business executives. The challenge becomes particularly acute in smaller organizations that can’t afford a dedicated chief information security officer (CISO).The problem: most cybersecurity metrics don’t translate to the language of the boardroom.Board members typically want specifics: What business outcomes can we expect from this investment? What key performance indicators (KPIs) will measure success? Where are we now, and how does that compare to this quarter last year?[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]These are reasonable questions. Yet traditional security metrics rarely deliver satisfactory answers. Fortunately, that’s changing. A new generation of platform-based cybersecurity tools can help organizations of all sizes connect the dots between tactical activities and strategic outcomes. Just as we can quantify sales or financial performance, we can now offer up cybersecurity as a quantifiable business KPI.No holistic view of posture: The most fundamental business-level cybersecurity question has always been: Where do we stand today? Yet most organizations still lack tools to quantify overall security posture, much less measure it across business units and domains. Inability to link tactical activities to risk: Many security teams still focus primarily on detection and response, without devoting sufficient attention to proactive measures such as employee security awareness training. But without a baseline posture and a way to quantify the impact of strategic interventions, security leaders will struggle to articulate a return on investment (ROI). Siloed tools and data: Intentional or not, security vendors have also impeded business-level visibility. Individual cybersecurity tools are more powerful than ever, capable of mitigating almost every type of threat. But as these tools grow more specialized, they’ve become more fragmented. The more disparate tools and datasets used, the harder it is to articulate risk at the overall business level. Compounding the problem, different departments may use different tools, making it even harder to tie individual investments to outcomes or prioritize risks. Together, these issues make cybersecurity seem like an abstract, unquantifiable concept — an impression that does no favors for investment planning or executive alignment.Track changes over time: Just capturing a baseline makes it possible to measure progress in security activities. For example, it’s hard to justify a large budget request for security awareness training if top decision-makers aren’t well-versed in phishing and other socially engineered threats. But if we can show that our rating for ransomware preparedness improved from C+ to B+ over the past two quarters, that’s easy to communicate. Measure and model ROI: With security ratings at multiple levels, it’s also easier to tie specific actions — like adopting multi-factor authentication (MFA), implementing secure code reviews, or launching new training programs — to business-level KPIs. More importantly, we can model ROI in concrete terms: Today, we rate a C in cloud security posture, but with a $1 million investment, we can reach an A in nine months. Prioritize investments based on risk: When we track posture scores across different business units we can show where controls work and where we must pay more attention. These metrics also let teams anticipate risk rather than just react to it. We can identify where vulnerabilities exist — say, a remote engineering team using cloud development environments — and target resources accordingly. Benchmark against industry standards: The ability to link posture ratings directly to industry standards and track them over time promises multiple benefits, including lower cyber insurance premiums, easier compliance, and increased confidence among investors and customers. Ultimately, cybersecurity leaders gain the ability to have more meaningful conversations with stakeholders. By shifting the conversation from technical jargon to measurable business outcomes, security leaders can earn a seat at the strategy table — and keep it.Manoj Srivastava, chief product officer and CTO, Blackpoint CyberSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Security Operations, SOC, Security Strategy, Plan, Budget, Leadership
Four business metrics security pros can offer that C-Suite execs understand
(Adobe Stock)
Related Events
Get daily email updates
SC Media's daily must-read of the most current and pressing daily news
You can skip this ad in 5 seconds