A study by WithSecure shows that organizations around the world lack a cohesive and strategic approach to cybersecurity investments.
Based on a survey of more than 400 global cybersecurity and IT decision-makers conducted by Forrester Consulting, the report states that many organizations are reactive in their approach to defending against threats and piecemeal when it comes to cybersecurity investments.
This creates a disconnect between security goals and business goals. To address this issue, the report recommends implementing an outcome-based security approach that aligns with business objectives.
This approach supports business goals rather than merely reacting to perceived vulnerabilities. The study found that only 20% of respondents said their organizations have complete alignment between cybersecurity priorities and business outcomes. However, 83% of respondents showed interest in or were planning to adopt outcome-based security solutions and services.
The report defines outcome-based security as cultivating only those capabilities that measurably deliver desired outcomes, as opposed to traditional threat-based, activity-based, or ROI-based methods. The outcomes should pertain to risk management, customer experience, resilience, visibility of the threat surface and risks, as well as skills, resources, response speed, and agility.
The study also found that 60% of the firms surveyed are reactive, not proactive, in their cybersecurity approach. In addition, 50% of firms struggle to measure cybersecurity value and have trouble articulating the contribution of security to business outcomes.
The study also listed challenges to extracting useful metrics that tie security priorities to business outcomes. The executives polled by Forrester listed difficulties in measuring cybersecurity value, capturing consistent and meaningful data, overcoming a paradox that investment in effective security results in fewer opportunities to demonstrate value, and translating cybersecurity metrics into something meaningful to the board.
The sources for this piece include an article in TechRepublic.
