What CEOs Don’t Know About Cyber Security: Study from CyberArk

By Eric Noonan • July 5, 2016

A recent global study sheds light on the current gap between executives and their organization’s security. The study, conducted by Dimensional Research (commissioned for a project by CyberArk), surveyed the opinions of 308 IT security professionals worldwide and captured hard data on enterprise security awareness at the executive level. While more and more organizations are quickly increasing their focus on security to stay out of today’s almost weekly headlines of multimillion-dollar security breaches and lawsuits, this study shows executives, in general, are far behind the curve. Here are some highlights from the study:

Compliance (Still) Does Not Equal Security

Results showed that executives are often still relying too heavily on compliance metrics. 79% of IT security professionals surveyed said they report on compliance metrics to demonstrate the effectiveness of their enterprise’s security, while 59% of them believe that threat detection metrics are actually most important. Relying on compliance metrics can be temptingly easy for CEOs to feel complacent about their organization’s security programs. For the CEO traditionally focused on the many facets of the business side of their organization, cybersecurity is a daunting and amorphous problem to grasp. It is important to use compliance as leverage and push further for context for responsible levels of information protection. Learn more on how to Leverage Compliance as an Enabler of Cyber Security.

Executives are Not Asking the Right Questions

Checking the compliance box can be just as easy for IT security professionals, especially if that is all that is asked of them. According to the study, 61% of respondents said they think their company’s chief executive doesn’t know enough about cybersecurity. The study also discovered “60% of the IT security professionals believe their organization can be breached, and one-third of CEOs and 43% of management teams are still not regularly briefed on cybersecurity issues.” This indicates that security professionals are too often briefing their executives on too little and wrong information. Executive teams need to ask their security professionals for more than compliance and system availability metrics; they need to also ask them for the information that they think really matters. For more, see The Five Questions CEOs Should Ask to Improve Security.

When and How to Effectively Improve Security

“53% of IT security professionals said their CEO makes business decisions without regard for security implications, and 44% said their CEO doesn’t grasp the severity of the risks facing the organization.” Without experienced and trusted IT security leadership, it can be very difficult to know when and where to divert precious company resources to effectively improve the organization’s security. The study also sought the main barriers for improving organizational security, some of which were: “In the face of a growing cybersecurity skills gap, 53% cited the lack of expertise as a primary barrier; and 75% of respondents cited budgeting issues as the primary barrier to improving cybersecurity.” They also cited the top two organizational security priorities in 2016 as being endpoint security and privileged account security. For help with this organization-wide challenge, see Two Essential Elements of an Effective Cyber Security Program.

Cybersheath Blog

CMMC Compliance Dashboard: Gain New Visibility into Compliance

CMMC is not a compliance framework. It’s a maturity model. That has big implications for how you approach compliance, but also how you keep track of all the elements that make up compliance. And yet, visibility has been one of the most difficult challenges facing DIB contractors. It used to…

CMMCEnclave: Add Versatility with a More Flexible Approach

The enclave approach to CMMC compliance is one of the most cost effective and least disruptive ways to safeguard CUI. You can maintain high-value custodial security of CUI without upending your existing processes, procedures, and people. That way, you can maintain the proper level of CMMC compliance and remain eligible…

How to Offboard Your Managed Services Provider

For any of a variety of reasons including lack of communication, slow response times, or prolonged downtime, your organization has decided to change your managed service provider (MSP). Whether you have already signed an agreement with a new MSP or you are actively looking for a replacement, now is the…

Our Trusted Partners

Cyberark McAfee Thycotic RSA Tenable Alien Vault Alert Logic Microsoft