What CEOs Don’t Know About Cyber Security: Study from CyberArk

By Eric Noonan • July 5, 2016

A recent global study sheds light on the current gap between executives and their organization’s security. The study, conducted by Dimensional Research (commissioned for a project by CyberArk), surveyed the opinions of 308 IT security professionals worldwide and captured hard data on enterprise security awareness at the executive level. While more and more organizations are quickly increasing their focus on security to stay out of today’s almost weekly headlines of multimillion-dollar security breaches and lawsuits, this study shows executives, in general, are far behind the curve. Here are some highlights from the study:

Compliance (Still) Does Not Equal Security

Results showed that executives are often still relying too heavily on compliance metrics. 79% of IT security professionals surveyed said they report on compliance metrics to demonstrate the effectiveness of their enterprise’s security, while 59% of them believe that threat detection metrics are actually most important. Relying on compliance metrics can be temptingly easy for CEOs to feel complacent about their organization’s security programs. For the CEO traditionally focused on the many facets of the business side of their organization, cybersecurity is a daunting and amorphous problem to grasp. It is important to use compliance as leverage and push further for context for responsible levels of information protection. Learn more on how to Leverage Compliance as an Enabler of Cyber Security.

Executives are Not Asking the Right Questions

Checking the compliance box can be just as easy for IT security professionals, especially if that is all that is asked of them. According to the study, 61% of respondents said they think their company’s chief executive doesn’t know enough about cybersecurity. The study also discovered “60% of the IT security professionals believe their organization can be breached, and one-third of CEOs and 43% of management teams are still not regularly briefed on cybersecurity issues.” This indicates that security professionals are too often briefing their executives on too little and wrong information. Executive teams need to ask their security professionals for more than compliance and system availability metrics; they need to also ask them for the information that they think really matters. For more, see The Five Questions CEOs Should Ask to Improve Security.

When and How to Effectively Improve Security

“53% of IT security professionals said their CEO makes business decisions without regard for security implications, and 44% said their CEO doesn’t grasp the severity of the risks facing the organization.” Without experienced and trusted IT security leadership, it can be very difficult to know when and where to divert precious company resources to effectively improve the organization’s security. The study also sought the main barriers for improving organizational security, some of which were: “In the face of a growing cybersecurity skills gap, 53% cited the lack of expertise as a primary barrier; and 75% of respondents cited budgeting issues as the primary barrier to improving cybersecurity.” They also cited the top two organizational security priorities in 2016 as being endpoint security and privileged account security. For help with this organization-wide challenge, see Two Essential Elements of an Effective Cyber Security Program.

CyberSheath Blog

Dr. Robert Spalding to Address Nation-State Attacks at CMMC Con 2021

Since the inaugural CMMC Con, we’ve seen some of the most malicious attacks on American infrastructure ever executed. The SolarWinds attack reverberated across the entire government as agencies scrambled to discover what nation-state attackers had accessed and stolen. The Colonial Pipeline, shut down by a ransomware attack, led to fuel…

CMMC-AB vice chair Jeff Dalton to address CMMC Con 2021

The swiftness and severity of recent cyber attacks has dominated headlines and revealed that many organizations still don’t quite know what to do to protect themselves, as well as the businesses and government entities they’re connected to.   Ransomware attacks were a big point of discussion at the recent G7…

CMMC Con 2021 Opens Registration, Reveals Theme and Speakers

CMMC compliance stands in the way of revenue for every defense contractor in the supply chain. Now that CMMC is a reality for the Defense Industrial Base (DIB), learn how contractors — primes and subs, large and small, foreign-owned — are handling the standards and requirements, as well as the…

Our Trusted Partners

Cyberark McAfee Thycotic RSA Tenable Alien Vault Alert Logic Microsoft

CMMC Con 2021 is here! Save your spot to hear the latest on CMMC from our expert speakers across the government and Defense Industrial Base.