What CEOs Don’t Know About Cyber Security: Study from CyberArk

By Eric Noonan • July 5, 2016

A recent global study sheds light on the current gap between executives and their organization’s security. The study, conducted by Dimensional Research (commissioned for a project by CyberArk), surveyed the opinions of 308 IT security professionals worldwide and captured hard data on enterprise security awareness at the executive level. While more and more organizations are quickly increasing their focus on security to stay out of today’s almost weekly headlines of multimillion-dollar security breaches and lawsuits, this study shows executives, in general, are far behind the curve. Here are some highlights from the study:

Compliance (Still) Does Not Equal Security

Results showed that executives are often still relying too heavily on compliance metrics. 79% of IT security professionals surveyed said they report on compliance metrics to demonstrate the effectiveness of their enterprise’s security, while 59% of them believe that threat detection metrics are actually most important. Relying on compliance metrics can be temptingly easy for CEOs to feel complacent about their organization’s security programs. For the CEO traditionally focused on the many facets of the business side of their organization, cybersecurity is a daunting and amorphous problem to grasp. It is important to use compliance as leverage and push further for context for responsible levels of information protection. Learn more on how to Leverage Compliance as an Enabler of Cyber Security.

Executives are Not Asking the Right Questions

Checking the compliance box can be just as easy for IT security professionals, especially if that is all that is asked of them. According to the study, 61% of respondents said they think their company’s chief executive doesn’t know enough about cybersecurity. The study also discovered “60% of the IT security professionals believe their organization can be breached, and one-third of CEOs and 43% of management teams are still not regularly briefed on cybersecurity issues.” This indicates that security professionals are too often briefing their executives on too little and wrong information. Executive teams need to ask their security professionals for more than compliance and system availability metrics; they need to also ask them for the information that they think really matters. For more, see The Five Questions CEOs Should Ask to Improve Security.

When and How to Effectively Improve Security

“53% of IT security professionals said their CEO makes business decisions without regard for security implications, and 44% said their CEO doesn’t grasp the severity of the risks facing the organization.” Without experienced and trusted IT security leadership, it can be very difficult to know when and where to divert precious company resources to effectively improve the organization’s security. The study also sought the main barriers for improving organizational security, some of which were: “In the face of a growing cybersecurity skills gap, 53% cited the lack of expertise as a primary barrier; and 75% of respondents cited budgeting issues as the primary barrier to improving cybersecurity.” They also cited the top two organizational security priorities in 2016 as being endpoint security and privileged account security. For help with this organization-wide challenge, see Two Essential Elements of an Effective Cyber Security Program.

CyberSheath Blog

2022 in Review: The CyberSheath Story Expands

This year marked a deluge of messaging about the Cybersecurity Maturity Model Certification (CMMC) and federal contractors were rightfully confused. With our keystone event, CMMC CON, we aimed to set the record straight and offer the best guidance for those in the Defense Industrial Base (DIB).   CMMC CON 2022…

CyberSheath Endorsed by Frost & Sullivan in First Independent Analyst Commentary on CMMC

Independent analyst firms have weighed in with commentary on nearly every discipline of information technology. Security has garnered a large portion of that IT discussion, yet until recently, Cybersecurity Maturity Model Certification (CMMC) compliance has been left out.   Frost & Sullivan changed that by selecting CyberSheath as its preferred…

Be Prepared: CMMC 2.0 Is Coming

Cybersecurity is increasingly important to safeguard your company, your customers, and your partners. We're moving into a global cyber era and we've got to get better at protecting ourselves.   Our adversaries are capitalizing on the lack of security controls in place in the defense industrial base (DIB) and we…

Our Trusted Partners

Tenable Microsoft Siemplify KnowBe4 ConnectWise DUO