Disconnect between security and business goals had negative consequences for 94% of respondents and increased the success of cyber-attacks at one in four companies
Delinea, a leading provider of solutions that seamlessly extend Privileged Access Management (PAM), announced findings from a global survey of IT Security Decision Makers (ITSDMs) from across the globe – including the UAE and Saudi Arabia – revealing the impact of misalignment between the cybersecurity function and wider business.
Asked about the Board and C-Suite’s understanding of cybersecurity across the organization, only 37% of respondents in the UAE and Saudi Arabia think their company’s leadership has a sound understanding of cybersecurity’s role as a business enabler. Over a third (34%) of respondents believe that it is considered important only in terms of compliance and regulatory demands, while one in five said it is not seen as a business priority. Furthermore, just over half of respondents (55%) believe that there is a “strong alignment” between business and cybersecurity objectives.
The disconnect appears to have caused at least one negative consequence to 94% of regional respondents’ organizations, with more than a quarter (28%) also reporting it resulted in an increased number of successful cyber-attacks at their company.
The impact of misaligned goals on the cybersecurity posture of organisations in the UAE and Saudi Arabia was wide-ranging as it contributed to delays in investments (42%), delays in strategic decision making (41%), and unnecessary increases in spending (33%).
There were also consequences for the individuals themselves, with 31% of regional respondents reporting it impacted the whole security team in terms of stress. Furthermore, global economic uncertainty has worsened the situation with the majority of those surveyed (61%) stating that aligning cybersecurity and broader business goals is becoming more difficult to achieve as a result.
Metrics and processes don’t focus on business outcomes
Structural processes are key to aligning goals and, encouragingly, the survey revealed that over two thirds of security teams (68%) meet regularly with their business counterparts at the highest level. Additionally, the majority 62% of companies in the UAE and Saudi Arabia have also embedded security team members within business functions. However, the research showed there is still room to improve, as half of organisations are not documenting policies and procedures to facilitate alignment, and a further 39% reported that alignment is ad hoc and only ‘happens when needed.’
The report also brought to light that metrics used to measure and demonstrate the value that cybersecurity delivers. Interestingly, improved experience for business users (33%) was cited as the most important measure of success, followed by more technical and activity-based metrics such as meeting compliance objectives (32%) and reducing costs of security incidents (29%).
”While security teams appear to be more ingrained into the organisational processes, it is clear that the majority of regional enterprises still fail to consider cybersecurity as a competitive advantage,” said Mohammad Ismail, Regional Director – Middle East, Delinea. “What’s more concerning is that our report shows that this disconnection translates into delayed investments, which put the business at risk, It is time for company leaders to reassess their approach to cybersecurity – seeing it as not just as an obligation, but as a profit center.”
“Cyber security can be a huge business enabler, but this research reflects that there is still some work to do at the board level in shifting mindsets. Executive leaders need to think of cybersecurity not only in terms of ticking the compliance box or protecting the company, but also in terms of the value it can deliver at a more strategic level,” said Joseph Carson, Chief Security Scientist and Advisory CISO at Delinea.
Making the business case to the board: gaps in ITSDM skillsets and changing lines of reporting
Building out business skillsets may provide the path to better alignment, however respondents in the UAE and Saudi Arabia listed technical skills as the most valuable for cybersecurity leaders to possess. These are rated above skills such as communication, collaboration, business acumen, and managing people.
Half (50%) of interviewees believed that making the business case to their Board and C-Suite was a gap in their own skillset while communication skills and the ability to manage stressful situations were recognized as areas for improvement by 42% of respondents.
Aligning goals also involves reviewing the reporting lines and CEO-level visibility. However, the Delinea survey suggests that there is little appetite for change in reporting structures, as less than a third (31%) of regional ITSDMs believe the CISOs or the most senior cybersecurity leaders should report to the CEO to best align cybersecurity with the overall goals of the business.
“Alignment between cybersecurity and business goals is essential for success. This research clearly highlights the negative consequences when teams’ objectives aren’t fully in sync. Ensuring common agreement across business functions is vital and there is a real value in metrics that not only measure security activity, but which also demonstrate the impact on business outcomes,” Carson added. “Communication is key, and while strong technical skills are still important, security leaders need the ability to communicate, influence and present the value they add to business outcomes more frequently than ever. Security leaders that demonstrate this mix of skills, and that have the same end goal in sight as the business, are a force to be reckoned with.”
