Engineer working in data center

Why now is the best time to reimagine cybersecurity

Photographic portrait of Steve

5 minute read 22 Oct 2021

Related topics

Transformation Realized

Technology leader's agenda

Companies must rethink how they view cybersecurity when accelerating digital transformation or risk greater exposure to new cyber attacks.

In brief

Organizations that accelerated digital transformation plans during the COVID-19 pandemic might have inadvertently introduced new cyber risks.
Companies need to leverage their digital transformation agenda to reimagine and implement cybersecurity as a strategic growth driver.
They also need to address key cybersecurity challenges by plugging talent gaps, adopting more flexible budgeting models and driving mindset shifts.

Over the last year, organizations accelerated their digital transformation plans to cope with the fast-changing business environment amid the pandemic. Yet, the stopgap technology solutions deployed during the initial stages of lockdown might have also inadvertently introduced potential vulnerabilities. Organizations might consequently find current levels of defenses inadequate for the security needs of the new normal.

According to the EY Global Information Security Survey 2021 (GISS), about three in four (73%) Asia-Pacific businesses highlighted that they saw an increase in the number of disruptive attacks over the past year, compared with just 47% in the previous year.

Number of disruptive attacks

of Asia-Pacific businesses said they saw an increase in the number of disruptive attacks over the past year.

As cyber threats grow, can businesses afford to downplay cyber issues, while continuing the digitalization path (and potentially create more risks), or should they leverage the transformation agenda to embed security by design across the organization?

Clearly, the latter must be the way forward, but organizations that embark on the cyber transformation journey must be prepared to overcome key challenges in plugging talent gaps, adopt flexible funding models and embrace cybersecurity as a value driver.

Cybersecurity, strategy, risk, compliance and resilience

Discover how EY's cybersecurity, strategy, risk, compliance & resilience teams can help your organization with its current cyber risk posture and capabilities.
Read more

Plugging talent gaps

Given the sophisticated nature of today’s cyber attacks, organizations need cybersecurity professionals with advanced technical skills. At the same time, there is a growing need for the cybersecurity function to expand its range of soft skills and professional qualifications that can build interdepartmental relationships and facilitate conversations on cyber transformations.

Hiring talent with skills of such breadth and depth is a tall challenge, which is compounded by the shortage and high turnover of sought-after cybersecurity talent in the market, especially when some parts of Southeast Asia are still in lockdown.

Bridging the cyber skills gap will require the effort of all stakeholders. Government schemes to attract new cyber talents and train existing ones are key to building a national talent pipeline. At the same time, organizations will need to adopt an end-to-end talent approach by improving hiring, retention, capability building and people development, as well as leveraging technologies to automate manual and labor-intensive tasks to free up the capacity of cyber teams. Organizations will also need to broaden their view to consider how employees play a critical role in their cyber defense, since threat actors are increasingly deploying tactics like phishing campaigns.

Adopt flexible funding

Despite the growing threat of cyber attacks, the cyber spend of Asia-Pacific businesses remains low — at just 0.05% of their annual revenue.¹ Chief Information Security Officers (CISOs) are struggling to scale up their functions’ efforts as they work with inflexible budgeting models, where they are either allocated a fixed portion within a larger corporate expense or cybersecurity costs are shared across the organization.

Organizations need to adopt a more flexible budgeting model, given the need for cybersecurity to respond quickly to the fast-moving cyber threat environment. Another reason is to build in agility for organizations to realign their cybersecurity strategy to their transformation initiatives.

Reimagine cybersecurity’s value

Tackling these challenges is not just the responsibility of the CISO or technology leader. It also requires the commitment and support of the board and management. The issue isn’t a lack of leadership support. According to the GISS, 39% of global organizations include cybersecurity on their quarterly board agendas, up from 29% in 2020. Further, only 20% of Asia-Pacific businesses include cybersecurity in the planning phase of any digital transformation program.

Inclusion of cybersecurity in digital transformation plans

of Asia-Pacific businesses include cybersecurity in the planning phase of any digital transformation program.

while cybersecurity is increasingly recognized as a business priority, it is viewed as a compliance or risk concern, rather than a strategic growth driver. This perception will continue to be reinforced if cybersecurity teams focus on the escalating problems without offering solutions, leading to the shutdown of new initiatives that are too cyber-risky. Therefore, there is a possibility that cybersecurity is conveniently left out from the decision-making process in innovation initiatives, for fear that the lack of solutions may jeopardize the implementation of these innovations.

While business leaders increasingly recognize the importance of cybersecurity, it is seen
as a compliance or risk concern insteadof a strategic growth driver.

CISOs need to help the business understand the strategic value of cybersecurity as an enabler — rather than a roadblock — of growth. It is important to better quantify the commercial value that investing in cybersecurity brings and build relationships to better communicate cyber risk in non-technical terms with the aim of becoming solution providers. It is also crucial to continue engaging with all functions on managing emerging cyber risks.

Transforming cybersecurity amid funding and talent challenges is neither a straightforward initiative nor an ambition that can be achieved in the short term. However, accelerated digital transformation has made it an opportune time for organizations to review ways of working and integrate cybersecurity considerations earlier into decision-making.

As organizations seek to become trusted businesses of tomorrow, they must answer this question: how can the business reap the benefit of the technology without leaving itself open to attack?

Summary

With stakeholders increasingly expecting companies to take sustainable actions, businesses need to articulate an authentic purpose that is aligned with such expectations. This is crucial to help drive effective transformations and realize long-term value. Companies seeking common ground in their purposes can better collaborate within industries and ecosystems.

About this article

Photographic portrait of Steve

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.