Is more C-Suite engagement needed to mitigate cyber risk?

Cloud security company Trend Micro says new research reveals a widespread concern among IT/C-Suite about the growing threat from ransomware

Cloud security company Trend Micro has published new research revealing that persistently low IT/C-suite engagement may imperil investments and expose organisations to increased cyber risk. Over 90 per cent of the IT and business decision makers surveyed expressed particular concern about ransomware attacks.

Trend Micro commissioned Sapio Research to interview 5,321 IT and business decision makers from enterprises larger than 250 employees across 26 countries​ for the research. Despite widespread concern over spiralling threats, the study found that only around half (57%) of responding IT teams discuss cyber risks with the C-suite at least weekly.

Eva Chen, CEO of Trend Micro says: “Vulnerabilities used to go months or even years before being exploited after their discovery. Now it can be hours, or even sooner. More executives than ever understand that they have a responsibility to be informed, but they often feel overwhelmed by how rapidly the cybersecurity landscape evolves. IT leaders need to communicate with their board in such a way that they can understand where the organisation’s risk is and how they can best manage it.”

Trend Micro found that current investment in cyber initiatives is not critically low. Just under half (42%) of respondents claimed their organisation is spending most on cyberattacks to mitigate business risk. This was the most popular answer, above more typical projects like digital transformation (36%) and workforce transformation (27%). Around half (49%) said they have recently increased investments to mitigate the risks of ransomware attacks and security breaches.

However, low C-suite engagement combined with increased investment suggests a tendency to ‘throw money’ at the problem rather than develop an understanding of the cybersecurity challenges and invest appropriately. This approach may undermine more effective strategies and risk greater financial loss. Less than half (46%) of respondents claimed concepts like “cyber risk” and “cyber risk management” were known extensively in their organisation.

Most (77%) want to hold more people in the organisation responsible for managing and mitigating these risks, which would help to drive an enterprise-wide culture of “security by design.” The largest group of respondents (38%) favoured holding CEOs responsible. Other non-IT roles cited by respondents included CFOs (28%) and CMOs (22%).  

The study follows previous Trend Micro Research revealing a worrying cybersecurity disconnect between business and IT leaders – perpetuated by self-censorship from cyber experts and disagreements over who is ultimately responsible.


Featured Articles

How secure is sensitive data stored in the cloud?

A Cloud Security Alliance (CSA) survey has found 67% of organisations store sensitive data in public cloud environments, but how secure is it?

CYBER LIVE LONDON: Day 2 highlights of the hybrid tech show

We take a look at highlights of the different stages at the Tech Live London show, including insights from Claroty, SalesForce and Oracle

TECH LIVE LONDON: An overview of the hybrid technology show

We take a look at the first day of Tech Live London with insights from technology leaders from companies such as IBM, Microsoft and Vodafone

Does a cashless society mean higher risk of fraud?

Cyber Security

5 minutes with Gary Brickhouse, CISO of GuidePoint Security

Cyber Security

CTO at Passbolt explains the importance of password managers

Application Security