By Douglas Ferguson, Founder and CTO of Pharos Security

Bridging the gap to the Board

There is no question that cyber breach is a top concern in boardrooms across the globe. Many CISOs believe their greatest problem is gaining enough investment. But what is the right amount of investment? Is it a single value or on a slider?

The reality is, the security industry has done a poor job of quantifying meaningful results, and even less convincing is how strongly security investment links to these results. The outcome has become an executive “damned if we do, damned if we don’t” position regarding investment in security. And this flies in the face of their fiduciary duty to the company and its shareholders and customers. To make matters even more difficult for the boardroom, senior business executives have been taking significant heat for cyber breach. It is true that the right investment needs to be allocated to security, and for security to be able to do the right job, but the industry doesn’t have a strong plan or vision yet to actually answer “what does good security look like, and what is the right cost for this?

In 2020:

Investment in cyber security will continue to increase, but security will continue to struggle to show a strong return.

Many CISOs believe winning more budget is there greatest need, the much greater problem is spending budget and not being able to demonstrate reasonable return. That’s the real killer.

The CISO job will still be difficult in 2020 but will get better for the ones that can show a business savvy strategy.

Many CISOs are still in denial believing that their Board “doesn’t get it”. When, in reality, the CISO is failing to tell a meaningful security story that is about a protection result - a destination - that doesn’t require any technical or security understanding.

##

About the Author

Douglas Ferguson, a security professional of over 20 years, is the Founder and CTO of Pharos Security. Pharos specializes in aligning security goals and strategy to the business and a calibrated risk appetite, ensuring an integrated business plan and optimized operations build that to plan and on budget.

Prior to Pharos, Ferguson was with Barclays Bank in London, where he was responsible for numerous security programs and initiatives across more than 40 countries. Previously, Ferguson was a Managing Consultant and researcher on the acclaimed X-Force at Internet Security Systems. He delivered security services to more than 200 clients globally and was a co-creator of the breakthrough System Scanner technology.