IT Security Leaders Are Failing to Close a Boardroom Credibility Gap
Most security bosses are pressured to soften their language, according to a global study report by Trend Micro
Trend Micro commissioned Sapio Research to interview 2600 IT leaders with responsibility for cybersecurity in their organisation—across LATAM, APAC, North America, Europe and the Middle East. Respondents hailed from organisations of all sizes and across multiple verticals.
Trend Micro Incorporated (TYO: 4704; TSE: 4704) recently revealed that four-fifths (79%) of global cybersecurity leaders have felt boardroom pressure to downplay the severity of cyber risks facing their organisation.
"Over half of security leaders say cyber is their biggest business risk. But they're failing to communicate that risk in a language the board understands. As a result they're ignored, belittled and accused of nagging," said Trend Micro's Technical Director Bharat Mistry. "Unless they can engage better with senior leadership, corporate cyber-resilience will suffer. The first step is to attain a single source of truth across the attack surface."
Of those security leaders who came under pressure from their board, 43% say it is because they are seen as being repetitive or nagging and 42% that they are viewed as overly negative. A third (33%) claim they have been dismissed out of hand.
This points to a serious credibility gap, closely linked to their inability to align cyber with business risk. In fact, 46% say that when they have been able to measure the business value of their cybersecurity strategy, they've been viewed with more credibility.
The credibility gap
This disconnect between IT/cyber and business leadership is manifested in one other very obvious and damaging way. Some 79% of global cybersecurity leaders have felt boardroom pressure to downplay the severity of cyber risks facing their organisation. Of these, 43% say it is because they are seen as being “repetitive” or “nagging”, and 42% that they are viewed as overly negative. A third (33%) claim they have been dismissed out of hand.
Other benefits of this approach include IT security leaders being:
Given more responsibility (45%)
Seen as a more valued function (44%)
Given more budget (43%)
Brought into senior decision making (41%)
Yet at present, a persistent communication gap exists between IT and business leadership.
Only half (54%) of respondents are confident their C-suite completely understands the cyber-risks facing the organisation—a figure that has barely moved since 2021 (50%). Over a third (34%) of respondents say cybersecurity is still treated as part of IT rather than business risk.
Additionally, 80% believe that only a serious breach would incentivise the board to act more firmly on cyber risk.
The heterogeneous cybersecurity environment may be compounding these challenges. Siloed point products across the attack surface generate inconsistent data points, which can make it difficult to tell a clear story about cyber risk to the board.
Over half (58%) of respondents believe they'll need an increase in IT comms skills in order to rectify the situation. But a unified Attack Surface Risk Management (ASRM) platform could eliminate the need for such hefty investments, by delivering consistent and compelling risk insight—potentially in the form of an executive dashboard.
