Magazine menu Close Magazine menu

Research: Towards superior cybersecurity

What makes enterprises better prepared for a cyberattack? Our research in partnership with Longitude, a Financial Times company, found three qualities leaders should foster.

Selected articles

financial times report csuite collaboration

How to bring the C-suite and cybersecurity team close

  • Leadership
  • min read
    • With cyberattacks growing more frequent and ever more complex, company leaders can no longer leave corporate security to the IT team. The C-suite (senior leadership) must get in the loop. Global professional services giant Accenture found cyberattacks were up by 31 percent globally in 2021. Protecting against attacks must be a priority for leaders. In partnership with Longitude, a Financial Times company, Kaspersky surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. The research found that when companies have strong links between their C-suites and cybersecurity teams, they report being better prepared for attacks. For example, 64 percent say they could deal comfortably with a cybersecurity threat created accidentally through employee error, compared to 47 percent of the rest of respondents. Two ways to ensure C-suite integration 1. Share perspectives at the top Evgeniya Naumova, Executive Vice President of Corporate Business at Kaspersky, believes the increased security risks with remote work have captured leaders' attention since the pandemic began. They realized employees were more likely to be exposed to threats outside the office environment. This, coupled with recent rises in cybercrime, has opened leaders' eyes to the threats they face. "There was a switch — a really obvious switch — in their minds," Naumova says. "They understood that it's not just something to observe from afar — it needs to be top of their minds. Companies that did not have a chief information security officer (CISO) or tech expert on their boards of directors were promoting roles because now they understood they could lose their business in one day to an attack." By drawing on the experience and insights of the wider leadership team, CISOs and chief information officers (CIOs) can gain a broader perspective that could create more effective, 360-degree protection for the business. Graeme Watt, CEO of UK IT giant Softcat, says responsibility for risk ultimately rests with the CEO – but he acts based on his CIO's input. "I have a CIO who reports directly to me, and the information security team sits under them," Watt says. "I am the person the board looks to on cyber risks, but I don't do all the reporting myself. I bring the CIO into the board meeting when we're talking about cybersecurity threats." 2. Ensure effective cybersecurity training and collaboration Integration between C-suite and cybersecurity teams starts with building a deeper understanding of the issues at hand. This can be achieved with the right training for senior leadership. "Training for the C-suite has an additional goal of advocacy – turning managers into leaders of an organization's cyber-awareness culture," says Kaspersky's Naumova. "Training using gamification and simulations of real attacks are particularly useful. First, they are more engaging, and second, they allow the C-suite to observe the results of their decisions instantly." Ricardo Lafosse, CISO at multinational food company Kraft Heinz, says the company promotes a culture of constant collaboration and communication between its cybersecurity team and wider leadership. Lafosse continues, "A great example is marketing. From a privacy and cybersecurity perspective, we have a very close collaboration on how we manage data before we launch a marketing campaign. That shows the importance of cybersecurity as a business enabler." A welcome side-effect of promoting the importance of cybersecurity across the business is that employees at every level of the team feel more valued by the company. This is likely to improve retention rates – an important consideration, given the research found that one-third (34 percent) of company leaders believe the cybersecurity skills shortage will become critical in the next two years. C-suite integration is consistent across the world The research shows attitudes to greater alliances between cybersecurity teams and the C-suite are consistent globally. The most positive is Latin America, where half of enterprises (51 percent) say closer integration between the C-suite and cybersecurity teams will be very important in the next two years. The lowest is in North America, at 42 percent. This is encouraging for enterprises with a multinational presence, as it's important they embed and maintain their culture consistently across global operations. Kraft Heinz's Lafosse says C-suite integration at his company is part of a broader positive and proactive cybersecurity approach. "Culturally, the organization respects and responds to cybersecurity events, and we champion great people in the team," he says. "The whole company also understands how reliant we are on cybersecurity." There are clear advantages in building strong links between senior leadership and cybersecurity teams. Any company seeking protection against ever-sophisticated cyber threats should nurture and value this relationship.
financial times report diversity

Two great ways to build a more diverse cybersecurity team

  • Women and diversity
  • min read
    • "A diverse team gives you different life experiences and strengths," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. Diversity in your cybersecurity team is also a competitive advantage, according to new research. In partnership with Longitude, a Financial Times company, Kaspersky surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. The research finds organizations that actively improve diversity and inclusion in their cybersecurity teams – named the Diversity Leaders for this reason – are better prepared to deal with a range of cyberattacks. For example, they are twice as likely (77 percent) to be prepared for 'black swan events' – sudden events with widespread impact, like a pandemic – than others in the sample (37 percent.) Organizations recognize the benefits of a diverse team. Six in 10 say creating a more diverse and inclusive cybersecurity team will be important in the next two years. They have work to do. Figures show 85 percent of cyber security professionals in the UK are white and 66 percent are male. And only 10 percent of women in IT work in a majority female team, another recent Kaspersky survey found. Two ways to rebalance your cybersecurity team 1. Recruit from different sectors "One of my engineers has no IT security background — he started as a musician," says Ricardo Lafosse, Chief Information Security Officer at multi-national food company Kraft Heinz. "He sees problems differently from me and that provides a whole new dynamic for how to solve an issue." Broadening the talent pool by hiring from unexpected places gives businesses a bigger picture when threatened. Diverse viewpoints make it possible to consider all the ways an invader could attack. "A diverse team gives you different life experiences and strengths," says Vaillance Group's Delaney. "A well-rounded team approaches challenges more creatively." 2. Build an inclusive culture Recruitment strategies are just the beginning. Companies must create an inclusive workplace culture so recruits feel welcome, nurtured and excited to build a career. The National Cyber Security Centre recently found that one in five UK cybersecurity professionals felt they couldn't be themselves at work. Meanwhile, research by Accenture and non-profit Girls Who Code revealed company culture is the top reason women leave a tech career. And a recent international Kaspersky survey found 44 percent of women in tech think men progress faster. "Teams are living organisms, and like all living organisms, they can be healthy and flourish — or not," says Evgeniya Naumova, Executive Vice President of Corporate Business at Kaspersky. Regional variation in valuing diversity in cybersecurity Cyber threats are global, but the research shows regions prioritize diversity and inclusion differently. For example, 84 percent of Australian leaders in the research said they were actively improving diversity and inclusion in their cybersecurity teams. In contrast, only 56 percent of those in Canada agreed with the statement. In Hong Kong and Italy, 72 percent agreed that creating a more diverse and inclusive cybersecurity team would be important in the next two years, but only 52 percent in the UK. This means multi-national organizations must ensure recruitment strategy and culture improvements happen across operations worldwide. Cyber threats are growing in number and severity, and businesses must do everything they can to protect themselves. Diversity might not always be a top-of-mind strategy, but the data shows it should be. As well as the powerful benefits of diversity and inclusion, a global strategy needs more senior leadership (C-suite) involvement. The research found companies with closely linked cybersecurity teams and C-suite are better prepared to manage attacks. If there is strong integration with senior leadership, cybersecurity is likely higher on the business agenda, and the team likely feels more valued, leading to better staff retention. "As cybersecurity leaders, we must push for diversity and ingrain these viewpoints into the fabric of our program," says Kraft Heinz's Lafosse. "The threat actors out there don't care about race or gender. If they find a good hacker, they're going to be part of their team. We need to be able to think that way."
financial times report cybersecurity skills

Why successful companies invest in cybersecurity skills

  • Leadership
  • min read
    • Arming your cybersecurity team with the right skills and experience is a crucial first step in facing down threats. In partnership with Longitude, a Financial Times company, Kaspersky surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. The research found a small group of companies strongly believe their cybersecurity training programs can keep pace with the ever-changing threat landscape. Dubbed the Skills Leaders, these businesses have better security outcomes. About three-quarters (74 percent) say they're prepared for employees accidentally creating a cybersecurity threat – such as falling for a phishing scheme – compared with only half (49 percent) of the rest. This is good news, because cybersecurity skills are in short supply. In 2021, Microsoft announced the US is facing a cybersecurity skills crisis, citing that more than one in 20 of all open jobs in the country require cybersecurity skills. In the same year, research by Information Systems Security Association (ISSA) and industry analyst firm Enterprise Strategy Group (ESG) found 95 percent of cybersecurity employees globally believe the skills gap has not improved in recent years. Our research found one-third (34 percent) believe this shortage will get worse in the next two years. But the Skills Leaders are a small group — just eight percent of the research sample. How can more organizations follow their lead? Three ways to upskill your workforce in cybersecurity 1. Train everyone, not just IT It's not just the cybersecurity team that should be on constant alert for threats. Employee-wide updates and reminders help make security part of company culture. "People need to keep their software up to date, understand how to encrypt their internet traffic and not use public Wi-Fi," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. "These are general cyber hygiene practices, and they're critical. Reducing human error is crucial. Technology researchers Gartner predicts that by the end of 2025, more than 99 percent of cloud breaches will arise from preventable user misconfigurations or mistakes. One way to reduce these errors is to introduce cybersecurity 'tests' to see how employees respond to threats and increase training for those who fail them. This is what Ricardo Lafosse, Chief Information Security Officer (CISO) at Kraft Heinz, does. "It's probably one of our best ways to see whether a malicious actor could mislead our employees and get into our organization using phishing techniques," he says. 2. Update your coaching techniques Training must also move with the times to keep up with the evolving threat landscape. The Skills Leaders identified in the research seem to understand this. They're more likely to be forward-thinking with their training. About two-thirds (67 percent) say it will be very important to carry out immersive cybersecurity training (gamification and simulations to recreate real attacks) in the next two years, compared with less than half (49 percent) of the rest. "Cybersecurity training is often perceived as a formality, but one-off training is not enough," says Evgeniya Naumova, Executive Vice President of Corporate Business at Kaspersky. "Behavioral change won't appear with the wave of a magic wand. It takes commitment and practice for acquired skills to become habit. Continuous learning is especially important for enterprises to prepare teams for the evolving threat landscape." Staying up to date also means being able to change strategy fast. To combat new threats as effectively as possible, Kraft Heinz's Lafosse prioritizes agility and flexibility in his cybersecurity team. 3. Put cybersecurity at the heart of recruitment Upskilling in cybersecurity will inevitably involve addressing the skills gap. And that could force companies to take an innovative approach to recruitment, like hiring candidates with non-IT backgrounds. The research found the Skills Leaders are more likely to embed cybersecurity awareness in their recruitment and onboarding processes, stressing the need for high cybersecurity standards from the start. Enterprises with a multinational presence must ensure they approach cybersecurity consistently across their global operations. It only takes one cyber threat in one region to potentially wreak havoc across the whole organization. The skills gap is a big challenge for enterprise cybersecurity teams. To be protected against the full range of evolving threats, enterprises must do all they can to fill it. That means expanding recruitment, preparing their existing workforces by keeping them abreast of changes and training them right from the start.

Selected report

Three steps to better prepared cybersecurity

New research with 750 leaders of large organizations reveals three steps to be better prepared for a cyberattack.

Download report

Selected episodes

View all series

Report

Empower women: Championing women in cybersecurity

Organizations well-prepared for a cyberattack are also those who actively increase cybersecurity team diversity. Our research on what today’s women in tech experience helps leaders consider the best ways to get more women on board.

Download report

Featured video

How to speak with the C-level about cybersecurity
3 min

Towards superior cybersecurity

How to speak with the C-level about cybersecurity

Watch the whole series

Kaspersky One Partner

Thousands of great minds protecting your enterprise from threats.

See solution
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries