Risk Management
Winning credibility and driving resilience: the challenges facing public sector CISOs
Public sector organisations are under unprecedented pressure to optimise cyber resilience. Trend Micro data from 2023 shows the sector recorded more malware detections than any other last year.
Public sector organisations are under unprecedented pressure to optimise cyber resilience. Trend Micro data from 2023 shows the sector recorded more malware detections than any other last year. Trend also detected over 12 million risk events globally among government customers, and the vertical was among the top two for endpoint ransomware detections. To drive strategic improvements, public sector CISOs need the confidence of their departmental bosses. Unfortunately, we’ve also uncovered a pervasive credibility gap here.
This communication breakdown must be addressed. But it will require a change of language and approach from government CISOs, built on better data and a simpler, more cohesive message.
Uncovering the credibility gap
Our research is built on interviews with scores of public sector IT leaders with responsibility for cybersecurity. Its findings mirror a larger study into the CISO credibility gap with board/business leaders. On the one hand, a majority (63%) claim their organisation’s biggest risk is cyber-related. And they say it is investing most in cybersecurity (60%) to mitigate organisational risk. An overwhelming 89% believe their C-suite completely or somewhat understands the cyber risk facing the organisation.
Yet here’s where things get murkier. Two-fifths of respondents agree that their organisation’s attitude towards cyber risk is inconsistent and can vary from month to month. And a similar share (43%) say cyber is still treated as part of IT risk, and that the organisation’s leadership doesn’t consider cybersecurity to be their responsibility (41%). A third even claim that leadership would be willing to compromise cybersecurity for faster digital transformation. This is not the impression of a sector in which CISOs are trusted and cyber treated as a strategic driver rather than a cost centre.
There’s worse to come: a fifth of government CISOs say they feel pressured to downplay the severity of cyber risks to leadership all the time, and a majority (68%) do at least some of the time. That’s because they’re seen as being repetitive/nagging, overly negative and getting their recommendations wrong. Many are dismissed out of hand.
A new way forward
It doesn’t have to be this way. If CISOs can align cyber strategy more clearly with organisational goals, and articulate risk in these terms, they are much more likely to see eye to eye. In fact, those able to measure the organisational value of cyber report that they’ve been given more budget and responsibility as a result. And many are brought into senior decision making as trusted participants round the table.
Part of this is about changing language and presentation. But to get there, public sector CISOs need the right data. In fact, data insight is the top area respondents (43%) believe cybersecurity can contribute value to their organisation. That’s where a unified cybersecurity platform really comes into its own – delivering a single source of truth across protection, detection and response tooling, from the endpoint to the cloud.
To help CISOs build the business case for investing in holistic cyber resilience of this sort, the National Cyber Security Centre (NCSC) has produced a Cyber Assessment Framework (CAF) which supports both the Government Cyber Security Strategy 2022-2030, and the Cyber Strategy to 2030 for Health and Adult Social Care.
We can help
The CAF is not about providing a prescriptive to-do list for public sector organisations, but rather influencing top-level outcomes indicative of best practice cybersecurity. The good news is that Trend Vision One and its various component parts support the CAF’s four objectives:
- Managing cyber risk
- Protecting against cyber-attack
- Detecting security events
- Minimising the impact of cyber-events
By consolidating onto a single platform to achieve all of this, public sector organisations can save costs, lighten the management burden for stretched IT teams, and reduce the dangerous security and visibility gaps that point solutions create. It also harnesses the power of artificial intelligence to accelerate the productivity of under-pressure security operations centre (SOC) analysts, with a generative AI assistant dubbed Trend Companion. And it uses alternative AI techniques to filter alert noise – to help SOC teams prioritise alerts with greater accuracy.
Watch: Managing Risk and Driving Cyber Resilience in the Public Sector
We recently discussed these challenges, opportunities and related trends in the first of our Public Sector Cyber Sessions. Watch here.
