The need for cyber resilience

55% of technology and security executives in our Australian DTI 2021 survey plan to increase their cybersecurity budgets, with 51% adding full-time cyber staff in 2021. Clearly, cybersecurity is more business-critical than ever before. 

More than half (55%) of respondents lack confidence that cyber spending is aligned to the most significant risks with 55% believing that their budget is not placed to provide the best ROI when it comes to remediation, risk mitigation and/or response techniques — and if a severe cyber attack took place? Over half (55%) say they wouldn’t have the budget to cover this expense.

Cyber budgets could — and should — link to overall enterprise or business unit budgets in a strategic, risk-aligned, and data-driven way, but 53% lack confidence that their current process does this.

And with regard to preparedness for future risks, executives are not confident that cyber budgets provide adequate controls over emerging technologies (58%). With confidence lagging in the process used to fund cybersecurity, executives say it’s time for an overhaul. 44% say they’re trying new budgeting processes, and considering how best to convince the CEO and board to assign needed funds. Nevertheless, more than one-third strongly agree that organisations can strengthen their cyber posture while containing costs — thanks to automation and rationalisation of tech.

The existing array of cyber solutions has matured, enabling real-time threat intelligence, security orchestration and automation, advanced endpoint protection, identity and access management, and other advanced technologies — prompted in large part by a threefold growth in cloud services.

Early switchers have taken advantage of these developments. But, more important, they’re investing in the classic digital transformation trifecta — people, processes, and technologies — to close the wide lead that attackers have long held. Of the 25 new cybersecurity approaches surveyed in Australia between 15% and 19% of executives say they’re already benefiting from some of these new practices. 

Companies are rapidly moving their operations (75%) and security (76%) to the cloud. They’re doing away with static, inherently insecure legacy systems in favor of more dynamic, nimble integrated cloud/network systems that are secure by design. 

35% of executives strongly agree that moving to the cloud is foundational for the next generation of business solutions for their organisation. And 36% strongly agree that new solutions exist to secure cloud infrastructures better than they have ever been in the past.

The likelihood of cyberattack is greater in 2020 than ever before. We asked executives to rank the likelihood of cyber threats affecting their industry, and the impacts on their organisations, over the coming year. IoT and cloud service providers top the list of ‘very likely’ threat vectors (mentioned by 33%), while cyber attacks on cloud services top the list of threats that will have ‘significantly negative impact’ (reported by 24%). 

Accelerated and increased digitisation means a larger presence for a digital attack and potential for harm to the business. Most likely to occur in the next year and potentially most damaging, survey respondents said, are attacks on cloud services, disruptionware affecting critical business services (operational technology), and ransomware. Are your investments addressing these threats?

More than half (51%) of executives in our Australian DTI 2021 survey say they plan to add full-time cybersecurity personnel over the next year and 22% will increase their staffing by 5% or more. 

Top roles they want to fill:

- cloud solutions (43%)
- security intelligence (40%)
- and data analysis (37%)

Cloud security and security analysis are among the skills that are considered as being in shortest supply. Shaping the future of cybersecurity — one that is in step with the business — means hiring the people who are ready to work collaboratively with others to tackle new, as-yet-undiscovered problems and analyse information.

Enterprises feeling the pinch of the cybersecurity skills gap may find much talent in their own backyards. Organisations are hiring from within, offering upskilling to increase current employees’ skills in the same key areas they’re hiring for: digital skills, business acumen, and social skills. 

Organisations should challenge long-held beliefs about training, and design their programs to be people-powered, business-led, and results-oriented. This approach uses techniques such as gamification to increase participation, improves effectiveness and recall by having students apply their newfound knowledge to challenges they face on the job, and rewards progress toward tangible business outcomes.