Beyond CISO Scapegoating: Cultivating Company-Wide Security Mindsets

In the not-so-distant past, Chief Information Security Officers (CISOs) shouldered the entire burden of cybersecurity breaches, often leading to rapid turnover and professional burnout. However, the landscape has shifted dramatically in the last ten years. As cyberattacks dominate headlines and organisations of all sizes become prime targets for digital miscreants, IT security has ascended to the forefront of business priorities, demanding attention from the entire executive suite.

The role of cybersecurity has evolved into a crucial business enabler, directly influencing an organisation’s financial health and compliance status. Recent regulatory changes, such as the upcoming NIS2 directive, now mandate critical companies to have comprehensive policies in place to manage and report on any cybersecurity breaches. This development necessitates unprecedented collaboration between business and security leadership.

Security can no longer be viewed as a point-in-time concern. To effectively counter the expanding attack surface and increasingly sophisticated threats, organisations must cultivate a proactive security culture that permeates every level of the company. This shift mirrors the evolution seen in financial management, where budgetary responsibilities have been distributed across departments rather than centralised solely with the CFO. A similar transformation is underway in the realm of cybersecurity, with accountability extending beyond the CISO to encompass all departments.

Recognising current cybersecurity challenges

To foster this company-wide approach to security, organisations must first grasp the complexities of today’s threat landscape. In our hyper-connected world, the digital footprint of businesses continues to expand, offering adversaries a multitude of entry points into networks and systems. The integration of emerging technologies, particularly artificial intelligence, further complicates the threat landscape, challenging even the most adept cyber defenders. In fact, a recent study found that 75% of security professionals witnessed an increase in attacks over the past 12 months, with an astonishing 85% attributing this rise to bad actors using generative AI.

Software supply chain vulnerabilities have emerged as a particularly alarming threat vector, as evidenced by high-profile incidents like the MOVEit and Log4j attacks affecting individuals and devices. These breaches underscore the difficulty in assessing and mitigating risks introduced by third-party vendors.

Paradoxically, internal networks often harbour more vulnerabilities than their external counterparts, with web applications presenting a higher concentration of critical security flaws. A NetSPI report found that internal networks have nearly three times more exploitable vulnerabilities than external networks and that web applications have a higher prevalence of high and critical vulnerabilities compared to mobile and thick applications.

Top brass to ground floor: Getting everyone on the security bandwagon

The expanding attack surface has transformed cybersecurity into an ‘all-hands-on-deck’ imperative. While the CISO remains a crucial figure, effective security now demands a holistic approach supported by the entire executive team. This includes CEOs ensuring security prioritisation, CFOs allocating appropriate resources, and CIOs maintaining open lines of communication with security teams regarding potential risk-laden applications.

Cultivating a security-first culture requires a top-down approach that engages every member of the organisation, from the boardroom to the frontline. Developers and IT personnel must integrate security considerations throughout the entire development lifecycle, embracing the concept of ‘shifting left’ in security practices. However, security awareness must extend beyond technical teams to encompass all employees and even customers.

Employee training plays a pivotal role in this cultural shift. From day one, staff should be educated on basic security hygiene and phishing recognition. Ongoing, progressive training sessions serve as a critical defence mechanism against human error and negligence. Similarly, organisations should consider extending cybersecurity education to their customers, or at minimum, ensure transparency regarding data breach procedures to mitigate reputational risks.

Beyond human factors, cybersecurity itself demands a holistic and continuous approach. Given the impossibility of achieving absolute security, organisations must adopt a strategy of continuous testing and improvement to fortify their overall security posture.

The rapid evolution of cybersecurity has catalysed a transformation in the CISO’s role. No longer simply the head security practitioner, today’s CISO must function as a cross-departmental leader, orchestrating the organisation’s comprehensive security programme. As cyber threats grow in sophistication and the attack surface expands, it has become abundantly clear that CISOs cannot single-handedly prevent or anticipate all potential threats. The path to a secure future necessitates the concerted effort of the entire organisation, including external partners, working in unison towards a common goal of robust cybersecurity.

By Joe Evangelisto, CISO, NetSPI.