Security As Catalyst: Making Cybersecurity A Strategic Business Enabler
Alexander Antukh, Ciso, Aboitizpower
Alexander Antukh, Ciso, Aboitizpower
Imagine that at your next board meeting, cybersecurity is treated as a purely strategic project investment case, where words like 'breach,' 'firewall,' 'phishing,' or even ‘cyber’ are not mentioned even once. Everyone would just agree that given the proposed costs and estimated ROI, it is a financially sound thing to do, regardless of its nature.
In today's rapidly evolving digital landscape, cybersecurity is often viewed as a necessary evil—a mere cost center rather than a strategic ally in business growth. This perspective not only undermines the potential of cybersecurity but also excludes it from discussions where it could play a significant role in driving business outcomes.
A Forrester study reveals a concerning disconnect within the industry: a mindblowing 97 percent of organizations struggle to align cybersecurity priorities with business outcomes, and 93 percent find it challenging to measure cyber performance in relation to business success. This disconnect arises, in part, from the tools and metrics currently in use. While numerous tools generate dashboards for executive decision-makers, the metrics they present—such as patching, compliance, and configuration—are often not directly tied to the company's strategic goals nor measured in the same terms.
This misalignment feeds into the common perception of cybersecurity as a cost center rather than a real business partner. Yet, the central question remains: Does cybersecurity bring real value to the business, and if so, how can we demonstrate it?
Consider the benefits of integrating security into DevOps as an example. While many industry responses focus on the technical advantages, the true answer lies in financial terms. Integrating security into DevOps can lead to faster time-to-market, enhanced security with faster mitigation of vulnerabilities, and better regulatory compliance—each translating into potential savings and revenue. For instance, 60 percent of developers report releasing code twice as fast as before, and vulnerability mitigation can be up to 11.5 times faster. Moreover, a robust cybersecurity posture can statistically reduce the risk of fines, even in the event of a breach.
Bridging the gap between business owners and cybersecurity professionals involves mutual efforts. For business leaders, board education is essential through resources like the National Association of Corporate Directors (NACD) and the Digital Directors Network (DDN). For cybersecurity professionals, understanding cyber risk quantification (CRQ) and undergoing executive training can help articulate the value of cybersecurity in business terms.
The evidence supporting cybersecurity as a strategic business enabler is compelling. Organizations that align their cybersecurity programs with business objectives see significant benefits, including increased revenue growth, market share, customer satisfaction, and employee productivity. Cyber-resilient companies not only financially outperform their peers but also enjoy competitive advantages, such as improved profitability and stakeholder trust. In fact, investing in cybersecurity has been shown to positively influence all five of Porter's forces, creating a competitive edge. Moreover, companies with strong cybersecurity measures outperform the market by up to 7 percent.
Bridging The Gap Between Business Owners And Cybersecurity Professionals Involves Mutual Efforts
The consequences of neglecting cybersecurity are evident. One commonly tracked metric by IBM is the average cost of a data breach, which stood at $4.45 million in 2023. Another, less commonly cited, reveals that publicly traded companies have experienced average stock value declines of 7.5 percent following a data breach, underscoring the direct impact on shareholder value. Conversely, a culture of security resilience is now a top priority for executives. Integrating a robust cybersecurity strategy into growth plans has become a competitive advantage.
In conclusion, the narrative around cybersecurity needs a paradigm shift—from viewing it as a cost center to recognizing it as a strategic business enabler. The statistics and insights gathered underscore the substantial value cybersecurity brings to the table, not just in safeguarding assets but in driving business success.
