CEO insights on cyber resilience
Source: Middle East Insurance Review | May 2023
A first-of-its-kind study has attempted to explore the minds of CEOs in managing cyber risk.
The study was conducted jointly by ISTARI, a Temasek-founded global cyber security firm dedicated to helping clients build cyber resilience, and Said Business School at the University of Oxford.
The study draws on 37 in-depth interviews with global CEOs, nine of whom have endured a serious cyber attack.
“The 29-page The CEO Report on Cyber Resilience”, applies a top-management lens to cyber security risks and underscores the critical role CEOs play in building cyber resilience.
It shared insights from 37 American, Asian and European CEOs whose businesses’ average annual revenue is $12bn, employing an average of 40,000 employees. One-third of the interviewees are from Asia. Nine of the CEOs interviewed had guided their company through a serious cyber attack.
The CEOs acknowledged that they are formally answerable to regulators, shareholders and their boards for cyber security yet the majority (72%) said they were uncomfortable making decisions about it, often leading them to delegate responsibility for and understanding of cyber security to their technology teams, which can jeopardise resilience.
The report outlined four mindsets CEOs need to lead cyber resilient businesses
- All CEOs interviewed said they feel accountable for cyber security. However, a parallel ISTARI survey of Chief Information Security Officers (CISOs) found one in two European (50%) and almost a third of US (30%) CISOs did not believe that their CEOs feel accountable. This gap in perception, according to the research, lies partly in the meaning of accountability: instead of seeing themselves as accountable - being the face of the mistake - CEOs should assume co-responsibility for cyber resilience together with their CISO.
- CEOs should stay away from blindly trusting their technology teams. Instead, they should move to a state of informed trust about their enterprise’s cyber resilience maturity.
- CEOs should embrace what the authors call the ‘preparedness paradox’: an inverse relationship between the perception of preparedness and resilience - the better-prepared CEOs think their organisation is for a serious cyber attack, the less resilient their organisation likely is, in reality.
- CEOs should adapt their communication styles to regulate pressure from external stakeholders who have different and sometimes conflicting demands. Depending on the stakeholder and the situation, CEOs should either be a transmitter, filter, absorber or amplifier of pressure. M