How confident are CISOs about their security posture?

Proofpoint released its annual Voice of the CISO report, which explores key challenges facing chief information security officers (CISOs). While the world’s CISOs spent 2021 coming to terms with new ways of working, many now feel much more in control of their environment: 48% feel that their organization is at risk of suffering a material cyber attack in the next 12 months, down from 64% last year.

But feeling prepared for a cyber attack is vastly different than being prepared. This growing confidence of CISOs is likely a result of successfully overcoming a seismic event (the pandemic) rather than any tangible change in risk levels of preparedness. The report reveals that 50% of global CISOs still feel their organization is unprepared to handle a cyber attack and 56% consider human error to be their biggest cyber vulnerability, with established work-from-anywhere setups and The Great Resignation presenting new challenges around information protection.

The report examines global third-party survey responses from more than 1,400 CISOs at mid-to-large size organizations across different industries. Throughout the course of Q1 2022, one hundred CISOs were interviewed in each market across 14 countries: the U.S., Canada, the UK, France, Germany, Italy, Spain, Sweden, the Netherlands, UAE, KSA, Australia, Japan, and Singapore.

The survey explores three key areas: the threat risk and types of cyber attacks CISOs combat daily, the levels of employee and organizational preparedness facing them, and the impact of supporting a hybrid workforce as businesses prepare to re-open their corporate offices. It also uncovers the challenges CISOs experience in their roles, their position among the C-suite, and business expectations of their teams.

“As high-profile attacks disrupted supply chains, made headlines, and prompted new cybersecurity legislation, 2021 proved to be another challenging time for CISOs around the world. But as CISOs adapt to new ways of working, it is encouraging to see that they now appear more confident about their security posture,” commented Lucia Milică, VP and global resident CISO at Proofpoint.

“As the impact of the pandemic on security teams gradually fades, our 2022 report uncovers a pressing issue. As workers leave their jobs or opt out of returning to the workforce, security teams are now managing a host of information protection vulnerabilities and insider threats.”

Key challenges facing CISOs

CISOs are more confident about their cybersecurity posture: after two years of unprecedented disruption, CISOs now feel more in control of their environment: 48% of CISOs surveyed feel that their organization is at risk of suffering a material cyber attack in the next 12 months, compared with 64% last year.

There is a lack of consensus among CISOs as to the most significant threats targeting their organization: this year, insider threats – whether negligent, accidental, or criminal – topped the list at 31%, but were closely followed by DDoS attacks, Business Email Compromise, and Cloud Account Compromise (O365 or G suite accounts being compromised), all at 30%. Despite dominating recent headlines, ransomware came in at 28%.

Organizational cyber preparedness has improved but remains a key concern: increasing familiarity with the post-pandemic work environment has also left CISOs feeling better equipped to deal with cyber threats. While 66% believed they were unprepared for a targeted attack in 2021, this is down to 50% this year.

Employee security awareness is on the rise, but users are still not adequately skilled for the role of cyber defense: while 60% of survey respondents believe employees understand their role in protecting their organization from cyber threats, 56% of global CISOs still consider human error to be their organization’s biggest cyber vulnerability. In the last year, only half of the global CISOs surveyed have increased the frequency of cybersecurity training for employees.

Long term hybrid work and The Great Resignation make protecting data a top new challenge for CISOs: with employees now forming the defensive perimeter wherever they work, 51% of CISOs agree that they have seen an increase in targeted attacks in the last 12 months. And half say that increases in employee transitions means that protecting data has become an increased challenge and investment in information protection is top of the list of priorities for the next two years. When asked how employees were most likely to cause a data breach, CISOs named compromised insider attacks as the most likely vector, where employees inadvertently expose their credentials, giving cyber criminals access to sensitive data.

Ransomware headlines have largely increased cyber risk awareness among the C-Suite and driven strategy shifts: recent high-profile attacks have pushed ransomware to the top of the agenda for organizations, with 58% revealing they had purchased cyber insurance and 3 in 5 global CISOs focusing on prevention over detection and response strategies. Despite the rising stakes, however, a concerning 42% of CISOs admit they have no ransom payment policy in place.

While CISOs feel slightly less pressured, board buy-in remains precarious as cyber risk worries business leaders: 49% of CISOs feel that expectations on their role are excessive, down from 57% last year. However, the perceived lack of alignment with the boardroom has increased with only 21% of CISOs worldwide strongly agreeing that their board sees eye-to-eye with them on issues of cybersecurity. When considering cyber risk, global CISOs listed significant downtime, disruption to operations and impact on business valuation as top board concerns.

“After spending two years bolstering their defenses to support hybrid working, CISOs have had to prioritize their efforts to address cyber threats targeting today’s distributed, cloud-reliant workforce. As a result, their focus has gravitated towards preventing the most likely attacks such as business email compromise, ransomware, insider threats and DDoS,” said Ryan Kalember, EVP of cybersecurity strategy for Proofpoint.

“Overall, CISOs appear to have embraced 2022 as the calm after the storm but may be falling into a false sense of security. With rising geopolitical tensions and increasing people-focused attacks, the same gaps of user awareness, preparation and prevention must be plugged before the cybersecurity seas grow rough once more.”