“A few things stand out this year, which were validated by a lot of the people that we spoke with at the conference,” says Tim. “While the cyber threat is growing, there’s a sense that the level of interest or focus from within the business is dissipating in favour of other areas like technology transformation or AI strategies, meaning CISOs are often having to do more with less, something SCN has set out strategies for tackling in our recent whitepaper.

“There’s also work to be done around the policies companies have in place and compliance with the frameworks they must adhere to,” Tim adds. “For a lot of businesses, there’s a difference between what’s seen in a compliance audit and what’s happening in the real environment. It’s not always indicative of a strong security posture where the rubber hits the road with things like a Managed Detection Response (MDR) partner, the security operations centre (SOC) configuration, how well deployed the firewall is, or if everything really does have multi-factor authentication (MFA).

CISOs also need to be mindful of other trends. These include the Australian Securities and Investments Commission’s (ASIC) recent announcement that company directors could be held responsible for security breaches based on them ‘not acting with reasonable care and diligence’, greater robustness of cyber insurance policies which, says Tim, has resulted in more complex requirements for businesses to adhere to, evolving mindsets towards ransomware as a result of companies backing up their data more effectively and improving incident response plans that make some think they don’t need to pay to get data back or engage with adversaries, and continued poor security hygiene around new technologies and processes for things like data.

“We’re still trying to fix processes that, a lot of the time, shouldn’t still happen or exist in the business environment. Data is a good example. There’s no scenario where it should still be dotted around the business.”

“Companies are realising that all of these factors need more than just a fix to bad practices,” says Tim. “We’re still trying to fix processes that, a lot of the time, shouldn’t still happen or exist in the business environment. Data is a good example. There’s no scenario where it should still be dotted around the business. Put it in one place, put MFA on it, we can do proper analysis and data loss prevention (DLP) solutions, and look for sensitive information rather than having disparate silos everywhere. If just one of those gets compromised, it’s a serious issue.

“For CISOs, who have to be focused on strategic value, regulatory and policy concerns, business acquisitions and more, the focus for the future has to be on reassessing how effective our cyber policies really are,” Tim states. “CISOs and security professionals have spent a lot of time getting board interest, driving special steering committees, initiatives, and frameworks over the years, but we have to ask ‘is it really working?’. I’m not so sure. I sense that, in the current environment, there’s a perception that processes, and things like insurance and indemnity, can cover or close some of the gap and eliminate the risk, but CISOs and security teams have to look beyond that. Technology needs to play a key role.”