Cybersecurity skills or business savviness: which one is more important for today’s modern CISO? asks Anton Roe.

Almost every day the news reports on the devastating impact of yet another cyber-attack or data breach. With the significant increase in how much an organisation can be fined introduced by the European GDPR, no organisation should feel complacent. In 2021 alone, 39 per cent of UK businesses and 26pc of charities reported breaches, with some reporting financial losses as high as seven figures. The question all companies are facing now is not if they will become a victim of a cyber-attack, but when – and what harm will it bring? It is a scary truth as hackers simply do not discriminate. The tactics they use are more sophisticated than ever, so even the smallest system vulnerability presents an enormous security risk to businesses of all sectors and sizes. This growing security threat means that boards have started asking more questions too, expecting black and white answers in a language they can understand – profit and loss.

Who’s responsible?

Several years ago, businesses rarely had a senior person whose sole responsibility was cyber-security. This usually fell in the hands of an IT Director or someone with other responsibilities, with the only specialist security knowledge being a relatively junior member of staff reporting to a mid-level IT manager. This meant that information security ended up being mostly focused on technical IT solutions. There was simply insufficient resource to fully understand the security posture of the organisation and how to improve it. At the same time, cybercrime was not as prominent – or so we thought – therefore there was no need for one senior to drive the security agenda against the operational objectives of the wider-business.

Fast-forward to today’s world of increasingly sophisticated cyber-attacks, more organisations are in desperate need of a senior cybersecurity expert whose sole responsibility is to articulate the security risks across the business in financial terms and demonstrate the value of improving security against competing operational demands. That’s how the role of a modern Chief Information Security Officer (CISO) was born.

CISO’s evolution

That role is rapidly and constantly transforming to match the broader business needs. Not so long ago, CISOs had to fight hard to convince the Board and colleagues of the importance of security for the health of the business. They have come a long way from trying to influence the decision-makers to now relentlessly executing cybersecurity strategies, educating departments and being fearless guardians of business assets. Their multifaceted role is necessary to promote a culture of security change across every department and every position.

A modern CISO wears many hats and has to make tough calls on a daily basis. For example, they must justify to the Board that a £100k(US$128,750 ) piece of security software is better value than something that will more visibly improve the business, such as more operational staff. As well as improving the security infrastructure, the much harder task for a CISO is to understand when and where it is acceptable to reduce security resource to increase business efficiency. Balancing security, cost and operational efficiency is certainly a fine art that takes skill and experience.

It’s not just an IT function

It is clear that the role of a modern CISO goes beyond an IT function. They have become true educators and business influencers who drive competitive edge. As many companies now put security practices of their suppliers under the microscope, CISOs have also become salespeople who must convince their partners and clientele of their strong cybersecurity practices. They are being rolled out in front of potential customers to demonstrate that their organisation is the right choice to protect their business-critical services and data.

These responsibilities mean that a completely different skillset is required. The CISO needs great interpersonal skills to understand, engage and persuade the business. They must acquire effective communication skills to articulate their agenda to the Board, which may have little security or even IT knowledge. CISOs must now have extensive experience of building and retaining high-performing teams and a solid understanding of finance to appreciate the value vs cost of security.

The most successful CISOs must have relevant cybersecurity knowledge and experience, but most importantly, they must possess a strong business acumen. For organisations with larger security teams, the role of the CISO is to effectively articulate the value of filling security gaps to the Board and receive the necessary funds to strengthen cyber-practices. In this model, the CISO does not need to be as technical, but their softer skills will need to stand out to bring more value to the security of the business. For smaller organisations, it is the reverse. Here, the technical skills will be more vital as they will need to be the ones having technical conversations with teams, identifying weaknesses and helping to design secure processes.

However, no matter the size of the organisation, business acumen is now the most sought-after value in CISOs, as when they are on top of their commercial game, they have higher chances of landing in the Board’s good books. Thus, better protecting the organisation from eager cybercriminals.

Roe is Chief Executive Officer, MHR International.