Leadership changes happen everywhere. Scenarios can differ, but it might result in a strategic pause. Stakeholders wait to see what happens next. But risk management can't afford such a pause. Distraction creates the conditions attackers look for.
During any transition, the safe move is to protect what is working, rather than rushing to change it. This is a typical new leadership problem, where, in an effort to show quick progress, security processes are altered at a time when no one is fully in control. But uncertainty, regardless of cause, surfaces gaps in the risk posture that need to be addressed.
1. The awareness gap: Employees remain one of the most frequently exploited parts of an organization's security environment, with the human element involved in many of the breaches. The question that should be asked here isn't whether all employees have access to the technology they need, whether a device, an app, or an account. This gap is simple enough to fulfill. What is difficult to bridge is security awareness. For instance, an employee that uses AI without a clear understanding of what not to share is wading into shark waters.
2. The skills gap: Risk managers and security professionals are in short supply, with organizations admitting their resilience goals are negatively impacted because of this skills gap. The problem is also one of perspective. Organizations are looking at cyber roles purely from a technical lens. Good professionals are those who also notice patterns others may miss and think out of the box about how a system can be protected. They can also assume the attacker's position to imagine how a system might be compromised.
3. The trust gap: Building cyber-risk resilience is not an individual affair. It often involves trusting people and organizations out of your control. The foundation behind active intelligence-sharing alliance network depends on every partner investing effort. When that doesn't happen, trust issues surface. The same gap shows up during acquisitions. Buyers often accept a target company's assurances about its data and cyber posture at face value, without independently checking whether those claims hold up.
4. The implementation gap: Systems that comprise ambitious technology projects must talk to one another and share data. But often they don't. Stakeholders don't have clear visibility of what data exists, where it lives, or who can access it. This makes data protection all the more challenging.
5. The certainty gap: A stable geopolitical state, a domestic political climate and a strong economic environment are a win-win for all businesses. But sudden shifts can disrupt even the best-laid plans. Businesses fixate on a single expected outcome, assuming no dramatic shifts, leaving little room to course correct when reality hits.
Practical steps for risk resilience
Steps organizations can take to strengthen risk resilience in the face of uncertainty include:
1. Build security awareness: Don't give just technology access; also provide better clarity on what security best practices are and why they are necessary. Also, run phishing simulation exercises to show employees the negative impact when security practices are not followed. Start security awareness training early rather than expecting employees to practice cyber discipline after things go wrong.
2. Solve the skills gap: Organizations can look beyond geographical borders and not just rely on the domestic resource market to recruit talent. They can also build apprenticeships and internship pipelines, upskill and outsource, to help supply a pipeline of talent.
3. Participate actively, verify independently: Organizations relying on shared threat intelligence should consistently invest, actively participate, and put the right people on necessary committees. It also means sharing
4. Map what's disconnected: Close the implementation gap by mapping how data actually moves through the organization before assuming it's protected. Identify where systems don't connect to each other, and where the people expected to feed them information day to day, at the frontline, aren't doing so consistently.
5. Take a multiple scenarios approach: The wrong move is to bet on a single expected outcome. The right move is to plan for several likely scenarios in advance. Identifying the right pre-agreed response for each scenario. Adopt a near-term and long-term approach to resilience. Near-term, this means testing incident response playbooks and prioritizing vulnerability patching by real-world exploitability, not just severity scores. Long-term means investing in in-house security talent and architecture like zero trust that reduces reliance on reactive fixes.
Real improvement in managing uncertainty from a risk perspective won't come from better technology alone. It will come from considering short-term and long-term impacts seen from the prism of an ever-changing threat landscape and accordingly building a resilience framework.
