Chief Information Security Officers (CISOs) are often not the ones ultimately responsible for their organization's cybersecurity spending and policy decisions1, so it's important that they're equipped with quantitative data to translate cybersecurity challenges into business imperatives for CXOs. The new IBM service provides CISOs with financial data to help them communicate to the C-suite and Board the potential business impact of security vulnerabilities and liabilities on their business, in order to make more informed business decisions regarding cybersecurity.
Calculating Exposure in Mergers & Acquisitions – As global M&A volumes are projected to amount to $2.1 trillion in 2020, it's important that organizations venturing into M&A transactions incorporate cyber risk assessment into their due diligence process to verify the valuation of a deal. A recent IBM Institute for Business Value study found that of surveyed businesses that had recently executed a major M&A transaction, 57% performed a cybersecurity assessment only after due diligence was complete. In fact, one in three responding companies experienced a breach that can be directly attributed to M&A activity during integration. Quantifying this potential exposure not only helps organizations proactively mitigate security risks before they turn into active threats, it enables them to assess the issues that might impact the target company's value.
Enabling a Zero Trust Remote Work Model – A recent study conducted by Morning Consult and sponsored by IBM found that 61% of surveyed employees new to working from home that are using their personal computers stated they haven't been provided with tools to properly secure the devices. Now protecting wider, more diverse environments, organizations should proactively operate under the assumption of potential compromise, taking a zero trust approach to security. By defining what poses risk to their business and quantifying the impact, from third-party tools or applications to access controls, organizations are able to understand which risks they need to prioritize mitigating. In other words, assessing security risks, contextualizing them and calculating their business impact can help enable organizations to enforce their zero trust model and strengthen their cybersecurity resiliency as work models adapt to an evolving business landscape.
1 According to the 2020 Cost of a Data Breach report, sponsored by IBM Security and conducted by the Ponemon Institute, only 27% of respondents stated that the CISO/ CSO was ultimately responsible for their organization's cybersecurity technology and policy decision-making.