Even with ransomware being a consistent topic in the news, do you think most companies are still approaching security as a “nice-to-have”?

Question

Answer

I’ve noticed in a few companies I’ve worked for—smaller-sized organizations—that CIOs and CTOs do not treat security as an absolute necessity. We know we need it, but we have so many other priorities to fund. These ransom attacks are increasing, but what's the price of the companies that are impacted? We'd rather take a risk rather than protect ourselves from something that may or may not happen.

Answer

Security does tend to be a nice-to-have. Oftentimes, even if you want to do an assessment, it gets trumped by something that's clearly generating revenue, like sales. For smaller companies, resources are very limited and early on you tend to be focused on revenue growth first, then security. You almost have to come up with a policy where you do an assessment every three months. It just becomes one of your standard operating procedures (SOPs).

Answer

If they have ever had an attack, they're probably more open to security spending, but I think you have to say, &#34;These are the tools; this is what we need to do. I can't exactly tell you what it will save for you, but I know that a cyber attack is a brand issue.&#34; When your company gets attacked, you have a serious public relations issue you need to deal with. And they'll be receptive if they've either been in that situation, or if they had something big happen in their area recently that's caught their attention. But it is a challenge. There's a real tendency to keep saying, &#34;We'll do it next year.&#34;

Answer

Most of the times security is not seen as something that generates revenue. Small to medium businesses are focused on growth and how to make sales. Unless you are regulated or required to be compliant to some security standards to be able to do business in a certain area(state, industry) or with a vendor, companies don't invest adequately in security.

Now as organizations grow they are starting to realize the brand impact of being hit by ransomware or the penalties by leaking PII so they start to invest more and more.
Interestingly, the security budget always get enough funding after a security breach.

Even with ransomware being a consistent topic in the news, do you think most companies are still approaching security as a “nice-to-have”?

Content you might like

What technology solution are you using for your employee experience platform? How does it integrate with your HCM solution and intranet solution? Any do's and don'ts, lessons learned to share?

Where do HR and other non-security/IT departments fit into your insider risk management strategy/program? What role do they currently play?

What are your CEO's top priorities for you this year?

What are some great on-prem and SaaS programs for internal PKI and Certificate Life Cycle Management?

What is the #1 threat to cloud security at your organization?