CISOs’ biggest worry in new role is inaccurate data on security posture

October 18, 2023, London and New York – Panaseer, a leader in security posture management using Continuous Controls Monitoring, today published its 2024 Security Leaders Peer Report. Now in its fourth year, the research provides insights into the conundrum many CISOs are facing surrounding the purpose and value of security controls data in supporting critical business decisions.

About the report

The survey of senior cybersecurity decision-makers in 1,000+ employee organizations in the UK and US found that the biggest concern when taking on a new CISO role is receiving an inaccurate audit of the company’s security posture (54%). This is a tacit acknowledgment that inaccurate security data can hide points of weakness and result in security resources not being utilized efficiently.

The issue of data quality was of greater concern to respondents than the lack of security budget (44%) and being scapegoated for a breach (44%).

The same desire to gain complete visibility into security controls data was also highlighted in the top challenges cited by respondents when starting a new CISO role:

1. Getting a true picture of weaknesses in organizational security posture (49%)
2. Understanding the threat landscape (45%)
3. Getting trusted data to enable strategic decisions (43%)

Understanding where security controls are failing is a critical first step to mitigating cyber risk and making the right decisions. Unfortunately, only 36% of security leaders are totally confident in their security data and use it for all strategic decision making. This is a concerning finding, as without trusted data CISOs might struggle to influence senior business stakeholders and ensure the right people are held accountable for fixing security issues.

“One of the most important things in the world is credibility. If you lose credibility, it’s the hardest thing to earn back from people,” argues Shawn Bowen, SVP and CISO of World Fuel Services. “So when your data lacks credibility, that’s the same problem. You need to know where your data is inaccurate and be up front about it, otherwise, if someone else finds the inaccuracies they aren’t going to trust you again.”

Perception and reality

The report found a concerning gulf between respondents’ perception of their security controls and reality. Nearly all (95%) said they are highly or somewhat confident that security controls are working effectively all the time, and 88% declared that they trust their security data is accurate.

As a result, over half (54%) of security leaders said they are very confident in their ability to use security data to prioritize actions to have the greatest impact on risk reduction. Nearly all (96%) are confident to some extent.

However, 79% of responding organizations admitted they have been surprised by a security incident that evaded their controls—indicating that data on the status of controls is either inaccurate or not being properly interpreted to improve security posture.

There is also evidence to suggest that controls data is not widely viewed as a strategic asset for cyber protection and risk mitigation.

Over one-third of respondents (38%) said they are unable to evidence remediation of control failures. A similar number (37%) classify control failures as a low priority—rising to 43% in financial services companies.

Restoring trust in the data

The vast majority (90%) of security leaders said that improving the accuracy of cybersecurity data is a priority for them in the next 12 months. Additionally, when asked to consider the impact of AI, 76% are concerned about threat actors using AI to find gaps in their organizations’ security controls. Given that they spend on average half (46%) of their time on manually collecting, formatting, and presenting this data, finding a more automated way to do it should also be treated with some urgency.

Continuous Controls Monitoring (CCM) can help to deliver the trust in this data that CISOs and other stakeholders need. The benefits of improving data quality and trust are clear, with 84% of security leaders believing that increasing trust in their data would help them secure more resources to protect their organization. But first there needs to be a mindset change in security leaders and the board—away from using controls data for reporting, and instead embracing it to proactively drive business decisions and stop problems before they occur.

“The industry needs to change if we are to solve the CISO security controls conundrum, and Continuous Controls Monitoring (CCM) can be the catalyst. It isn’t a better reporting tool, it’s a way of knowing what to do next – making day-to-day cybersecurity firefighting easier and getting ahead of the game on strategic risk,” argues Panaseer Security Evangelist, Marie Wilcox.

“At the moment, many leaders don’t know that security controls data can help them do this. It’s understanding the value of a big picture view, and single source of truth rather than multiple siloed perspectives.”

About Panaseer

Panaseer is an enterprise cybersecurity automation and data analytics company that helps organizations stop preventable breaches by ensuring security controls are fully deployed and working effectively — maximizing their security investments and resources. Control failures are the biggest problem in cybersecurity, with 79% of organizations admitting to being surprised by a security event that evaded existing controls.

Panaseer’s Continuous Controls Monitoring platform gives a complete, trusted view of security controls, with metrics and measures guidance aligned to best practice frameworks that improve collaboration and prioritization. With $262 billion spent on cybersecurity tools in 2021, CCM means organizations can do more for less by getting the most out of their existing security investments.