Background

The Critical Balance of Cyber-risk and Cyberthreat Management

In a digital world, no responsible leadership team questions the need for effective cybersecurity. Boards of directors and C-suite executives prize business-aligned CISOs – security leaders who skillfully allocate scarce resources to defend the enterprise against attacks and vulnerabilities while enabling rapid introduction of new corporate capabilities.

In most contexts, demonstrating cybersecurity success requires a positive outcome: software tested and approved at the speed of DevOps, rapid action to prevent a lost laptop from leaking customer contract details, and flexible solutions that can quickly extend to new SaaS applications demanded by business users.

When it comes to compliance, however, the process becomes cloudier. Large enterprises face a complex mix of regulations: international (across all countries where the company does business and, potentially, where its customers live), national, state, and, in many cases, industry.

These non-standard strictures change frequently and erratically. New executive orders¹can emerge, along with changes to policy enforcement and fines,² often with little warning. Compliance departments must respond quickly and reprioritize investments, balancing improvement initiatives across these new requirements, customer data privacy demands, cyber insurance changes, staffing needs, and other corporate priorities.

[Source: Stratascale 2022]

¹For an example, see “Executive Order 14028 of May 12, 2021 Improving the Nation's Cybersecurity.”

²For an example, see Riddick, The SEC Is Serious About Cybersecurity. Is your Company? Harvard Business Review, September 2021.

Distinguishing Cyber-risk and Cyberthreats

To further complicate a CISO’s efforts to effectively address compliance, the regulatory quagmire extends well beyond the corporate cybersecurity office. It encompasses linked but different domains, which McKinsey describes as “cyber-risk” and “cyberthreats.”³

Cyber-risk represents one of many classes of corporate risk and is prioritized and managed at a corporate executive or board level, while cyberthreats “exist in the context of enterprise cyber-risk as potential avenues for loss of confidentiality, integrity, and availability of digital assets…the risk impact of cyberthreats includes fraud, financial crime, data loss, or loss of system availability.”

The sprawling nature of this cyber-risk/cyberthreat continuum, involving issues both directly within and emphatically beyond a CISO’s control, complicates the development and execution of a cybersecurity strategy that addresses concerns around governance, risk, and compliance (GRC – also referred to within the security domain as integrated risk management, or IRM).

In the preparation of this report, a team of expert contributors captured this diffuse set of requirements in a schematic that illustrates the many considerations impacting effective regulatory risk management. Cybersecurity leaders serve as the first line of defense against cyberthreats and need to also act as effective members of a broader corporate team responsible for overall risk management.

³This distinction is used frequently by McKinsey: examples include Boehm et al., The risk-based approach to cybersecurity. McKinsey & Company, October 8, 2019 and Boehm et al., Enhanced cyberrisk reporting: Opening doors to risk-based cybersecurity. McKinsey & Company, January 29, 2020.

[Source: Stratascale 2022]

To establish an effective regulatory security posture, security leaders must balance two discrete domains: cyber-risk, one aspect of a broad set of corporate risks, and cyberthreats, the attack vectors and vulnerabilities under the cybersecurity team’s purview. Cyber-risk is a subset of the governance, risk, and compliance (GRC) issues concerning the board of directors and senior executives; the security management team is responsible for policies, technologies, and (ultimately) outcomes that effectively manage cyberthreats that are material to risk mandates.