A Security Culture: Top Priorities for CISOs and their Teams

Cybercrime is increasing in efficiency, efficacy, and scale. Although organizations are frantically trying to prevent attacks from reaching their environments, there’s also an understanding that breaches are inevitable. According to IBM’s 2022 Cost of a Data Breach report, 83% of organizations studied have had more than one data breach. So it’s no longer a question of if a data breach will happen, but when.

The main line of defense against cyber criminals for most organizations is their security team, often led by a chief security information officer. Traditionally, CISOs spearhead internal and external information protection efforts, but the current cyber risk environment is expanding their role.

It’s no longer enough to create a security plan and rely on those with technical know-how to execute. CISOs must be able to communicate complex security concepts to all employees, even those in the C-suite and the boardroom. Doing so requires building a culture of security transparency and accountability rooted in the boardroom that then permeates through the rest of the organization. One way to look at it is that CISOs have a toolbox full of priorities, best practices, and insights they pull from to keep organizations secure. To successfully guard against increasingly complex and pervasive threats, the top CISOs are adjusting the contents of their toolboxes to include tools that a wider variety of people understand how to use. 

It Starts with a Good Foundation

When building a culture of security, it’s imperative to focus on security from the very beginning of the product life cycle. That helps to ensure all employees are up to date on best practices so security flaws can be identified as early as possible. Rather than waiting until a product is almost fully built to add in security features, CISOs are directing teams to start testing and implementing security early in the development process to keep user data safe from the start. By helping those team members across an organization -- from security engineers and accountants to executives -- understand the importance of addressing risks early, CISOs lay the groundwork for an intrinsic understanding of security.

Soft Skills: The Basis of an Effective Security Program

While security roles have traditionally been viewed as highly technical and culture-agnostic, top CISOs today recognize that soft skills are just as important. The best CISOs can speak across groups and understand the language of both the business and technical worlds.

In order to push security across the entire organization and create a healthy security culture, CISOs must be able to influence people; that means coming across as a partner and not as the company police. This requires strong people skills and the ability to build relationships across groups. Modern CISOs are evolving to prioritize soft skill development and culture-building initiatives, such as employee engagement and observability, in order to see that the security practices they know are best for the company actually implemented at large. 

A Culture-Oriented Approach to Measuring Success

Security roles are typically highly technical and not traditionally seen as major culture-drivers within a company. But top CISOs are now prioritizing culture-oriented measurements like employee engagement and observability. By building a culture of transparency and accountability, people at every level gain an understanding of their assets and associated risks. That is necessitated by the incessant rise of complex security threats. One of the most effective ways to cement security into an organization’s culture is to make people want to adopt security measures instead of feeling as though they are forced to.

To make security a foundational part of an organization’s culture, CISO priorities are adjusting to include the following: