Proofpoint has released its annual Voice of the CISO report, which explores key challenges, expectations and priorities of chief information security officers (CISOs).
The findings reveal that 53% of Australian CISOs continue to feel at risk of experiencing a material cyber attack in the next 12 months.
Although this number is lower compared to previous years (68% in 2022 and 72% in 2021), 56% also believe their organisation is unprepared to cope with a targeted cyber attack, compared to 77% last year and 56% in 2021.
While organisations have largely overcome the disruptions of the last two years, the effects of the Great Resignation, recent wave of mass layoffs, and employee turnover continue to linger.
Of those CISOs who experienced a data loss event, 70% say that employees leaving the organisation played a role.
Even though 69% of security leaders had to deal with the loss of sensitive information in the past 12 months, just 49% believe they have adequate data protections in place.
The 2023 Voice of the CISO report examines global third-party survey responses from more than 1,600 CISOs at mid-to-large size organisations across different industries.
Throughout the course of Q1 2023, 100 CISOs were interviewed in each market across 16 countries: the U.S., Canada, the UK, France, Germany, Italy, Spain, Sweden, the Netherlands, UAE, KSA, Australia, Japan, Singapore, South Korea, and Brazil.
The report discusses global trends and regional differences around three central themes: the threats and risks CISOs face daily; the impact of employees on organisations’ cyber preparedness; and the defenses CISOs are building, especially as the economic downturn puts pressure on security budgets.
The survey also measures the changes in alignment between security leaders and their boards of directors, exploring how their relationship impacts security priorities.
“Our 2023 Voice of the CISO report reveals that amidst the rising difficulties of protecting their people and defending data, CISOs are being tested at a personal level with higher expectations, burnout, and uncertainty about personal liability,” said Yvette Lejins, resident CISO, Asia Pacific and Japan at Proofpoint. “The improving relationship between security leaders and board members gives us hope, however, and this partnership will enable organisations to overcome the new challenges they face this year and beyond.”
Key Australian findings from Proofpoint’s 2023 Voice of the CISO report include:
- Australian CISOs feel slightly more confident and more prepared than last year: 53% of Australian CISOs feel at risk of experiencing a material cyber attack in the next 12 months, compared to 68% last year and 72% in 2021. Further, 56% believe their organisation is unprepared to cope with a targeted cyber attack, compared to 77% last year and 56% in 2021.
- The loss of sensitive data is exacerbated by employee turnover: 69% of Australian security leaders reported having to deal with a material loss of sensitive data in the past 12 months, and of those, 70% agreed that employees leaving the organisation contributed to the loss. Despite those losses, 49% of Australian CISOs believe they have adequate controls to protect their data.
- Cloud account compromise tops the list of the most significant threats: the top threats perceived by Australian CISOs have shifted, with cloud account compromise now leading the way, followed closely by ransomware and DDoS attacks. Last year, insider threats were the top concern, followed by email fraud (business account compromise) and supply chain attacks.
- Most organisations are likely to pay a ransom if impacted by ransomware: 52% of Australian CISOs believe their organisation would pay to restore systems and prevent data release if attacked by ransomware in the next 12 months. And they are relying on insurance to shift the risk—53% said they would place a cyber insurance claim to recover losses incurred in various types of attacks.
- Supply chain risk is still a priority: 65% of Australian CISOs say they have adequate controls in place to mitigate supply chain risk, a decrease from last year’s 74%. While these protections may feel adequate for now, going forward, CISOs may feel more strapped for resources—47% say the shaky economy has negatively impacted their cybersecurity budget.
- People risk is still a concern, even with heightened awareness and improved cyber hygiene: there is a significant decrease in the number of Australian CISOs who view human error as their organisation’s biggest cyber vulnerability—51% in this year’s survey vs. 76% in 2022 and 45% in 2021. Also consistent with previous years, 53% of CISOs believe that employees understand their role in protecting the organisation, compared to 75% in 2022 and 41% in 2021; this illustrates Australian organisations still have a ways to go in building a strong security culture.
- CISOs and boards are in tune (not much change in CISO/boards relationship): 57% of Australian CISOs agree their board members see eye-to-eye with them on cybersecurity issues. This is a very slight decrease from the 58% of CISOs who shared this view last year but an increase from the 47% who felt this way in 2021.
- Mounting CISO pressures are making the job unsustainable: 58% of Australian CISOs feel they face unreasonable job expectations. This is a modest improvement from last year’s 63% who shared this view. CISOs’ job-related angst is a likely contributor—54% are concerned about personal liability and 50% say they have experienced burnout in the past 12 months.
“Security leaders must remain steadfast in protecting their people and data, a task made increasingly difficult as insiders prove themselves as a significant contributor to sensitive data loss,” said Ryan Kalember, executive vice president of cybersecurity strategy for Proofpoint. “If recent devastating attacks are any indication, CISOs have an even tougher road ahead, especially given the precarious security budgets and new job pressures. Therefore, CISOs must ensure they focus on the right priorities to move their organisations toward cyber resilience.”
You can read the full report here.
