Companies Need to Rethink What Cybersecurity Leadership Is
Cyber leaders have the monstrous and all-important goal of securing a business, but when companies make big, strategic decisions — about business models, digital strategy, product mix, M&A — cybersecurity is an afterthought. Today’s cyber leaders must be able to embed security throughout the company’s operations, rapidly respond to threats, and influence fellow senior leaders. Research being run by New America (where I’m a Cybersecurity Policy Fellow), paired with my observations from dozens of consulting engagements, suggests a framework for what business leaders must do to spur cybersecurity success. A global pharmaceutical organization that I’ve worked with incentivizes “better” behavior by tailoring cyber KPIs to each business unit, creating healthy peer pressure that encourages executives to partner with the cybersecurity function, and establishing bonuses for those leaders whose departments do.