Post #53: We just don’t know what’s out there

Perhaps it’s rather scary when you hear the Chief Product Officer of a large cybersecurity business make the above observation. However, it’s also a reflection of the complex and ever-changing landscape. We attended the keynote presentation at the Qualys Security Conference in London last week in order to understand better the profound impact that digital transformation is having upon the security industry. In terms of what we learned: 

1: Every business is becoming an IT company. This might sound like hyperbole, but the reality is that almost all organisations are using more IT in their business practices. Think about the ease, for example, of setting up a bank account online now versus the historic process of having to visit a branch and meet the manager. As Sumedh Thakar of Qualys put it, businesses “want to automate everything.”

2: Increased automation means increased challenges: As businesses expand their digital footprints, so their ‘surface area’ or ‘perimeter’ expands too. Put another way, as more ‘things’ (such as mobile devices or, say, handheld scanners in a factory) get connected and go online, so potential cybersecurity risks proportionately expand. This phenomenon is what provoked the original observation of not knowing what’s out there.

3: Cyberattacks are going to happen: Consider that some $66bn was spent on cybersecurity last year (per Statista) yet it still yields ineffective defences. Just think about the number of high-profile businesses such as the likes of British Airways and Facebook that have suffered breaches in the past years, beyond all the smaller, lower-profile names too. Given that attacks will happen, the correct approach – according to Qualys – is for businesses to seek to minimise the time needed to remediate the situation. In other words, the quicker problems are dealt with, the better. Machine learning outcomes “won’t solve hunger or world peace” (per Qualys) but they can reduce remediation time.

4: “Security is a cost of doing business.” Notwithstanding the vested interest of any cybersecurity company in making this observation, it remains abundantly self-evident to us that businesses which fail to invest in effective cybersecurity solutions run the risk of seeing their organisational reputations undermined. As we have observed before, data has little value unless it is stored, secured and analysed effectively. Expect to see more in terms of integrated cybersecurity solutions that offer vulnerability management, detection and response offerings.