How to secure board engagement in strategic cyber discussions

Businesses that do not invest in cybersecurity face the risk of huge financial and reputational damage.

The pandemic has raised the threat of cyber attacks for businesses. Many reports show an alarming increase in incidents in the last year, with the attack methods of cybercriminals becoming increasingly sophisticated. Despite this, boards are still not taking the initiative when it comes to cybersecurity.

With this in mind, Ash Patel, Head of Cyber at ECI Partners, the leading growth-focused mid-market private equity firm, who advises the boards of the portfolio on how to identify and understand the scale of the cyber risks they face, shares his thoughts on how businesses can mitigate the cyber risks facing their operations.

Why CEOs should care?

Four in 10 businesses suffered a breach or attack last year; of those, more than a third reported negative impacts, ranging from financial loss to business disruption. However, the consequences of a cyber attack go well beyond that, businesses could face:

  • Loss of crucial intellectual property to a rival, allowing them to secure a competitive advantage
  • Punitive regulatory sanctions with fines of up to 2% of a company’s global revenues, as mandated under the General Data Protection Regulation (GDPR)
  • Reputational damage and loss of customer revenue with more than one in four consumers stating they would stop doing business with a company following an incident compromising their data security or privacy

Ash Patel, Head of Cyber at ECI Partners, comments: “The financial and reputational fallout from a cyber attack can create huge problems for mid-sized businesses. And with cybercrime showing no signs of slowing down, it’s imperative that businesses understand the threat and are proactive in mitigating the dangers.”

“Tackling these risks is not a one-size-fits-all approach. Businesses need to identify the gaps in their own cybersecurity defences, make their own decisions about acceptable risks, and find the right strategies to counter them.”

How CTOs can push cybersecurity up the board agenda

In order to truly protect the business from breaches and attacks, it’s important that the board makes cybersecurity a priority. CTOs have a responsibility to make this happen, and the best way of achieving this is:

  1. Talk to boards in the language of the business
    Technical IT jargon is far less likely to resonate strongly with the board than a discussion about how cyber attacks threaten the business’s value story.
  1. Focus on future proofing as well as today’s operations
    It is important to not overlook the threat that cyber poses to innovation. Boards’ efforts to pursue a digital agenda may be undermined by cyber risk if it is not properly understood and planned for.
  1. Concentrate on areas of weakness
    Conducting cyber gap analysis, which focuses on the areas of risk where controls are often weaker and take steps to mitigate these specific risks. For example, the human link is often one of the weakest, so firms should invest in regular staff training to mitigate these
  2. Learn from experience
    Spend time discussing incident reports with the board, focusing in particular on what the company has learned – and what is required to prevent a reoccurrence of that type in the future
  1. Agree on targets and monitoring
    With a set of key performance indicators included in each board pack, the board will have a clear view of how the company is performing and where they might need to divert more resource to

Ash Patel continues: “Cybersecurity, and the risk management associated with it, is and should be a board-level responsibility. For businesses that don’t have their own cyber team or specialist, it falls to the CTO to work with the board, to educate them on the risks, strategy, performance indicators and reporting.”

“Once CEOs and the board have a full grasp of cyber in context of their business, they will be better equipped to not only protect against and properly handle potential attacks, they will also be able to pursue the business’s digital transformation and growth priorities.”

For more news from Top Business Tech, don’t forget to subscribe to our daily bulletin!

Follow us on LinkedIn and Twitter

Amber Donovan-Stevens

Amber is a Content Editor at Top Business Tech

eCMR: If not now, then when?

Gerry Daalhuisen • 17th July 2024

There have been several unexpected pit stops on the road to eliminating paper-based processes in logistics. But, is paper finally set to be a thing of the past?

Tackling Tech Debt

Wes van den Berg • 16th July 2024

5 years ago if you were a CIO without a cloud strategy you’d likely be out of a job. But making decisions in haste might mean businesses ended up with technology they regret, that doesn’t deliver on the promised value.

Laying the foundations for global connectivity

Waldemar Sterz • 26th June 2024

With the globalisation of trade, the axis is shifting. The world has witnessed an unprecedented rise in new digital trade routes that are connecting continents and increasing trade volumes between nations. Waldemar Sterz, CEO of Telegraph42 explains the complexities involved in establishing a Global Internet and provides insight into some of the key initiatives Telegraph42...

IoT Security: Protecting Your Connected Devices from Cyber Attacks

Miro Khach • 19th June 2024

Did you know we’re heading towards having more than 25 billion IoT devices by 2030? This jump means we have to really focus on keeping our smart devices safe. We’re looking at everything from threats to our connected home gadgets to needing strong encryption methods. Ensuring we have secure ways to talk to these devices...

Future Proofing Shipping Against the Next Crisis

Captain Steve Bomgardner • 18th June 2024

Irrespective of whether the next crisis for ship owners is war, weather or another global health event, one fact is ineluctable: recruiting onboard crew is becoming difficult. With limited shore time and contracts that become ever longer, morale is a big issue on board. The job can be both mundane and high risk. Every day...