If they were to increase the effectiveness of their cyber security program, companies should focus more on the human aspects of cyber protection, Gartner highlighted in its annual trend forecast. From the modular construction to the conversion of the operational model to the implementation of zero-trust, the analyst also provides additional advice for planning security strategies.
According to Gartner surveys, 90 percent of employees who admit to unsafe workplace activities are not deterred from their actions even if they are otherwise aware of the risks. Enterprise security and risk management (SRM) managers would therefore be wise to better balance the technology and people-centric elements of their cyber defense programs.
– In order to reduce their cyber security vulnerability, a human-centered approach to protection is essential for companies – he said Richard Addiscott, a senior analyst at Gartner. – By focusing on people, internal communication and cybersecurity talent management during audit planning and execution, organizations can simultaneously improve business risk management, decision-making and retention of security professionals.
Three areas in particular demand more attention from SRM managers to improve the management of cybersecurity risks and the effectiveness of the cyber defense program. On the one hand, they must not lose sight of the key role of people, on which the success and sustainability of the security program may depend. On the other hand, they must provide the technological capabilities that provide greater insight and strengthen the ability to respond in the entire digital environment of the organization, as well as transform the operation of protection in the spirit of greater – but not undermining – security agility.
Transformation of the operational model
In its forecast (Top Trends in Cybersecurity 2023), Gartner drew the attention of SRM managers to cybersecurity trends spanning three areas:
Human-centric security design – Personalized cyber protection prioritizes the employee experience throughout the control management lifecycle. According to the analyst, by 2027, half of enterprise cybersecurity directors (CISOs) will move to such human-centric practices to reduce friction from controls and maximize control adoption. Traditional programs aimed at developing security awareness have not always been successful in this area. CISOs must therefore use past experience to identify and implement controls that place a disproportionate burden on employees while not significantly mitigating risks.
People in sustainable security programs – Cybersecurity leaders have traditionally focused on improving technological capabilities and processes to protect, while the people essential to change have received less attention. At the same time, CISOs who switch to a people-centered approach and talent management, and pay more attention to the recruitment and retention of professionals, also achieve better results in the development of their programs, both in terms of functional and technological maturity. According to Gartner, by 2026, 60 percent of companies will has shifted to quiet recruiting to address systemic challenges in the cybersecurity workforce by nurturing in-house talent.
Transforming the Cybersecurity Operating Model to Support Value Creation – Technology is increasingly migrating from the company’s central IT department to the purview of business lines and business areas, fusion teams, and individual employees. According to the analyst, last year 41 percent of the employees did some technology-related work, and their proportion will continue to increase, reaching 75 percent in 2027. A wide range of business leaders now understand that achieving results faster is not only a priority, but also a major cybersecurity challenge. CISOs must therefore transform the operational model of cyber defense and adapt it to the way they work. And employees must learn how to balance and manage cybersecurity, financial, legal, reputational, and other competitive risks.
Threat exposure management – The attack surface of modern companies is so extensive and complex that CISOs need to implement a continuous threat exposure management (CTEM) program to review and understand it. According to Gartner’s forecast, companies that plan and prioritize their cybersecurity investments based on CTEM programs will suffer two-thirds fewer incidents in 2026 than organizations that do not manage their exposure. Addressing technological vulnerabilities alone is not enough for effective protection.
Exposure control and platform consolidation
In assessing their cyber security threats, companies are assisted by techniques, processes and tools that can be used to check how potential attackers can exploit any of their identified vulnerabilities and risk-increasing exposures. Today, these solutions have undergone significant development, they can be used to automate the repetitive or predictable operations of surveys to a large extent, which enables the regular control of attack techniques and established protection. According to the analyst, in 2026, more than 40 percent of organizations – including two-thirds of medium-sized companies – will rely on consolidated platforms to assess their cyber security exposure.
Consolidate Cybersecurity Platforms – As companies seek to simplify operations, platform vendors are building their platforms around one or more key areas of cybersecurity. For example, identity management services are offered on a unified platform that combines governance and capabilities to manage privileged users and general access. With consolidated platforms, SRM managers can keep an up-to-date record of security controls, making it easier to spot overlaps and reduce redundancies faster.
Organizations that can be assembled from elements demand modular cyber protection – Companies are increasingly switching from their previous, monolithic systems to modular applications in order to respond more flexibly to the challenges of the rapidly changing business environment. Cyber defense must also follow this approach to build security controls at a modular level into architectures and deployed applications. According to Gartner’s forecast, in 2027, more than 50 percent of enterprise core applications will be based on composable architectures, which means that their protection will have to keep up. This gives CISOs the unique opportunity to build component-based, reusable security controls that developers can build into applications out of the box.
The board receives greater cybersecurity competence – SRM leaders must also encourage the members of the company board to actively participate and assume greater responsibility in cybersecurity decision-making. For this, the board will need reports that demonstrate the impact of cyber security programs on business efforts and the achievement of goals, but its work will also be aided by advice on resource allocation and defense budget planning.
According to Gartner’s further forecast, by 2026, 10 percent of large companies will implement a comprehensive, mature and traceable zero-trust program, which promises to be a significant improvement compared to the current rate of less than 1 percent. The development of a mature enterprise-level zero-trust cybersecurity architecture requires the integration and configuration of many components, which is a rather complex technological task. According to the analyst, its success depends on the business value the company creates with it. It’s worth starting small and continuously developing the zero-trust approach, because this way it’s easier to recognize the benefits of the program, and the complexity of the implementation can be better managed step by step.
Hardware, software, tests, interesting and colorful news from the world of IT by clicking here!
