• More than a third of security professionals were not moderately or very confident with the final choice of security solution
• Despite this, 71% say their organisation touts its cyber robustness to partners and customers
• 68% of those hit by a breach in the past 12 months were not confident that they could recover from a similar breach again

Nominet has today announced the findings of its Cyber Confidence Report, which analysed almost 300 senior security practitioners in the UK and US, and found that CISOs were being put in compromising positions. Seventy-one percent said that their organisation uses the security posture of the organisation as a selling point, despite their lack of confidence in the security stack.

When asked how confident they were in an organisation’s final choice of security solutions, 34 percent of CISOs said that they were only somewhat or slightly confident. In addition, only 17 percent of those questioned said that the array of technology making up their security stack was completely effective. There is clearly some way to go before true cyber confidence from the CISO can be gained.

“It is critical that security professionals and the wider business are on the same page when it comes to cyber defence,” said Stuart Reed, VP of Cyber Security at Nominet. “While it is natural that a CISO might be slightly more cautious about claiming the effectiveness of the security solutions in place – because there is no silver bullet – more than a third not being even moderately confident in the final choice of a security solution is a worry, particularly when businesses are touting the benefits of their cyber defence. This disconnect in cyber confidence should act as an alarm bell to organisations and potentially prompt some investigation and analysis.”

Bouncing Back From A Breach: UK vs US

The Cyber Confidence Report also looked at the level of confidence among CISOs whose organisation had suffered a breach. While suffering a breach in the past 12 months didn’t impact the perception of security posture, it did impact the confidence around dealing with that type of breach again. In fact, two thirds (68%) of those hit by a breach in the past 12 months did not display a high level of confidence in their organisation’s ability to defend and recover from a similar attack again.

There was also an interesting distinction between the UK and US. US respondents were twice as likely to be very confident in the ability of an organisation to defend against a similar attack; 40 percent compared to 22 percent respectively. That was despite the fact that almost twice as many respondents in the US compared to the UK reported more than 30 breaches in the past 12 months; 20 percent compared to 11 percent.

“There is a difference between the security market in the UK and US and this is incredibly important for both vendors and third-party advisors to understand. What might reassure a CISO in the US won’t necessarily have the same effect in the UK and we need to be aware of the cultural and contextual difference to ensure that CISOs are supported and empowered to regain confidence in the security infrastructure they implement,” continued Reed.

Re-Prioritising: Measurement & Third-Party Management

In terms of building confidence in the security posture of an organisation, 20 percent of CISOs either didn’t test the performance of their security stack once it was in place or didn’t know if it was being tested. A lack of knowledge about the effectiveness of their security stack could be generating a lack of confidence among senior security professionals.

It is also important to look at investment decisions and how they might be contributing to the cyber confidence among senior security professionals. With 76 percent believing that cyber security is an increasing priority within their organisation, it begs the question of where investment should be spent. Areas ranked top for investment over the next three years are cyber monitoring (16%), cyber resilience (14%) and cyber governance (12%). Strategy and program transformation (3%), stakeholder awareness (4%) and lastly third party / supply chain management (6%).

There are two particularly critical areas of cyber robustness; the security infrastructure of the organisation itself, and that of the organisations that it is connected to. With third party and supply chain management seeing such low investment, combined with a lack of overall stack measurement; investment in these areas could enhance confidence felt by the security team.

Gary Foote, CIO at Haas F1 and responsible for its security posture gave his perspective: “Communicating investment priorities and what’s needed to keep our infrastructure secure is an increasingly important part of my job. In a technologically driven sport such as Formula 1, being able to show effectiveness of the security stack and potential risks through clear measurement is hugely important. We’re also highly conscious of the need for strong security across the third parties we engage with and in our supply chain. One of the ways we mitigate against this threat is ensuring we have early and holistic visibility through comprehensive network detection and response.”

Foote concluded; “For me, cyber confidence is about having the right proof points and technology in place, as well as having an open dialogue with the wider business, to ensure we can keep the wheels in motion.”

Dave Polton, VP of Solutions for Nominet Cyber said: “The channel is facing a huge opportunity to help CISOs regain confidence in their security stack but also to help them better communicate risk to the wider business. With access to the right technology, measurement tools and experienced consultancy – for example on how best to manage third parties – partners can be a CISO’s right-hand-man in building a robust security infrastructure which not only inspires confidence but can generate investment in the areas that count. We believe that giving partners access to training and development that enables them to carve out this position as trusted advisor is a crucial element of broader cyber confidence.”

-ENDS-

Notes To Editors

Methodology And Executive Analysis

Nominet commissioned a survey of 274 Chief Information Security Officers (CISOs), Chief Technology Officers (CTOs), Chief Information Officers (CIOs) and other professionals with responsibility for overseeing the cyber security of their organization.

Respondents were sourced from large organizations (with 2,500 employees or more) within the UK (117) and the US (157), spanning a range of industries and sectors including automotive, critical national infrastructure (CNI), finance, government, healthcare, hospitality, legal, life sciences, retail, transport and utilities.

About Nominet

Nominet is driven by a commitment to use technology to improve connectivity, security and inclusivity online. For over 20 years, Nominet has run the .UK internet infrastructure, developing an expertise in the Domain Name System (DNS) that now underpins sophisticated threat monitoring, detection, prevention and analytics that is used by governments and enterprises to mitigate cyber threats.

A profit with a purpose company, Nominet supports initiatives that contribute to a vibrant digital future and has donated over £47m to tech for good causes since 2008, benefitting more than 10 million people. The company has offices in Oxford and London in the UK and Washington DC in the US.