CISOs are upbeat about the potential of AI tools in security operations, new research shows, but the priority focus for many right now is filling workforce gaps.

Findings from Splunk’s annual CISO Report show AI adoption is a key priority, with 68% highlighting investment in this domain as a leading focus alongside improvements to threat detection and response capabilities and identity and access management (IAM).

Indeed, around 92% said the technology is helping their teams to review more security events while 89% reported improved data correlation.

Yet despite this, just 6% have fully deployed agentic AI in security operations, pointing to sluggish adoption rates.

More than one-third (39%) of CISOs who have partially or fully adopted agentic AI strongly agree it has increased their teams’ reporting speed - more than twice the rate of those who are still exploring the technology.

More than eight-in-ten (82%) of CISOs, meanwhile, believe agentic AI will increase the amount of data reviewed, and 82% said it will increase correlation and response speeds.

While the potential benefits of AI are tantalizing for security leaders, the other side of the coin is that 86% fear agentic AI will increase the sophistication of social engineering attacks.

Similarly, 82% believe it will increase deployment speed and complexity of persistence mechanisms.

New tools mean nothing without talent for CISOs

Although AI is increasingly prevalent, CISOs don't expect technology to replace any security analyst jobs. Instead, they're prioritizing human capital to address critical skills gaps: upskilling current workforces, hiring new full-time employees, and engaging contractors.

The skillsets CISOs are most lacking in their security programs are threat hunting, engineering support - for vendor tooling, detection engineering, or maintenance - software development, and network and cloud architecture.

"Because of AI, CISOs will need to constantly reskill, upskill and bring in new talent required to achieve the ROI leadership wants. In this sense, AI will be creating jobs, not eliminating them," said Ryan Fetterman, senior manager, SURGe by Cisco Foundation AI.

Among those who rank threat hunting as their team’s biggest skills gap, 71% said upskilling their current workforce was a top means for addressing shortages. T

hose with bigger engineering gaps tend to focus on hiring new full-time employees, while hiring contractors is the answer for most of those whose biggest gap is software development.

This is easier said than done, however, with only 16% expecting to fill all their shortages.

“Investing in your teams, in part, means rethinking your hiring strategy. I challenge conventional wisdom that demands a cybersecurity degree or a decade of experience,” said Fanning.

"In a field where technical knowledge becomes obsolete quickly, a candidate’s foundational understanding of computing, systems, and networks — as well as curiosity, adaptability, and problem-solving skills — are far more valuable. Cyber knowledge can be taught, where needed, on top of that foundation.”

FOLLOW US ON SOCIAL MEDIA

Finance leaders have a poor opinion of the performance of CISOs, believing that they can't always communicate clearly and aren't fully aligned with business needs.

A new survey of 300 CISOs, directors of cybersecurity, CFOs, and finance leaders by threat-hunting firm Expel found less than half (46%) of security leaders think their finance counterparts are highly aligned with the security team’s priorities.

Finance leaders, though, are less convinced, with only 35% believing that their security counterparts are highly aligned with the finance team’s priorities.

These conflicting perceptions on both sides of the divide further exacerbate existing issues with alignment, the study noted.

Crucially, there's a similar pattern when it comes to risk tolerance and budget expectations. While 71% of surveyed security leaders say that security and finance teams are fully or very aligned, finance decision-makers are much less positive, with only 58% saying the same.

"While most finance decision-makers see security as business-critical, they demonstrate a lower level of assurance in some of their security teams’ abilities," the researchers said.

Only half of surveyed finance leaders said they were very confident that their security team can communicate business impact clearly or protect the organization from major cyber events, while only four-in-ten express full confidence in security’s ability to align with business strategy.

Security decision-makers, meanwhile, are suspicious that they're perceived negatively by finance, with 36% saying they're seen as a cost center and 35% as no more than an operational necessity.

"The real issue isn't that finance sees security as a cost center — it's that too many security leaders haven't learned to articulate value in terms finance understands," said Greg Notch, Expel chief security officer.

"Security leaders should spend their time showing how that cost translates to business protection. Finance teams make cost-benefit decisions all day long. They're not afraid of costs; they're afraid of costs they can't quantify or understand."

How cyber leaders can shake up communication

When reporting results to finance, surveyed security leaders typically prioritize metrics like business impact of actual security incidents at 18%, cost of control versus potential losses at 17%, security program maturity level at 16%, and risk reduction score at 15%.

However, researchers found these metrics don't align with what finance actually requires for making strategic decisions. In fact, program maturity level versus industry benchmarks is the second least popular metric among finance leaders.

"Instead of falling back on maturity metrics, leaders need to communicate in the language of risk, especially when justifying security spend," advised Notch.

The calculation, he said, means taking the percentage - or percentage range - of likelihood that the organization will experience a breach, and the cost of that breach.

From there, you can determine that an investment that costs $x will likely lower your percentage likelihood of breach by x%.

"Cybersecurity teams have to understand the KPIs that matter to the business and how their operations ladder up into those," he said.

"It’s all about cybersecurity teams being able to communicate how their impact is contributing to those KPIs in the language of the business — which is all about dollars and cents."

FOLLOW US ON SOCIAL MEDIA

Often underestimated by CISOs, hardware and network vulnerabilities are on the rise as IoT proliferates and AI creates increasingly larger attack surfaces.

That’s according to an analysis by Bugcrowd, which found the last year has seen a massive 88% increase in hardware vulnerabilities and a doubling in network flaws.

In a new report, Inside the Mind of a CISO 2025: Resilience in an AI-Accelerated World, the firm said that 81% of security researchers had encountered new hardware vulnerabilities in the past 12 months.

Bugcrowd pointed to a 40% rise in broken access control vulnerabilities as a key factor behind rising threats. Meanwhile, sensitive data exposure was another problem area, with a 42% increase in critical vulnerabilities tied to personal information like names, addresses, and account details.

"We are in a high-stakes innovation race, but with every AI advance, the security landscape becomes exponentially more complex," said Nick McKenzie, Bugcrowd CISO. "Attackers are exploiting this complexity, but still targeting foundational layers like hardware and APIs."

The good news is that the number of critical vulnerabilities has gone down slightly year-over-year. The number of critical flaws in API targets fell by about 25%, for example, while vulnerabilities in website targets decreased by 30%.

There was a slight rise in critical vulnerabilities for Android, hardware, iOS, and network targets. Of these, broken access control is now the top category at 36%.

However, there's also been a 42% increase in sensitive data exposure and a 10% increase in API vulnerabilities as attack surfaces expand. Network vulnerabilities doubled, according to the report.

Pentesters are having a field day

This increasingly perilous threat landscape has sparked a boom time for ethical hackers and pentesters, the report noted. Across 2024, there was a 32% increase in average bug bounty payouts for critical vulnerabilities.

Bugcrowd said enterprises are focusing on critical vulnerability payouts, paying more for P1 vulnerabilities and less for P3, P4, and P5 vulnerabilities.

Despite this helping hand, CISOs are still contending with heavy workloads and growing challenges. With applications going through multiple development cycles and teams under immense pressure to release features quickly, this is creating a frantic environment where mistakes are made.

New attack vectors and often forgotten targets like APIs and hardware typically among those overlooked.

With this in mind, Bugcrowd said organizations should consider adding APIs and hardware to the scope of their offensive security testing programs.

They should also adopt an integrated approach to attack surface intelligence - which, the firm noted, would help to secure budgets by showing measurable improvements in security efficiency.

Naturally, the company urged enterprises to make better use of ethical hackers, pentesters, and red teamers for offensive security training.

“By using adversarial testing and objective measurement, security leaders can shift from reactive firefighting to building true resilience, " said Trey Ford, chief strategy and trust officer at Bugcrowd.

"Ultimately, this enables CISOs to confidently articulate their security story and secure resources necessary to protect their organizations.”

MORE FROM ITPRO

• This DeepSeek-powered pen testing tool could be a Cobalt Strike successor
• Everything you need to know about penetration testing
• Businesses are taking their eye off the ball with vulnerability patching

The RSAC Conference 2025 last month left CISOs to process a whirlwind of discussions, innovations, and evolving strategic imperatives. Building on themes that gained significant traction in previous years, 2025's event solidified several critical areas demanding CISO attention, from the pervasive influence of AI to the increasing personal and professional pressures of the CISO role itself.

For security leaders navigating this complex terrain, the key takeaways from San Francisco were both challenging and clarifying. With a focus on agentic AI, identity security, collaborative defense, and human-centric strategies, the conference provided valuable insights for security leaders.

Agentic AI: transforming security operations

Agentic AI, defined by autonomous systems capable of independent decision-making, was a major topic at RSAC Conference 2025. Cisco unveiled an open-source 8-billion-parameter Foundation AI Security Model, which is intended to improve detection and response capabilities within security operations centers (SOCs). This model is designed to automate tasks such as identifying intrusion methodologies, assessing severity, and generating compliance reports.

Vasu Jakkal, corporate vice president of security at Microsoft, highlighted the transformative potential of agentic AI in cybersecurity, discussing how AI agents can work collaboratively to detect and prevent intrusions, thereby reducing the cost and complexity of sophisticated security operations.

Identity security: beyond human users

The rise of digital ecosystems has resulted in numerous non-human identities, like machine-to-machine communications and AI agents. Traditional identity management is now inadequate, prompting organizations to secure these digital identities against unauthorized access and system compromises.

Comprehensive identity governance solutions are required, covering both human and non-human entities, with strong authentication and authorization protocols throughout the enterprise.

Collaborative defense between public and private sectors

RSAC Conference 2025 underscored the vital importance of collaboration between private enterprises and government agencies in addressing evolving digital challenges. Sessions emphasized the importance of sharing intelligence and coordinating responses to close gaps in cybersecurity. Collective knowledge and resources can help organizations better manage modern digital issues, creating a stronger defense network.

Speakers and panellists deliberated on strategies for effective public-private partnerships, advocating for open communication channels and trust-building measures. These partnerships aim to streamline intelligence sharing on harmful activities, making it more actionable and timely, while also pooling technological resources to tackle sophisticated malicious campaigns. Despite political shifts and challenges that can sometimes hinder collaboration, the overarching consensus was that such alliances are indispensable for fortifying both national and organizational cybersecurity postures.

CISOs are advised to foster partnerships through intelligence-sharing forums and collaborative plans, enhancing preparedness against emerging risks.

Human element as the persistent core of cybersecurity

While technological advancements dominate the cybersecurity landscape, the human factor remains a critical component. Keynotes and sessions consistently highlighted that human behavior, decision-making, and collaboration are irreplaceable elements in building robust security frameworks. Despite the proliferation of automation and artificial intelligence, the ability of humans to adapt swiftly to unforeseen security challenges and coordinate responses across diverse teams remains unmatched. This human-centric approach reinforces the significance of fostering a culture of vigilance and resilience within organizations, where each member is empowered to contribute to the collective defense.

The emphasis on community and shared responsibility further underscores the importance of continuous education and awareness programs. These initiatives are designed not only to enhance technical knowledge but also to cultivate critical thinking and proactive attitudes needed to counter increasingly sophisticated digital intrusions. By integrating these programs alongside cutting-edge technological defenses, organizations can strike a powerful balance, ensuring that while systems evolve to meet new challenges, the human element remains the persistent and vital core of cybersecurity success.

Innovation and investment driving the future

A key takeaway for CISOs from RSAC Conference 2025 is the recognition of ProjectDiscovery's open-source platform for managing system weaknesses as a game-changer for under-resourced teams. Its advanced scanning capabilities highlight the growing importance of accessible security tools in democratizing cybersecurity efforts.

The role of the Chief Information Security Officer (CISO) has undergone a profound metamorphosis. Once a primarily technical custodian sequestered within IT, the modern CISO is increasingly a strategic business leader, pivotal to organizational resilience, innovation enablement, and stakeholder trust. 

Recent survey data underscores the shift: the proportion of CISOs who report directly to the CEO has almost tripled in just one year, soaring from five percent in 2023 to 14 percent in 2024. Facing increasingly complex digital threats and transformative technologies like Artificial Intelligence (AI), today’s CISO must be a multifaceted expert, a strong communicator, and a visionary architect of enterprise-wide security.

The modern-day CISO: responsibilities, remit, and key alliances

Being a CISO in the current era means shouldering a vast array of responsibilities that extend far beyond the traditional confines of IT protection. Core duties now include strategic risk management, aligning security posture with overarching business objectives, and maintaining a dynamic grasp of the organization’s risk appetite. 

As Gartner’s Nathan Parks cautions: “With only 14 percent of security-and-risk leaders able to secure their data and support business goals, many organizations court vulnerability and inefficiency.” 

Developing and continuously tuning enterprise-wide policies, standards, and controls is, therefore, just the start. Indeed,; the modern CISO must also ensure the organization is ready to detect, respond to, and recover from security events with minimal disruption.

The CISO’s remit is truly enterprise-wide, touching every information asset and process, so success hinges on robust collaboration. Board-level engagement has become the norm: Splunk’s 2025 CISO Report notes that 82 percent of CISOs interact directly with the CEO and 83 percent attend board meetings on a regular basis, prompting author Michael Fanning to observe, “CISOs have officially arrived in the C-suite, and we’re working more closely with our boards than ever before.” 

Beyond the boardroom, a tight partnership with the CIO grounds security strategy in operational reality, while coordination with Legal and Compliance navigates the rising tide of data-protection regulations. Human Resources helps cultivate a security-aware culture and manage insider risk, and — perhaps most critically — business-unit leaders ensure that controls support, rather than stifle, innovation.

Finally, today’s CISO is increasingly expected to spearhead organizational resilience. PwC’s 2025 Global Digital Trust Insights frames the opportunity plainly: “CISOs can lead resilience-building efforts by proactively assessing risks and scenario-planning — translating how strong resilience benefits the business is just as important as the plan itself.” In other words, the modern security chief is no longer a gatekeeper at the edge of IT, but a business architect whose influence — and accountability — extends to every corner of the enterprise.

The evolutionary journey of the CISO

The CISO role, or its early equivalents, began to solidify in the late 1990s and early 2000s, largely in response to the burgeoning reliance on networked IT systems and the initial waves of internet-borne malicious activities. Initially, the focus was heavily technical.

However, several powerful forces have dramatically reshaped and elevated the role, particularly over the last decade. The escalating sophistication of hostile actors, transitioning from opportunistic individuals to well-resourced, often state-affiliated groups, has fundamentally changed the nature of the challenge.

At the same time, widespread digital transformation, such as cloud adoption, IoT, mobile computing, and the sheer volume of data, has expanded the organizational surface vulnerable to security compromises. Additionally, the surge in data privacy regulations like GDPR and CCPA has increased accountability on organizations and their CISOs. 

Public security incidents now involve severe financial penalties, reputational damage, loss of customer trust, and operational paralysis, elevating security to a board-level imperative. Consequently, the CISO role has evolved from technologist to strategic risk executive, often reporting higher and needing broader skills in business, finance, communication, and leadership.

On the horizon: enduring challenges and AI as a strategic ally

The future for CISOs promises no abatement in challenges. Digital perils will keep mutating, which means security leaders must constantly try and stay more than several steps ahead. 

Indeed, the talent crunch shows no sign of easing: the 2024 ISC² Cybersecurity Workforce Study puts today’s global workforce gap at 4.76 million professionals. Furthermore, more than half (59 %) of organizations say skills shortages have already had a significant impact on their ability to shield themselves against adversaries who can now use AI at scale while internal teams are stretched dangerously thin. 

This all means that the modern CISO must marshal strategy, technology, and cross-functional alliances to keep the enterprise secure today, tomorrow, and beyond. 

A number of technologies, particularly AI, offer a powerful means for CISOs to augment their capabilities and stay ahead. 

AI can be a significant force for good by automating voluminous and repetitive tasks, thus freeing up human analysts for more strategic work. It can enhance detection capabilities by identifying subtle patterns and anomalies indicative of sophisticated hostile actions that might evade traditional tools. 

Furthermore, AI can accelerate response times to security events through automated containment measures. Research from various bodies supports this positive outlook. 

A Microsoft Security survey, for instance, revealed that nearly half of current AI for security users felt good about its ability to make critical security decisions. This growing confidence suggests a shift in perception, where AI is increasingly viewed as an indispensable aid rather than a potential hindrance to an organization’s protective posture.

The path forward: strategic adaptation and leadership

While AI offers immense promise, the rapid emergence of generative AI (GenAI) also introduces a new frontier of specific concerns for CISOs, particularly regarding its secure adoption within the business. 

Data protection and potential leakage are paramount. The ISMG "2024 Generative AI Study" found that 80% of leaders fear sensitive information slipping through the cracks when employees use GenAI tools, especially public models, without proper oversight. CISOs must establish robust governance frameworks to manage data input and output for GenAI systems to prevent inadvertent exposure of proprietary or customer information.

Compliance is another significant hurdle, with evolving regulations like the EU AI Act causing confusion. Indeed, just 38% and 52% of business and cybersecurity leaders, respectively, say they do have a good understanding of AI regulations, according to the ISMG study.

Finally, the rise of emerging GenAI-driven perils requires proactive attention. Hostile actors are already exploring how GenAI can be used to craft more convincing, deceptive email campaigns, generate polymorphic malicious code, or create sophisticated disinformation.

The CISO of today and tomorrow must be adaptable, business-savvy, and technologically astute. Their role involves not only safeguarding the organization but also enabling secure innovation. 

This includes championing the safe, ethical adoption of AI in security and guiding its responsible use across the enterprise. By understanding both the potential and risks of technologies like GenAI, CISOs can strategically leverage them as powerful allies. 

Continuous learning, strategic foresight, and resilient leadership are essential for navigating the digital world securely.

As cost pressures rise and cyber threats become more sophisticated, CISOs are increasingly looking to AI to reduce the strain, new research suggests.

Cybersecurity budgets are under pressure, with only two-in-ten global security leaders and consultants allocating more than 10% of their annual budget to cybersecurity - 12% down from 2023.

Notably, three-in-ten told Wipro for its 2025 State of Cybersecurity Report that investing in AI automation to bolster cybersecurity operations and reduce costs is a top priority.

A similar number are using AI to improve threat detection and response times, with a quarter using it to enhance incident response capabilities.

"Cybersecurity budgets are struggling to keep pace with the growing sophistication of cyber threats," said Tony Buffomante, SVP and global head of cybersecurity and risk services at Wipro.

"AI offers a solution by helping organizations strengthen defenses while optimizing costs. This allows CISOs to adopt a more outcome-driven focus by prioritizing risk-adjusted returns on investments."

There are, of course, challenges to AI adoption. More than three-quarters (84%) of respondents cited data quality and privacy as the biggest difficulty in implementing effective AI-driven cybersecurity solutions.

Other problems included a lack of expertise, a challenge for three-quarters of tech leaders, forcing them to depend on external resources or undertake costly upskilling programs.

Seven-in-ten respondents listed integration with legacy systems as a prominent challenge while budgetary constraints affect a similar number too - largely thanks to the need for significant investments in various hardware components and software licenses, along with continuous system monitoring and maintenance.

CISOs target tool sprawl to optimize costs

Other strategies used by CISOs to optimize costs include ‘tools rationalization’. This involves evaluating and consolidating duplicate security tools across platforms to eliminate redundancies and improve efficiency while reducing costs.

Just over a quarter of respondents specifically highlighted tools rationalization as a key focus at present.

Tool sprawl has become a recurring issue for cybersecurity practitioners in recent years, with research in late 2024 showing teams were becoming frustrated with a growing array of disparate solutions.

Meanwhile, 23% are aiming to cut costs by undertaking security and risk management process optimization, and two-in-ten are aiming to simplify their operating model.

Security strategies require bold vision

Notably, Wipro’s study found organizations are taking a strategic approach to cybersecurity. There's an almost universal focus on Zero Trust security frameworks, with 97% of respondents identifying it as a top investment priority.

Meanwhile, 82% are investing in IoT device management and security to address the growing risks associated with the proliferation of connected devices.

Nearly eight-in-ten organizations are prioritizing investment in Secure Access Service Edge (SASE) to cope with rapid cloud adoption, the rise of remote work and the evolving threat landscape.

With an influx of AI tools, more than half (55%) of security leaders also said they are ramping up efforts to prioritize LLM guardrails. This, the study noted, is helping CISOs and security teams better manage and secure access to LLMs for enterprise applications.

"Increased technological complexity, constantly evolving regulations and a rise in sophisticated cyber threats across multi-hybrid cloud environments create daunting challenges for security teams," said Buffomante.

"CISOs need to adopt a risk-adjusted, outcome-oriented mindset and transition from technologists who merely prevent and react to breaches to risk strategists focused on optimizing enterprise cyber resilience."

MORE FROM ITPRO

• Bigger salaries, more burnout: Is the CISO role in crisis?
• CISOs are gaining more influence in the boardroom, and it’s about time
• Why the CISO role is so demanding – and how leaders can help

With the threat of personal liability for data breaches hanging over CISOs' heads, organizations are increasingly working to minimize the risk.

Recent US and EU legislation has made it possible to hold executives responsible for security breaches, with potential penalties of fines and even imprisonment.

A recent survey from edge cloud platform provider Fastly found that 93% of organizations have made policy changes over the last 12 months to try and deal with concerns about increased personal liability for CISOs.

As part of this, two-in-five said they were giving CISOs more say in strategic decisions at board level. To reduce risk, 38% said they'd promised greater scrutiny of cybersecurity disclosure documentation from supervisory agencies.

The same number said they'd improved legal support for cybersecurity staff, including taking out liability insurance, and corporations have allocated more resources to security in the past year.

"It’s encouraging to see the vast majority of companies making changes to liability disclosure given the inevitability of another worldwide outage that will put CISO accountability back into the spotlight," said Fastly CISO, Marshall Erwin.

"However, while investing in legal protection is an important step, this change is often more about shielding organizations from legal risk rather than fostering meaningful accountability to drive better security practices."

Firms are still uncertain over personal liability rules

Adding to the uncertainty is the fact that nearly half of organizations are unclear about who actually holds ultimate responsibility for cybersecurity incidents, while only 36% have clearly delineated roles and responsibilities within their teams.

"CISOs do not make the final call on every decision. When it comes to security risks, the question a board should be asking is, ‘Are we aligning the budget to address the risks the CISO has communicated to us?’," said Erwin.

"This is where accountability should start - at the senior leadership level, with clear communication and alignment of resources."

In late 2023, new rules were introduced by the US Securities and Exchange Commission (SEC) aimed at holding executives responsible for security breaches and mishaps.

It's no empty threat, either. Last year, the SEC filed charges against both SolarWinds and its CISO, Tim Brown, following the notorious attack in 2020.

Similarly, in 2023 Uber CSO Joseph Sullivan was convicted of trying to cover up a data breach and sentenced to three years of probation, a $50,000 fine, and 200 hours of community service.

Across the Atlantic, similar rules have been introduced by EU lawmakers, in particular the EU’s Network and Information Security Directive (NIS2). This legislation aims to protect critical infrastructure and services across the union, and includes personal liability for executives.

The Digital Operational Resilience Act (DORA), which regulates security practices for financial institutions, does the same.

But there's great uncertainty about how readily the measures will be implemented, and in what circumstances, according to Fastly’s report.

"We need better, clearer standards from regulators and enforcers that distinguish between unavoidable incidents and avoidable ones resulting from truly deficient security practices," said Erwin.

MORE FROM ITPRO

• CISOs are gaining more influence in the boardroom, and it's about time
• How CISOs are navigating the “slippery” AI data protection problem
• Remote work is still causing security headaches for CISOs

The role of the CISO is growing in status as cybersecurity becomes an increasingly pressing issue for enterprises globally, new research shows.

A recent study from Splunk shows security execs are being granted more powers to make strategic decisions for the business and are fostering closer collaborative ties with the boardroom and CEO.

More than eight-in-ten CISOs now report directly to the CEO, a huge increase from 47% in 2023. Meanwhile, 83% participate in board meetings somewhat often or most of the time.

However, while six-in-ten acknowledge that board members with cybersecurity backgrounds have a more powerful influence on security decisions, only 29% say their board includes at least one member with cybersecurity expertise.

"As cybersecurity becomes increasingly central to driving business success, CISOs and their boards have more opportunities to close gaps, gain greater alignment, and better understand each other in order to drive digital resilience,” said Michael Fanning, chief information security officer at Splunk.

“For CISOs, that means understanding the business beyond their IT environments and finding new ways to convey the ROI of security initiatives to their boards. For board members, it means committing to a security-first culture and consulting the CISO as a primary stakeholder in decisions that impact enterprise risk and governance."

CISOs on the board builds strong security practices

Splunk’s research found that board members with a security background reported stronger relationships with security teams, and felt more confident about the organization’s security posture.

They were much less likely than other board members to express concern they weren't doing enough to protect the organization.

Working relationships where a board member had a security background were particularly good when it came to setting and aligning on strategic cybersecurity goals, with CISOs on the board delivering a three-fold improvement.

Other areas to benefit included communicating progress against milestones and security goal achievements, along with budgeting adequately to meet goals.

There were, though, differences in priorities. More than half of CISOs thought innovating with emerging technologies was a priority, compared with just a third for board members. A similar proportion of CISOs prioritized upskilling or reskilling security employees, versus only 27% for boards.

"As the role of the CISO grows more complex and critical to organizations, CISOs must be able to balance security needs with business goals, culture, and articulate the value of security investments," commented Shefali Mookencherry, chief information security and privacy officer at the University of Illinois Chicago.

"By establishing strong relationships across various departments and stakeholders, CISOs can provide guidance and leadership to propel cybersecurity and privacy programs."

CISOs face regulatory challenges

As regulatory environments have become more complex, expansive, and punitive, CISOs are having to deliver faster incident reporting, and are facing more liability.

However, only 15% of CISOs ranked compliance status as a top performance metric, a significant contrast to 45% of boards. Nearly a quarter (21%) of CISOs said they'd been pressured not to report a compliance issue, although 59% said they would become a whistleblower if their organization was ignoring compliance requirements.

Meanwhile, cyber budgets reflect inconsistent support and misalignment, with three-in-ten CISOs saying they receive the appropriate budget for cybersecurity initiatives and accomplishing their security goals, compared with four-in-ten board members who think budgets are adequate.

Other woes included concerns that they're not doing enough, with 18% revealing they were unable to support a business initiative because of budget cuts in the last 12 months. Nearly two-thirds said that lack of support led to a cyber attack.

CISOs have reported the scope of their role has widened to encompass business concerns that extend beyond cybersecurity, but believe their compensation doesn't reflect this.

The 2025 State of the CISO report from IANS Research includes testimony from roughly 800 CISOs on the growing importance of the role, and the simultaneous growth in the role’s complexity and scope of responsibilities.

The report found that in addition to their traditional remit of InfoSec and digital risk, CISOs are increasingly being asked to look after other business domains such as digital strategy.

For example, 90% of CISOs said they had ownership of what might be considered their traditional domains including the organization’s security operations, architecture, and governance, as well as digital risk and compliance.

The majority (between 50 and 90%) also identified other elements of business risk, such as disaster recovery, business risk, and third-part risk management, as well as broader security concerns such as product security as falling under their remit too.

However, IANS noted a series of ‘emerging domains’ that 1-25% of CISOs reported were being added to their workload, including AI, M&A security, change management, IT due diligence, digital transformation, and innovation.

The report found the broader scope associated with the CISO role has not been reflected in their compensation, with just 3% of CISOs attributing salary raises to taking on further responsibilities.

IANS found that only when switching employers were CISOs more likely to see their additional workload reflected in their pay packet.

For example, 7% of CISOs said their growth in compensation was driven by a change in employers, a move which is often accompanied by taking on a larger role with more responsibilities, and this group received an average increase of 31%.

The vast majority of CISOs (70%), however, indicated any raises they received were annual merit-based increases, which on average were 6%.

CISOs taking ownership of IT unlikely to see meaningful pay rises

IANS identified three distinct segments among respondents in terms of their C-level access and boardroom influence, using the labels ‘strategic, functional, and tactical’.

Strategic CISOs, which accounted for 28% of the group are described as those who report directly to the CEO or at least have a high-ranking position in the C-suite hierarchy, and thus have significant influence across the organization.

This group also enjoys frequent interaction with the board, with quarterly meetings as the minimum, which IANS said promotes “mutual understanding and aligning on strategic priorities between the CISO and top leadership”.

The next group, which made up 50% of respondents, is referred to as the functional CISO. According to IANS’s taxonomy, functional CISOs excel in one of these areas but do not enjoy both C-suite access and boardroom engagement.

The final 22% of respondents were described as tactical CISOs, who have waning executive-level access to a lower organizational rank and only sporadic boardroom engagements.

Comparing the compensation for these three groups, IANS found strategic CISOs were the best remunerated, with an annual cash compensation of around $545,000, compared to $385,000 for functional CISOs and $291,000 for their tactical counterparts.

IANS noted that CISOs who oversee an organization's security as well as all of its IT functions, referred to as ‘dual CISOs’, are a surefire way to ensure increased compensation.

The study found that dual CISOs at large organizations earn an average total compensation (including equity) of $1 million, whereas those who only take on partial IT oversight are closer to the average of traditional CISOs who manage none of the IT functions ($653,000).

“This would seem to indicate taking on all of IT is highly rewarded, but being given some IT functions opportunistically—perhaps due to the departure of another IT executive or unclear lines of ownership between infosec and IT—is not a reliable path to higher compensation,”the report noted.

Cybersecurity and data protection specialist Acronis has announced the appointment of Gerald Beuchelt as its new chief information security officer (CISO).

An experienced industry leader, Beuchelt arrives with more than a decade of cybersecurity leadership experience, most recently serving as CISO at Sprinklr and previously holding the same role at LogMeIn.

Beuchelt’s career has also seen him serve as treasurer and director on the board of the Boston Chapter of Infragard, the FBI public-private partnership program, and the National Cyber Security Alliance.

Other roles include chief security officer at Salesforce-acquired Demandware, and principal information security engineer at The MITRE Corporation.

In his new role as Acronis’ CISO, Beuchelt will spearhead the firm’s global information security strategy to ensure the protection of its information, systems, and technologies. He will also work to drive its goal of securing clients’ data, applications, and systems, the company said in an announcement.

“We are proud to welcome Gerald to Acronis as our new CISO,” said Ezequiel Steiner, Acronis CEO. “His extensive experience and forward-thinking approach to cybersecurity will play a vital role in advancing our mission to protect all data, applications, and systems for organizations worldwide.

“As CISO, he will drive initiatives that ensure our customers and partners benefit from Acronis’ natively integrated solutions, which eliminate complexity and provide unmatched simplicity and performance.”

As a part of the firm’s senior security leadership team, Beuchelt will lead Acronis’ global team of IT, security, and compliance experts, as well as oversee corporate IT infrastructure such as help desk operations, server, and network management.

The cybersecurity provider said Beuchelt will also support the expansion of new research, reports, and threat intelligence from the Acronis Threat Research Unit (TRU).

Commenting on his appointment, Beuchelt praised the breadth of Acronis’ product capabilities, as well as its global impact and strategic direction.

“I’m particularly inspired by the company’s dedication to making security solutions scalable and accessible for service providers, enterprises, SMBs, and individual users alike,” he said.

“My focus will be on maintaining and continuously improving our security posture to address the increasingly complex threat landscape.

“As part of Acronis TRU, we will implement research-driven guidance that will shape Acronis’ capabilities to protect against modern threats while raising awareness of how our solutions empower businesses to succeed. I look forward to collaborating with the talented team at Acronis to expand our influence in the cybersecurity community.”

CISOs are feeling the pressure over stories of their peers being held personally liable for cybersecurity incidents.

In the most notorious example, the US Securities and Exchange Commission (SEC) last year announced that it was filing charges against both SolarWinds and its CISO, Tim Brown, amid allegations of "fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities".

While Brown beat the charges earlier this year, others haven’t been quite as lucky.

Uber CSO Joe Sullivan, for example, was given a three-year probation sentence and a $50,000 fine for covering up a 2016 data breach. And CISOs fear such charges could potentially be filed against them.

Seven-in-ten told security firm BlackFog in a new survey that incidents like this had negatively affected their opinion of the job. Around a third said the trend was a no-win situation for security leaders, leaving them facing internal consequences if they report failings and prosecuted if they don’t.

"The role of the CISO is all about managing risk for the organization but, as regulations tighten, security leaders increasingly need to consider their own personal risk," said BlackFog founder and CEO Dr Darren Williams.

Increased accountability has, at least, led to internal changes to improve cybersecurity practices within their organisation. Nearly half (44%) of respondents said their company had already put processes in place to reduce their cyber exposure as a result.

Nearly half of all respondents believe that the potential for an individual to be prosecuted following a cyber attack would improve accountability and transparency amongst cyber professionals.

This was higher for respondents in the US, at 55%, compared with those in the UK at 43%.

When asked about the impact on the cybersecurity leaders of the future, only 15% believed that it would be a deterrent for IT professionals to become CISOs.

Meanwhile, four-in-ten said the increased scrutiny and potential of personal liability has made the board take cybersecurity more seriously. This was higher in the UK, with 47% of security leaders agreeing, compared with just 35% in the US.

This has yet to translate into more resources, though, with just 10% of all respondents saying such concerns had translated to any rise in security budget.

"High profile instances of individuals being charged will no doubt add to the pressures they feel but could also be a catalyst for boards to support their leaders," said Williams.

"Improvements to governance, clear lines of reporting and incident response procedures are vital, but this must be supported by allocated resources so that security leaders can implement the security measures they need."

Social media and content aggregation giant Reddit has announced the appointment of Fredrick Lee as its new chief information security officer (CISO). 

Reporting to CTO Chris Slowe, Lee is tasked with overseeing Reddit’s privacy and security teams, which tackle the identification and mitigation of risks and challenges around information security, privacy, and compliance.

The security veteran brings more than 20 years’ experience leading global information and security efforts at major financial services companies and technology startups. 

He joins the company from his previous role as chief security officer (CSO) and head of IT at Gusto and has previously held the position of CSO at Square. 

Commenting on his appointment, Lee underlined Reddit’s need for robust security as the platform looks toward further growth.

“I believe Reddit uniquely helps its users build meaningful connections and conversations around the areas or interests they are most passionate about,” he said. 

“As Reddit grows, it is crucial that our security and trust systems remain resilient and agile to adapt to the ever-evolving threat landscape. 

“I’m thrilled to be joining such an exciting platform, and looking forward to helping reinforce the platform’s existing safety infrastructure and cyber security defenses, and continue advancing the systems that protect Redditors and their communities.”

Reddit says the security of both its platform and the wider business remains one of its “core trust pillars”. The company has continued to bolster its safety and security efforts in recent years, expanding its teams and reinforcing existing measures that are designed to protect the platform and its users.

Today, the platform stands at 57 million active daily users, with more than 100,000 active communities, and over 13 billion posts and comments.

As part of its security efforts, Reddit launched a new Transparency Center and regularly shares its practices, updates, and findings to help maintain and protect its global user community.

One such update was posted back in February, detailing a “sophisticated phishing campaign” that aimed to steal the credentials and two-factor authentication tokens of Reddit employees. 

The company said its systems were hacked as part of the campaign, with attackers gaining access to some internal documents, code, as well some internal business systems. 

The point of initial intrusion came from a targeted phishing attack on an employee who, after realizing what had happened, self-reported the incident, prompting the firm’s security team to quickly remove the attacker’s access and begin an internal investigation.

Reddit’s former CISO Allison Miller left the company shortly before the attack took place and it’s not thought that Lee’s appointment is related to the attack or Miller’s departure.

Looking ahead, Reddit says the appointment of Fredrick Lee as its new CISO will help the organization further develop its security infrastructure and protect its user base.

“We are thrilled to welcome Lee and his technical expertise and leadership capabilities to Reddit,” said Chris Slowe, Reddit’s chief technology officer. “His extensive experience will be integral to evolving our safety infrastructure and cyber security processes so we can continue to ensure our users’ safety and defend against emerging cyber threats.”

Governments could reduce international cyber crime by putting stronger regulations on cryptocurrency, a security expert has said.

Itai Greenberg, chief strategy officer at Check Point, told ITPro that greater government oversight of blockchain technology and transactions would be an immediate way to improve the threat landscape.

“If we put in regulation, we can dramatically reduce the amount of cyber attacks,” he said.

“It would have a direct impact, because cryptocurrency allows people to get dollars without being traced.”

Greenberg acknowledged that the government’s role in enforcing crypto rules can only go so far, and that the blockchain is here to stay.

“It was never introduced by governments, it will not be disappeared by governments.” 

The different blockchains across the world support many legitimate uses, including more secure transactions of finances and synchronization of data in a decentralized format. 

But Greenberg maintained that clearer rules around tracing and taxing when it comes to the blockchain is still needed.

“There are many, many good people around the world that contribute to the success of blockchain and cryptocurrency. What they do not have is the big brother that will tell them how to do it right, and we’re starting to see it now with Celcius, with FTX.”

Because transactions made on the blockchain are irreversible, it can prove difficult to recover funds stolen by hackers, or cryptocurrency that a company sends as ransom to a threat actor.

Cryptocurrency can be difficult to trace, but not impossible. The FBI was able to locate and recoup $2.3 million of the money lost in the 2021 Colonial Pipeline ransomware attack, and law enforcement can obtain warrants to check the digital assets of suspects.

Third-party exchanges can also work directly with government agencies to help them access funds.

But a fully fledged, international scheme to track and tax cryptocurrency would require the participation of world governments, and this could be difficult to secure. 

Nations such as Russia already offer safe harbor to cyber criminals, and could be unwilling to compromise the payment channels of those under their protection.

More comprehensive tax requirements on crypto assets, as well as more stringent enforcement of existing laws, could help to dissuade criminals seeking to use crypto platforms as a basis for obtaining illicit funds.

In recent months, international agencies have become even more aggressive in their pursuit of cyber criminals and ransomware groups in particular.

The US Department of Justice (DoJ) placed a $10 million bounty on a Russian man linked to the groups LockBit and Hive, and has since charged a string of LockBit associates as it embarks on more operations to disable the group.

Greenberg praised this activity, saying the actions further protect the cyber security landscape for organizations and individuals.

Improving cyber resilience

Speaking on the wider strategies that companies can take to be more resilient to attacks, he suggested abandoning the traditional idea of detection and remediation, and to instead invest in real-time prevention.

With increasingly automated attacks such as DDoS bots or even AI-assisted fuzzing, the time delay between detection and response in older systems could mean the difference between resilience and compromise.  

Greenberg acknowledged this can change be difficult to implement. For example, while false positives are acceptable in a detection system they can cause unwanted interference and disable core processes if they crop up in a prevention system.

He said many companies try to estimate how many times per year they will be attacked and that this is likely to be in the thousands, but that some companies fall into the trap of thinking that there’s little difference between 95% prevention and 99% prevention.

“It’s not about the 95% that you block, it’s about what you don’t block. And it needs to go as close as possible to 100%.”

Greenberg also highlighted the struggle that chief information security officers (CISOs) face in optimising their limited IT budgets, workforce, and skillsets.

“There are two philosophies here, one that says you split your budget with half in SOC, remediation, engineering people and half in prevention and detection,” he said.

“I would advise a CISO to put as much as they can into the prevention technology. So make it 90% of your budget, because you are no longer in this race of putting people and technology in to deal with remediation.

“Resilient companies will put more in prevention and outsource their remediation and incident response into an MDR service.”

Zero trust data security provider Rubrik has announced the appointment of Richard Cassidy as its new field CISO for the EMEA region. 

As Rubrik’s new field CISO, Cassidy will focus on further developing the company’s strategy and execution across the EMEA region, as well as supporting customers with cyber resilience.

“Running breach and threat hunting investigations in the UK and Europe has set me up well for a CISO position, where I’ve been involved with organizations across industry verticals such as finance, military, central and national government, and automotive,” he said.

“I’m passionate about demystifying the complexities of cyber security and how this translates into building viable security ecosystems that stand the test of time. I am really excited to continue this work with Rubrik.”

Cassidy’s appointment is the latest in a string of company-wide leadership hires in recent months. Back in June, Rubrik announced the appointment of seasoned SaaS leader Andres Botero as its new chief marketing officer, while former Zscaler executive Toby Keech was hired as vice president for its UK and Ireland business. 

The move also follows the launch of advanced user intelligence on the Rubrik Security Cloud platform, which leverages Rubrik’s Time Series Data and Metadata architecture to proactively fight cyber attacks and reduce data risks.

“Richard joins Rubrik at a very exciting time for the company following the recent launches of our advanced user intelligence and double extortion ransomware solutions,” said James Hughes, VP of Rubrik’s Solutions Engineering business in EMEA. 

“Richard’s experience across the channel, sales, product development, and engineering will be invaluable as we continue to prioritize a zero trust strategy and commitment to customers.”

A renowned industry thought leader and Forbes Technology Council member, Cassidy brings extensive experience in cyber leadership, threat intelligence, and technical advisory to the role. 

The seasoned veteran joins the company from security provider Securonix, where he held the role of vice president of global technology. 

As an advisor to various sectors, Cassidy has spent his 22-year career developing deep knowledge across all aspects of security – including SecOps, threat hunting and forensics, incident response, managed services, as well as networking and cloud.

Cyber insurance pricing is down by 9% in 2023 following an all-time high at the end of 2022, despite ransomware activity having increased 48% year on year (YoY).

The figures show the shock experienced by the cyber insurance market during 2020 and 2021 as ransomware frequency and severity escalated sharply. The result increased the cost of cyber cover more than double.

Things are more nuanced in 2023, according to a report published by the Howden Group. Activity relented in 2022 - accompanied by the implementation of mitigations and risk controls by companies - before surging again in 2023.

However, strengthened defenses have paid dividends and the report noted that “resurgent ransomware activity in the first half of the year has so far not been accompanied by a corresponding rise in losses or claims”.

The effect of this is that despite the uptick in ransomware activity, cyber insurance premiums are remaining flat or even decreasing from their historic highs.

The report described the surge in ransomware during 2020 and 2021, attributed in part to the availability of low-cost ransomware kits, as “unlike anything experienced previously”.

At one point in 2021, ransomware incidents were up by 390% compared to a Q1 2019 baseline. The result was what the report described as a “major market correction”.

After 18 months of relative calm for the cyber insurance market, optimism around a drop in claims and a return to competition was tempered by an increase in global ransomware attacks - up 47% in the first quarter of 2023 compared to the same period in 2022.

The average US ransomware payment also went up by 55% YoY.

Ransomware gangs have been accelerating their activity after a year of comparatively smaller gains. Average ransom payments in early 2023 were nearly double those of the previous year. 40% of companies surveyed reported payments of $1 million compared to 11% in 2022.

Cyber criminal groups are paying more attention to an organization’s ability to pay versus the security measures in place, according to the report. 

Mounting issues with cloud outages

Away from cyber insurance, the report also highlighted the potential for businesses to become more greatly exposed to spiraling losses due to interruptions in the digital supply chain, not necessarily only from cyber attackers.

Jonathan Hatzor, CEO at Parametrix Insurance, said: “The cloud goes down almost every day”.

He noted that the big three cloud vendors only tended to report major disruptions and that the most common reported cause of outages was human error.

The resulting financial and reputational costs from such incidents can be severe.

Estimates can vary depending on the research and the type of customer, but an organization’s financial loss as a result of a major outage at one of the big three hyperscalers could range between a few thousand dollars per hour and more than $300,000.

“Cyber supply chain risk is something that companies operating in all sectors and geographies need to measure, manage, and mitigate,” said Hatzor.

War exclusions

Finally, the war exclusions issue in cyber insurance has focused minds as positions are clarified on cyber warfare and buyers check that existing levels of protection will be maintained. 

Earlier this year, cyber insurance provider Lloyd’s introduced ‘war exclusions’ to its policies, attracting criticism from the industry. 

The new wording from Lloyds and the broking community means losses will not be covered if they arise from a physical war, from a cyber attack carried out as part of a physical war, or "from a state-sponsored cyber attack that causes a major detrimental impact to the essential services required for the functioning of a sovereign state”.

While the clause might sound initially alarming, the report noted that “cyber insurers have confirmed that they do not consider any attack to date, including NotPetya, would be of sufficient scale to trigger the exclusion”.

The economy is in a difficult situation. ONS figures show that the UK economy grew by 0.1 percent in the first quarter of 2023 and the cost-of-living crisis continues to affect confidence. 

While the technology sector has traditionally been able to weather tough conditions, that's not the case this time around. 

Even areas like IT security are facing challenges. While Gartner predicted this market will continue to grow by 11.1% year-on-year through to 2026, this increase in spending will have to be stretched further to keep pace with emerging threats. 

CISOs are having to look at their strategies with fresh eyes in order to stretch budgets, including potentially consolidating the number of vendors they work with.

So what will these consolidation exercises look like, and how can channel partners capitalize?

What should consolidation mean to your customers?

When we use the term consolidation, we typically mean cost-cutting. However, for security teams, the ability to reduce costs should not be conflated with decreasing budgets, which will ultimately leave teams without critical resources. 

The challenge is how to make budgets go further and invest where companies need it, rather than this being an exercise in having money taken away.

Waiting until customers ask about this approach is too late. Instead, taking a proactive approach can put you - and your customer’s security team - in the driving seat when it comes to how projects are defined and what the success metrics are.

To get started, analyze how your customer manages their security processes and the products. It’s easy to build up shelfware that is either not being used, or only utilized for tasks that are not valuable enough to carry on spending on them. 

These solutions can be removed and replaced with more cost-effective options, especially where other solutions can be used to cover the same tasks.

This may throw up some interesting findings. You may find yourself dealing with challenging scenarios and internal company politics. For example, you may find that processes are not as efficient as they could be, or that teams are relying heavily on manual work to get things done.

In a worst case scenario, you may uncover something that is not compliant with an industry standard or regulation. 

It’s important to be tactful here, as security teams may have invested a lot of their time into building and evolving their processes. With anything that has been in place for a while, this can create a lot of attachment. While we all like to think of ourselves as rational beings, this is not always the case. 

Taking a diplomatic approach can pay off as no-one likes to think of their deployment as wasteful.

Building back up again

Once you have established the tools, processes, and people involved in delivering security, you can assess the potential overlaps and where consolidation can occur. 

Every vendor talks about the mythical single pane of glass for security, and you may find that customers have multiple ways of achieving this result. They may even be running multiple product suites for their security and risk management requirements, from identity management through to firewalls, network security, and cloud.

From here, you can look at how to consolidate and improve security operations. 

This may remove some tools, but the main goal should be to achieve better processes and faster delivery. Ideally, you can reduce the overall vendor count and make use of more integrated suites of services rather than multiple products. 

This can make a big difference in cloud environments, where customers would otherwise have to run multiple agents to get the security services they need. Taking a ‘one agent’ approach reduces the overall amount of compute resources required to manage security services, which helps the customer save costs.

On top of this audit, you can move into recommending how best to consolidate and maintain security levels. For example, many companies will subscribe to a threat intelligence feed, but do they make use of it? 

Instead, can you supply a service that combines multiple feeds for better coverage while also offering recommendations on where to improve over time. This delivers an ongoing revenue opportunity while helping customers reduce their spending on specific security products.

Alongside this, explore ways  you can help the customer to automate their processes where possible. These efforts not only help the security team work faster and more efficiently, but it can show where there are ways to improve processes and working practices. 

Security vendors are all deploying AI and machine learning to streamline processes, but this should also be used to free up focus time for security analysts.

Looking for more opportunities around value

While security consolidation projects may set out to cut costs, they might lead to other opportunities that you can build on. For instance, many companies now need more help in communicating their security position to their internal leadership teams or the board. 

This calls for more risk management support, but it also requires nuanced communication support as well. It is not enough to just provide a dashboard – instead, you may need to help security teams work on how they communicate with leadership.

Improving communication is a great secondary objective for consolidation projects. By cutting the number of tools involved, you can remove some of the headaches for security teams about getting the right data together. 

On top of this, you can make it easier for them to demonstrate they are doing a good job.

Many companies need help on security consolidation projects. To maximize these opportunities, start by looking for overlaps and gaps. Once this audit is complete, you can make recommendations on how to reduce the number of vendors, integrate those that are in place, and make processes more efficient for everyone involved. 

The result should save the company money, but it should also deliver better security posture for the future.

Cyber security has become a vital part of any business plan. Even the smallest business needs to have the appropriate policies and methodologies in place for protecting their data as best they can.

To achieve this, every business needs access to a variety of cyber security skills, whether that's through hired staff or trusted partners.

Minimizing the threat surface only goes so far. As businesses grow, through opening new offices and new staff joining, so too does the potential threat surface, especially with expanding network coverage and new cloud systems being incorporated.

Given the multitude of online threats facing modern businesses, it can be easy to be overwhelmed by the many different types of security required. Cyber attacks are inevitable; but, with the appropriate skillsets in place, it is possible to take advantage of the opportunities offered online whilst protecting data and mitigating the risk of attack.

The cyber security skills every business needs

Ethical hacking

One of the most effective ways to gain a granular understanding of a business' threat posture is to use ethical hacking. An ethical hacker’s job is to assume the role of an offensive hacker and probe a business’ IT estate for vulnerabilities and attack paths so these can be fixed or otherwise mitigated.

The skill set of an ethical hacker can prove invaluable to organisations. The value to be had is not just in spotting security issues; the deep understanding of computer systems required to do the job can help when building new products like apps, for example, and they can be built securely from the outset.

It's important to note that ethical hacking is more than just penetration testing. While penetration testing assesses the technical elements of a system, and is a central component of many cyber security strategies, ethical hacking considers all parts of a business, including soft-skills and the security culture.

Ethical hacking essentially acts as a live-fire training exercise of what could happen during a targeted attack, giving valuable experience to IT teams and identifying potential vulnerabilities in the threat posture. This can involve conducting genuine phishing attempts against staff to see if the organisation’s access management rules are robust enough. It can also involve testing the physical security of the office itself.

Ethical hacking can be performed in-house by your own Red Team – a group of employees tasked with pretending to be adversaries – but for an optimum understanding of the response to a breach, an external testing team can be covertly contracted.

How far you go with ethical hacking will largely be a question of resources, as there really is no limit to what you can learn about your own systems. That said, ethical hacking does involve misleading employees, and so each business will need to assess what is reasonable.

Network security

Modern businesses rely on their networks, and so strong network security is fundamental. With the types of available network tools increasing and more devices being connected to networks, it's imperative that the appropriate security technologies are in place to protect the flow of data.

Administrating access controls is an essential part of network security. Access rights ensure each user and device has the appropriate level of access and that data are protected against potential threats, both malicious and accidental. The concept that governs this the information security principle of 'Least Privilege' – the idea that employees should only be given access to the data they need to perform their jobs effectively. Anyone who works outside of HR, for example, shouldn’t be able to access HR files, while those who work in the finance department are the only ones who should be able to access payroll data.

Administrators will be pleased to know that there are plenty of tools to choose from to help them adopt these policies. This includes firewalls, VPNs (virtual private networks), or even the fancy new machine learning algorithms which can identify when a device or user is acting strangely and automatically cut it off from the network. Machine learning is also being deployed in firewalls to make web application firewall (WAF) tools. WAFs help to create an extra barrier to prevent hackers from targeting your apps, although they aren’t intelligent enough yet to determine whether users are humans or machines.

Cloud security

The Cloud has become a ubiquitous part of the modern enterprise environment, whether it is online storage or leasing additional processing power through cloud computing. That said, while IaaS providers take steps to maintain data integrity, looking after your own data is your responsibility, not the cloud storage provider's.

Not all cloud providers are the same. Although the core services they offer are broadly the same, they offer different functionalities and levels of protection, based upon the service subscription. Part of the cloud security skill is being able to curate the different cloud services, choosing which is the most appropriate for the business and its objectives.

However, cloud security is a highly technical skill that requires an in-depth understanding of how the cloud operates and remains one of the hardest skillsets to find.

Among the cloud security threats is poor identity management, as hackers may mask themselves as legitimate users in order to access, modify and delete data.

Another is poorly-secured cloud apps. Most apps and cloud services use APIs to communicate and transfer data. This means the security of the API directly affects a cloud service's security. The chance of a data breach increases when third parties are granted access to APIs.

Institutions such as SANS and CSA offer cloud security certifications for professionals to increase their skill sets in this area.

Risk management

Risk management is a necessary part of cyber security. Risk is a combination of the likelihood of something happening and the impact it would have.

Having the appropriate strategies and planned response for cyber incidents forms the foundation of any strong risk strategy, which should incorporate prevention (reducing risk), resolution (response during an incident) and restitution (post-incident actions).

With limited resources, escalating threats and a plethora of security technologies being marketed, businesses need to carefully consider the most effective investments for their IT budget. This requires an innate understanding of the risks facing the core functionality of the business.

A background in risk management offers the capacity for in-depth risk analysis for the threats a business is facing and their potential vulnerabilities. This skillset enables businesses to carefully balance the needs of maintaining operations against potential risks within the IT budget.

Patching and software management

Ensuring software is up to date and secure is vital for maintaining a robust security posture, as known vulnerabilities are quickly exploited by threat actors. It can often be seen as an ever-escalating arms race between hackers and patchers.

The instinctive response when a new patch is released might be to immediately deploy it, but this can negatively impact the business by overloading the network or losing functionality. New products and services that can be used to maintain competitiveness need to be deployed, but without disrupting ongoing business operations.

For networks that incorporate modified, specialist or bespoke systems, it can be prudent to test an update in advance by virtually deploying it in a sandbox environment. Doing so enables administrators to test whether the patch will adversely impact any systems within the network.

Patching and software deployment need to be considered in association with maintaining business operations, usually by scheduling them during out of normal business hours. However, this can be complicated when there are multiple sites in different time zones. Thus, software management is just a much a collaboration between security and business operations as it is a skill in coordinating updates.

Big data analysis

IT teams are bombarded with information generated by a multitude of security systems, which can quickly become overwhelming and potentially lead to valuable insights being missed.

Being able to curate the diverse information streams and prioritize critical information is therefore a key skill. A single incident on its own may be negligible, but when the same incident keeps repeating, then action may need to be taken. It's important security teams are able to effectively analyze the data and provide a rapid response to escalating threats.

Big data analysis is particularly effective at identifying advanced persistent threats (APTs), as there are often massive amounts of data to analyze for abnormalities. With big data analysis, APTs will be spotted sooner, allowing the mitigation of the potential damage they may cause.

Non-technical skills

Due to the highly technical nature of IT, there can be a rift between IT departments and the rest of the business. The weakest link within a business’s security posture is often the people, most commonly through unsecure devices and phishing attacks.

However, robust security posture is not just dependent upon technical skills, but also upon communication and collaboration. There needs to be clear exchange between all stakeholders to ensure an understanding of security needs.

Being able to communicate the need for IT security in an easy-to-understand format is a crucial skill for encouraging a culture of security awareness. This could be through presenting seminars on pro-active security skills or orchestrating security exercises to educate staff and identify those who may need further training.

Networking with others within the security sphere is also useful for being forewarned of emerging trends and potential threats.

Governance & compliance

The past few years have witnessed a swathe of security legislation around the world, especially in regard to data security. Although the EU’s General Data Protection Regulation has become the default standard for data protection, there are variations between different legislations, which can cause lengthy data sharing issues for unprepared businesses.

Export control regulations need to be followed, especially for third-party providers that offer services to both sensitive and non-sensitive business sectors.

Knowledge of IT governance enables businesses to have an innate understanding of the legislative requirements that applies to them, thereby ensuring that they can seamlessly exchange information between all the regions they operate in.

The proliferation of regulations being applied not only protects consumer privacy, but also protects business data and IT infrastructure. Compliance benefits both the organisation and any customers and partners it comes into contact with. Though, it is important to not be so focused on simply compliance that actual cyber risks are forgotten.

Automation

One solution being proposed to cover the problem of the cyber security skills gap, while also improving security in businesses overall, is the increased use of automation.

With threats increasing and budgets not necessarily keeping pace with inflation, businesses are turning to automation to cut the cost out of simple tasks, enabling staff to prioritize their attention on difficult ones. The increasing functionality of machine learning enables some of the simpler and repetitive tasks to be automated.

This needs to be done with care; solely relying on automation could be detrimental, as automation is not always 100% effective. Instead, automation is best used for everday tasks, such as flagging potential abnormal network behavior, with a human in the loop for decision-making. This means that anything flagged as a potential issue is less likely to be a waste of human time.

AI and machine learning can identify threats by type, such as ransomware or phishing attempts, whether it's a known malware strain or not. They can also identify errant behaviour by users, for example, if a person who works 9-5 becomes active at 3am, or starts trying to access systems and data they don't normally or don't have the appropriate privileges for. This could be indicative of a successful hack or an insider threat and can be investigated by the appropriate members of the IT team.

The most modern enterprise security software offers AI and machine learning capabilities, although what you choose to adopt will depend on the skills already present in your business, and how able you are to balance existing skills.

For example, if there's no one in your business who knows how to investigate and remedy potential and actual hacks, you will need to train someone up in this area in order to use the software effectively.

The frequency and complexity of cyber attacks continue to escalate, creating a challenging environment for organizations of all sizes. In 2025, cybersecurity is dominated by advanced threats, including AI-powered phishing, adaptive malware, and relentless ransomware campaigns. Cybercriminals are leveraging artificial intelligence to automate and personalize attacks, making them harder to detect and more effective at bypassing traditional security measures. For example, AI-driven phishing can now tailor messages to mimic trusted contacts and adapt to avoid detection, while AI-powered malware evolves in real time to evade defenses.

Recent data underscores the severity of this trend: ransomware attacks are surging, with a notable 84% increase in ransomware incidents over the previous year, and ransomware now accounts for 35% of all cyberattacks in 2025. The global average cost of a data breach reached an all-time high of $4.88 million in 2024, a 10% increase from the prior year. This intensification of threats is further amplified by the rapid adoption of AI by both cybercriminals and state-sponsored actors, who use it to automate reconnaissance, exploit vulnerabilities, and conduct large-scale social engineering attacks.

For many businesses, especially small and mid-sized organizations, effectively managing security in-house is an increasingly daunting challenge. This difficulty is compounded by a persistent cybersecurity skills gap, with an estimated 4.8 million person shortage in the industry.

The struggle to keep pace with evolving threats and a lack of specialized talent has made the services of a Managed Security Service Provider (MSSP) more critical than ever. The global market for managed security services is projected to reach nearly $76 billion by 2030, reflecting a growing reliance on outsourced expertise to build cyber resilience. An MSSP offers the specialized knowledge and continuous monitoring necessary to protect vital infrastructure, allowing internal teams to focus on core business objectives.

What is an MSSP?

MSSPs are specialized third-party providers that deliver outsourced cybersecurity services. They handle the security operations for an organization, either in part or in full, and can do so from a remote location or by placing experts on-site.

An MSSP may offer a broad suite of security capabilities or specialize in core focus areas like cloud security or compliance. The majority, however, will manage a business's security infrastructure and monitor systems for threats from their own Security Operations Centers (SOCs). To do this, they implement and manage a sophisticated technology stack that goes far beyond basic antivirus software. Common tools include Security Information and Event Management (SIEM) platforms, Managed Detection and Response (MDR) services, VPN management, and advanced firewall management.

Ongoing responsibilities also include system upgrades, patch management, and configuration changes, ensuring a client's security posture continuously adapts to new threats and business demands.

Services an MSSP can provide

MSSPs offer a comprehensive suite of services designed to protect organizations before, during, and after a cyber attack. Proactively, their primary goal is to harden the IT infrastructure and enforce robust security policies to minimize the attack surface. This includes vulnerability assessments, penetration testing, and ensuring systems are configured securely.

Should an attack occur, an MSSP's role shifts to rapid detection and response. Using advanced security monitoring tools, they can identify threats in real time and take immediate action to neutralize them, preventing or limiting damage to the organization's systems.

Because MSSPs serve numerous clients, they accumulate a vast amount of experience dealing with a wide variety of attacks. This broad visibility allows them to understand emerging threat patterns and containment strategies. They leverage this collective knowledge to continuously refine and strengthen your security posture.

Typical services provided by an MSSP include:

• Security infrastructure management: Implementing and managing firewalls, intrusion detection and prevention systems (IDPS), and other security hardware and software.
• 24/7 monitoring and threat detection: Continuously monitoring networks, systems, and applications for suspicious activity from a Security Operations Center (SOC).
• Vulnerability management: Regularly scanning for and remediating vulnerabilities in your systems through patching and configuration updates.
• Incident response and remediation: Developing and executing a plan to contain threats, eradicate them from the network, and recover affected systems.
• Security information and event management (SIEM): Aggregating and analyzing log data from various sources to detect patterns indicative of a cyber attack.
• Compliance management: Assisting organizations in meeting regulatory requirements such as GDPR, HIPAA, or PCI DSS.

For a small to medium-sized business (SMB), a good MSSP functions as a seamless extension of the firm's own IT employees, providing specialized expertise that would be difficult and expensive to build in-house.

Why use an MSSP?

For organizations seeking to alleviate the stress and complexity of building and maintaining robust security infrastructure, partnering with an MSSP is often the optimal choice. An MSSP not only relieves internal IT teams of the bulk of routine security tasks, such as daily threat monitoring and incident response, but also assumes responsibility for maintaining uptime, managing upgrades, and ensuring swift remediation in the event of a breach.

While some organizations may develop and execute their own security strategies, from deploying necessary software and training staff to allocating adequate resources, this approach can prove overwhelming, particularly for smaller IT teams. In such cases, outsourcing to an MSSP becomes a compelling solution.

SMBs frequently lack the specialized expertise required to manage a comprehensive security infrastructure independently. Even with strong commitment and resource allocation, the demands of security maintenance can quickly exceed the capacity of limited teams. This strain can result in critical IT functions, like system patching, hardware management, and digital transformation initiatives, receiving insufficient attention. The rise of remote work only compounds these challenges by introducing additional layers of complexity.

The evolving cybersecurity landscape further complicates matters. Smaller teams may struggle to respond effectively to the full spectrum of threats, especially as cyberattacks become more sophisticated. While in-house staff can handle some known risks, an MSSP provides specialized expertise and round-the-clock monitoring, offering a crucial layer of protection and peace of mind. Leading MSSPs bring a depth of knowledge that is difficult to cultivate internally, with dedicated teams that continuously monitor emerging threats, assess IT environments, and provide actionable recommendations. They also deliver support services, keeping all business units informed and engaged.

Partnering with an MSSP also addresses the persistent challenge of talent acquisition. Many CISOs report increasing difficulty in recruiting and retaining skilled security professionals, a problem that is especially acute for smaller firms or those located outside major urban centers. MSSPs offer immediate access to a pool of experienced security specialists, eliminating recruitment headaches and ensuring continuous protection.

MSSPs provide a comprehensive suite of security services delivered remotely, and their pricing models are typically designed to accommodate financial constraints. Most providers charge a predictable, flat monthly fee, enabling businesses to budget effectively and avoid unexpected expenses.

As technology evolves, MSSPs ensure that security measures scale and adapt alongside your business. Through regular assessments and audits, they deliver strategic insights and recommendations, allowing organizations to focus on core business objectives without compromising security.

MSSPs can operate either on-site or remotely, but in either scenario, they integrate seamlessly with existing IT teams. This collaboration frees internal staff to concentrate on innovation and other strategic projects, rather than being consumed by security incidents. Ultimately, MSSPs help enhance customer experiences by improving response times and boosting satisfaction.

By partnering with an MSSP, organizations can overcome resource limitations, access specialized expertise, and achieve scalable, cost-effective security, all while enabling their internal teams to focus on driving business growth.

MSP vs MSSP

A managed service provider (MSP) offers a broad range of IT management services, such as network support, application management, system administration, and email management, typically delivered to multiple clients on a recurring, pay-as-you-go basis. While MSPs are essential for maintaining smooth business operations and IT efficiency, their security offerings are generally limited to baseline protections like routine monitoring and patch management.

In contrast, an MSSP specializes exclusively in cybersecurity, delivering advanced, round-the-clock services such as threat detection, incident response, and compliance monitoring from a dedicated security operations center (SOC). MSSPs are well-positioned to serve as strategic security partners for organizations seeking robust protection as cyber threats grow in both frequency and sophistication.

As the threat landscape evolves, MSPs that do not expand their security capabilities risk losing business to those that do, or to MSSPs that offer more comprehensive protection. While it is possible for an MSP to transition into an MSSP by enhancing its security offerings, such as adding antivirus, patch management, and web protection, delivering true, enterprise-grade cybersecurity requires specialized expertise, tools, and continuous monitoring that are the hallmark of an MSSP.

Many MSPs now partner with MSSPs to provide their clients with the best of both worlds: efficient IT management and advanced security. This dual approach ensures organizations can maintain operational efficiency while safeguarding their critical assets from ever-evolving threats.