The biggest threat to cybersecurity? The “meh” attitude.

I recently attended the Cybersecurity Summit in Chicago hosted by the Cyber Risk Alliance and gained a new perspective on the biggest threat to cybersecurity in the U.S. While staying ahead of the ever-evolving attack tactics used by hackers remains top of mind, the most prevalent danger to organizations appears to be the sense that current security measures are good enough. It’s a “meh” attitude that’s emerged amongst security professionals after battling years of constant strikes.

It doesn’t have to be that way.

Waning sense of urgency

During the daylong event, speakers noted that we’re continuing to see the majority of cyberattacks originating from the usual set of countries: Russia, North Korea, Iran and China. Hackers are intent on stealing intellectual property, personal and corporate data and extracting money via ransom or transfer.

Organizations are still fighting the good fight but have hit the brakes a bit when allocating budgets to harden their networks and cloud instances further. While we often read about big data breaches in the news, organizations are generally dealing with medium-impact attacks that, when successful, have an “acceptable” long-term impact on operations. Companies are used to being attacked and infiltrated on a regular basis, and security professionals are countering the best they can with tools on hand.

In its “2022 State of Cybersecurity” report, CompTIA finds that the primary hurdle that companies have cited “is a belief that the current cybersecurity posture is ‘good enough.’” The industry association surmises that “the notion of ‘good enough’ indicates a lack of specific metric around measuring cybersecurity efforts.”  The report also suggests that many companies are holding back on increasing security technology investments because the ROI is undefinable.

New points of vulnerability

Cloud computing and mobile devices have changed the concept of a secure perimeter. The CompTIA report confirms the concern, listing “use of cloud computing” and “use of mobile devices” as the top two components of risk management that companies need to address.

The process of risk analysis for cloud and mobile requires input from both technical and business operations perspectives. It’s finding a balance between giving all data the highest level of security and enabling the business to pivot as needed to react to changing market forces with a flexible workforce.

Put the burden on AI

Alden Hutchison from IBM Security pointed out that currently, about 40% of security analysts’ time is spent on automatable tasks. He suggests that the best way for companies to improve their overall security posture is to uncover the use cases where artificial intelligence (AI) can automate the reactive. Essentially, take the mundane part of cybersecurity away from humans and let AI manage how attacks are handled. This approach both reduces human error and frees security professionals to focus on proactive measures such as monitoring threat advancements, policy development and predictive threat analysis.

AI tools can also contribute to predictive threat analysis to identify emerging trends, attackers and new tactics.

The path forward

Now is not the time to lose energy for creating, monitoring and adjusting strong security postures. At SenecaGlobal, we work with SecurityTech firms to help them integrate AI tools into their solutions to make them more effective. So, I know what is possible now and in the near future.