What Are the Biggest Challenges for Companies?
Many companies are addressing the risks by shifting on-premise data centers and security to cloud-based solutions. The pace is accelerating as issuers with smaller cloud storage capacity migrate to better synchronize their systems. But cloud-based security raises new concerns. We’ve heard several common themes from cybersecurity professionals.
Building the Infrastructure: Organizations face two key dilemmas—choosing from a large swathe of security providers and vendors, and managing them. Creating a single dashboard to manage a network of diverse solutions, ranging from end point protection to cloud systems parameter solutions, is a common problem, says one vendor who installs different cloud security platforms. And with so many similar options available, some organizations are paralyzed; they take too long to get the perfect fit rather than establishing an initial infrastructure to update over time.
Monitoring, Training and Governance of Systems: After completing the infrastructure, companies need properly trained staff to monitor and run the systems, as well as a governance structure to maintain its integrity. Streamlining various internal systems and security vendor products takes time and resources, a challenge further complicated because many major security providers are active acquirers of smaller companies, which can throw products out of sync.
What defines a strong cybersecurity governance structure? First, we think a clear reporting structure to the board committee responsible for oversight is essential, with jargon-free reports that can be easily understood by directors without cyber expertise. Similarly, a simple matrix classifying “High, Medium, Low” risks is helpful, as well as reports on mitigation action and threat taxonomies. The general counsel, board and business managers should interact with the information security team more frequently as governance matures. Oversight must extend to the employees running and monitoring systems. And companies should be aware that the vendors they choose matter; services that are more common will have more professionals available to run the systems.
Rising Costs of Implementation/Resourcing: Many CIOs told us they are struggling with costs. In some cases, engineers can make a single change on one server that dramatically increase overall costs for an entire system over time. What’s more, many vendors do not clearly outline the rising costs of monitoring and maintaining a robust cybersecurity infrastructure. Checks on employee additions and a forward-looking infrastructure cost model can help avoid these pitfalls, especially at companies with fewer dedicated cyber resources. Cyber insurance costs are another factor; insurance benefits may be reduced when new vendors are added and systems are updated, or if coverage decreases. For example, Lloyd’s of London recently announced it will stop selling insurance for state-backed cyber-attacks.
How Can Investors Evaluate Cyber Risk Management?
Investors must ask the right questions and focus on budgets to gauge a company’s cyber-strategy and actions. How are cyber issues reported to the board? How are risks monitored and escalated? What types of system tests and response plans are being deployed? Are employees prepared for an attack?
Discussions with directors and management can yield important evidence of cyber proficiency. In recent engagements, we found that companies with a strong sense of the risks are more willing to discuss the topic and provide details on governance, reporting and training. Vague or standard responses could indicate that a company is less prepared for threats, lags peers—and is more vulnerable to attack. Cyber budgets offer important insight into strategy and action. Transparency on spending for cyber insurance, resourcing, vendors, or in-house build helps complete the picture.
Coherent Strategies for Complex Threats
As threats increase, companies must step up efforts to combat attacks and secure their data and systems. Small- and medium-capitalization companies may face greater risks, as many are relatively early in their cybersecurity journeys and have gaps in their systems that could attract attacks.
For companies of all sizes, investors should scrutinize cyber systems in place and dig deeper into the governance, resourcing and reporting on security. With coherent strategies in each area, companies will be more prepared to prevent and respond to cyber-attacks. By engaging with management regularly on these issues, investors will be better equipped to incorporate a company’s cybersecurity profile into a broader risk assessment of portfolio candidates and holdings.
Robert Keehn, Proxy and ESG Engagement Associate from AB’s Responsible Investing team, contributed to this analysis.
