Proofpoint has released its second annual Cybersecurity: The 2023 Board Perspective report, which explores board of directors’ views on the global threat landscape, cybersecurity priorities, and relationships with CISOs. The findings reveal that nearly three-quarters (73%) of those surveyed feel at risk of a material cyber-attack, a notable increase from 65% in 2022. Likewise, 53% feel unprepared to cope with a targeted attack, up from 47% the previous year.
Interestingly, recent research from Proofpoint illustrates similar sentiments are shared by CISOs in the Middle East, with 55% of KSA CISOs and 75% of UAE CISOs admitting they feel at risk of experiencing a material cyber-attack in the next 12 months. Half of CISOs in the Middle East believe their organization is unprepared to cope with a targeted cyber-attack.
This year-over-year change may reflect the ongoing volatility of the threat landscape, including lingering geopolitical tensions and rises in disruptive ransomware and supply chain attacks. The emerging risk of artificial intelligence (AI) tools such as ChatGPT may also be contributing to these sentiments: 59% of board members believe generative AI is a security risk for their organization.
Global board members have those concerns even though 73% view cybersecurity as a priority, 72% believe their board clearly understands the cyber risks they face, and 70% believe they have adequately invested in cybersecurity.
The Cybersecurity: The 2023 Board Perspective report examines global, third-party survey responses from 659 board members at organizations with 5,000 or more employees across different industries. In June 2023, more than 50 board directors were surveyed in each market in each of the following 12 countries: the U.S., Canada, the UK, France, Germany, Italy, Spain, Australia, Singapore, Japan, Brazil, and Mexico.
The report explores three key areas: the cyber threats and risks boardrooms face, their level of preparedness to defend against those threats, and their alignment with CISOs based on the sentiments Proofpoint uncovered in our 2023 Voice of the CISO report. We found a similar year-over-year increase in the number of CISOs who feel at risk and unprepared, and a closer alignment than before between board directors and security leaders.
“The newfound alignment between board members and their CISOs on cyber risk and preparedness is a positive sign that the two sides are working closer together and making progress. However, this growing alliance hasn’t yet delivered significant changes in cybersecurity posture, despite boards feeling good about the time and resources they’re investing to combat this risk,” said Ryan Kalember, executive vice president of cybersecurity strategy at Proofpoint. “Our findings show that it remains a challenge to translate increased awareness into effective cybersecurity strategies that protect people and data. Growing even stronger board-CISO relationships will be instrumental in the months ahead so directors and security leaders can have more meaningful conversations and ensure they’re investing in the right priorities.”
Key global findings from Proofpoint’s Cybersecurity: The 2023 Board Perspective report include:
- Generative AI has the boardroom’s attention: with tools such as ChatGPT getting much of the spotlight in recent months, 59% of those surveyed view this emerging technology as a security risk to their organization.
- Year-over-year comparison shows board members’ increasing concerns about cyber risk: 73% of those surveyed feel their organization is at risk of a material cyber attack, compared to 65% in 2022.
- Awareness and funding do not translate into preparedness: 73% of directors agree that cybersecurity is a priority for their board, 72% believe their board clearly understands the cyber risks they face, 70% think they have adequately invested in cybersecurity, and 84% believe their cybersecurity budget will increase over the next 12 months; however, these efforts are not leading to better preparedness—53% still view their organization as unprepared to cope with a cyber attack in the next 12 months.
- Board members and CISOs have similar concerns about their biggest threats: board members ranked malware as their top concern (40%), followed by insider threat (36%) and cloud account compromise (36%). This is only slightly different from CISOs’ top concerns of email fraud/BEC (33%), insider threat (30%), and cloud account compromise (29%).
- Directors are not completely aligned with CISOs in the areas of people risk and data protection: while most directors (63%) and CISOs (60%) agree that human error is their biggest risk, board members are much more confident in their organization’s ability to protect data 75% of directors share this view, compared to only 60% of CISOs.
- Bigger budgets, additional cyber resources, and better threat intelligence top boardrooms’ wish lists: 37% of board directors said their organization’s cybersecurity would benefit from a bigger budget, 35% would like to see more cyber resources, and 35% would like better threat intelligence.
- Board-CISO interactions and relationships are gradually improving: 53% of directors say they interact with security leaders regularly. While an increase from last year’s 47%, it still leaves nearly half of all boardrooms without strong CISO-C-suite relationships. Board members and CISOs are generally closely aligned when they do interact, however, with 65% of board members saying they see eye-to-eye with their CISO and 62% of CISOs agreeing. From a regional lens, previous Proofpoint research shows that 63% of CISOs in the UAE and 45% of CISOs in KSA agree that board members saw eye-to-eye with them on cybersecurity issues.
- Personal liability is a concern for boards and CISOs alike: 72% of board directors expressed concern about personal liability in the wake of a cybersecurity incident at their own organization and 62% of CISOs agree.
“Board members are taking cybersecurity matters seriously, demonstrating they have no illusions about human risk and the impact cyber threats pose to an organization’s bottom line. They are making strides in their relationships with security leaders, understanding that strong board-CISO partnerships are more critical than ever,” said Kalember. “But this is not a time to grow complacent. Boards must continue to invest heavily in improving preparedness and organizational resilience. This means pushing for even deeper, more productive conversations with CISOs to ensure directors are making informed, strategic decisions that drive positive outcomes.”