A company’s cybersecurity strategy starts with understanding the business and the threats it faces. So how do you build a cybersecurity strategy that’s genuinely “aligned” with the business? How do you implement it successfully? Let’s look at a few reflections before moving to action.

Every company needs to place itself on a quadrant that maps its “attractiveness” as an attack target (do I hold sensitive information, customer data, intellectual property? what countries and markets do I operate in?) against its level of protection (how “hackable” am I). From a cybercriminal’s point of view, an easily hackable company with a degree of attractiveness presents a very interesting cost-benefit ratio.

Once you know who you are, you have to decide what to do and how. It’s not enough to (just) put cybersecurity in the Top 5 priorities on the leadership team’s yearly list… and then do nothing. How much do I need to spend? What organizational decisions do I need to make? How am I going to measure it?

You have to make decisions that shape the entire journey:

“I don’t want to have any incidents”: impossible, even with unlimited investment. “I want to respond fast and find out before others tell me”: you’ll need to invest in Detection. “I don’t want to do anything because I’m not attractive”: you’ll need to invest in recovery, because mass attacks (WannaCry was less than four years ago and already feels like ancient history) can bring your company to a halt… but how many times a year can you afford that? How long can it take you to recover? If you only prepare to recover, how many times a year can you realistically absorb that, depending on how long recovery takes? “I want to keep up with my peers in the market”: you’ll need to benchmark against industry intelligence and/or cybersecurity rating solutions. “I’ll do whatever the regulator tells me”: the easiest posture… and the least secure.

This shared strategic vision is essential to align every C-level in the company. Otherwise, a mismatch between expectations, investment and execution makes success impossible.