Accelerated digital transformation has been our reality since 2020. Faced with this perfect storm, how should the cybersecurity function position itself? Has the time come to make a stronger case for its role in business transformation and resilience? Let’s look at a few answers.

Companies learned, through past crises this century, to successfully run cost-reduction programs to maximize the efficiency of their operations. But since last year, we’ve been living through a “perfect storm” where the need to cut costs is just one more factor alongside the imperative of digital transformation, in a hostile context of growing threats and risks, and with shrinking budgets to match.

This moment is also, then, a turning point for how cybersecurity develops within the company, one that requires making strategic decisions (and getting them right), prioritizing key initiatives, and executing them successfully in a fast-changing context. In short, how do you do more (and better) with less.

The context

There’s no shortage of statistics showing the reality of growing threats over the past year, multiplied since the start of the COVID-19 crisis, with almost weekly examples of Spanish companies seeing their operations seriously affected by cyberattacks.

Without drowning you in a flood of data, what we can say is that any company, regardless of sector, is going to suffer (if it hasn’t already) a serious cyber incident that puts its operations, reputation and even its market survival at risk within the next two or three years.

Of course, company size, sector and regulation, among other factors, shape each organization’s maturity level, but regardless of that, the constant-change context we live in (everything is “agile” now) also calls for an agile review of where cybersecurity stands in the company, where it’s headed, and how prepared the organization is for a major crisis (which will come, for sure).

Return on investment

Security ROI was the Holy Grail that seemed easy to state, hard to explain, and impossible for company CISOs to actually achieve. But now that there’s a track record of the economic consequences of cyber crises at major companies across multiple industries (e.g., data breaches with a measurable financial impact on stock valuation, or fines imposed by regulators), it’s a concept worth reinforcing and bringing back as a throughline in cybersecurity discussions at the leadership level.

Think of a CFO whose sole objective is to protect the company’s EBITDA, wondering why profit needs to drop 1% to fund cybersecurity investment. That question isn’t just for the CISO to answer, it may also mean justifying that more is needed without using a single technical word that muddies the discussion.

Keeping this conversation alive at the leadership level is still an open item for many companies, and it requires setting a shared tone so business, technology and security stay aligned.