Key findings from the survey include:
- 61 percent said they don’t communicate security risk with senior executives or only communicate when a serious security risk is revealed
- 38 percent said that collaboration between security risk management and business is poor, non-existent or adversarial. 47 percent rated their communication of relevant security risks to executives as “not effective”.
- 57 percent of the respondents said communications are too siloed
- 63 percent said communication occurs at too low a level
- 56 percent said the information is too technical to be understood by non-technical management
- 50 percent said negative facts are filtered before being disclosed to senior executives and the CEO
- 35 percent said it takes too much time to prepare report metrics to senior executives.
“Risk provides the common language that enables the a broader business conversation about cyber security risks, particularly when dealing with non-technical executives”, noted Dwayne Melancon, chief technology officer for Tripwire. “However, it's clear from this report that most organizations are missing the majority of opportunities to integrate security risks into day-to-day business decisions. Changing this paradigm will require security professionals to develop new communication skills so they can talk about security risks in terms that are clearly relevant to the top-level business goals.”
The study respondents included 749 U.S. and 571 U.K. professionals in the following areas: IT security, IT operations, IT risk management, business operations, compliance/internal audit and enterprise risk management.