The Personal Liability Trap and Evolving Regulatory Volatility

The illusion of Cybersecurity maturity is causing boards and IT leaders to prioritize technology trends and rapid innovation while spending on foundational defenses and operational resilience dwindles. This has accelerated due to the recent AI Boom but the “Green Dashboard Illusion” has underpinned this for years.

Takeaways for your Clarity:

Read Time: 4-6 minutes

• The Maturity Chasm: A widening communications gap leaves executives believing security capabilities are far more advanced that their underlying technical reality.
• The Dashboard Trap: The green dashboard illusion conveys a point-in-time compliance based adherence to frameworks, not active defense against live adversaries.
• The Budget Disconnect: Believing security is a “solved problem” causes leadership to freeze or flatten cybersecurity funding, while prioritizing high-risk technology initiatives.
• The Shift: Discussion needs to shift from “capability building”, which implies a stopping point to “maintaining operational resilience”.

Mind the Gap

Security practitioners and IT leaders focus on the telemetry, tool integrations and unpatched edge vulnerabilities. Meanwhile the C-Suite and the board view security through industry reports, trends and polished summary decks aligned with compliance.

While distillation of complex technical metrics data into consumable and meaningful business insights for effective communication to executives is paramount, the gap in their understanding is widening as the business strives to innovate faster than the competition. Scrubbing technical friction from executive summaries to remain readable, implies to leadership that the Cybersecurity program and it’s capabilities are more advanced than the underlying reality.

When leaders believe that the Cybersecurity capability is mature and effective, they often file it under “problem solved”.

As security practitioners, we know that security is never solved. It is a dynamic and ever changing landscape of emerging threats and evolving tactics. When leadership sees “problem solved”, funds dry up. Threat actors have taken notice of this gap and are capitalizing on the unbalance of leaderships desire to innovate and security teams struggle to keep pace with lacking resources.

Compliance is not Security

In many organizations, executive leadership relies on compliance metrics tied to industry frameworks to gauge the effectiveness of the security program. While maintaining compliance is almost certainly required for any industry, these high-level point-in-time metrics do not accurately reflect the effectiveness or maturity of the overall program.

While these metrics are repeatable, they are often times not defensible. They do not represent the reality of how effective a program is at identifying, protecting, detecting, responding to or recovering from threats and incidents. This is one reason that the “Govern” function was added to the NIST CSF 2.0 Framework in 2024. It helps organizations establish and monitor their cybersecurity risk. To help security leadership bridge this gap and realign executive leadership and the business with cybersecurity strategy.

A result of this realignment has been a shift in accountability. The C-Suite now has some skin in the security game. This means proper alignment of capability, risk and maturity has a direct (in some cases financial) impact on those outside of IT. More overtly, the SEC has also changed it’s disclosure rules, putting additional regulatory pressures on executive leadership to ensure due diligence/care is taken with regards to cybersecurity.

Adversarial Resilience is the new metric

The days of the linear attack vector are rapidly coming to a close. As the business adopts new technologies such as AI and powerful utility based compute, so too does the adversary. This calls for yet another paradigm shift in how security is implemented and program effectiveness reported up.

Becoming resilient in the face of attack is the new defense that must be considered. Much the way AI introduces probabilistic outcomes, attackers are no longer deterministic in their approach. They can shift tactics on a dime while maintaining effectiveness and defenders must do the same. This does not mean abandon traditional “defend” efforts, rather invest in detect, respond and recover more heavily. Everyone has likely heard the adage “it is not if, but when”. This is more true today than it has ever been, so the logical question becomes “when it happens, how well prepared are we?”.

This requires executive reporting that does not focus solely on compliance, but emphasizes risk and the ability to maintain business continuity in the face of adversity. Measurements may include mean-time to respond/recover, mission impact mapped to business unit. Producing a quantitative Cyber Resilience Score is one such example, with detailed metrics distilled into easily understood impact to the business and the bottom line.

The capability conundrum

Cybersecurity has historically focused on capabilities. Building, deploying operating and iterating on capabilities remains a valuable component of a mature program, but maintaining operational resilience is of equal importance. It all boils town to the “three-legged stool” problem of people, process and technology.

Many leaders see the technology aspect of cybersecurity as the problem solver. It is the tool evaluating the adherence to standard and producing the metric. It does the technical job of defending the perimeter. The problem is when the process for operating the capability are ignored. Resilience relies of people and process more so than technology.

Funding the people and the process aspect of cybersecurity has largely been ignored by many organizations, and the results are apparent in the news. A properly balanced and operationally resilient program consists of a stool with equal length legs. Capabilities can not operate autonomously (yet) and resilience relies on people and process, and will continue to do so for the foreseeable future.