Why company cluture is undermining our ability to appreciate risk and so prepare for or cope with the cyber threat:
We have a problem with the way that almost ALL organisations operate (this is covered in series of guest blogs that we were invited to do for Commvault. The first one in the series was: 9 Tips For CXOs Post COVID19 – Data, Risk And Digital Transformation). In the second blog in the series we go onto explain:
The way that almost all departments in almost all organisations are managed and incentivised is based on revenue and profit. These are return on investment (ROI) measures. As long as this is the way that individuals are incentivised and organisations are managed, there will be little or no effective risk appreciation. About the only senior manager focused not on ROI, but instead on return on risk (ROR), is the CISO, but as long as he is at odds with the rest of the management team the CISO is at risk of not only finding that he is isolated (what I term CISOlation), but that he is also scapegoated when things go wrong – even if his warnings were ignored. It is as if the senior management team are watching a TV where only two of the three colour feeds are working (revenue and profit). They can see roughly what is happening across the business, but they don’t get the full picture. When major risks do appear, often out of the blue, they are visible to the CISO, but not to the others and if his warnings are ignored then this can lead to calamity.
We have seen this time and again – with credit risk in the global financial crisis and the health hazard during the pandemic, each time there were warnings but they were ignored because organisations had a focus on ROI and not ROR. The difference this time is that the cyber risk is not only visible and evidently growing, but organisations also still have time to address it.
AND it is not just a threat, it is also an opportunity. As we explain in the first Commvault blog:
Few however realize that flexibility and risk awareness can together be a powerful source of competitive advantage. Dominant players tend to use their scale to sustain market leadership, but during major disruption events, if they lack the risk awareness to be crisis prepared and the flexibility to respond effectively, then they can fall rapidly from grace. Such events are a real opportunity for flexible, risk-aware organizations not only to capture market share, but even also to capture entire markets. They are well positioned to thrive while those around them flounder.
