Cyber Security in Focus is an annual research report that explores the perceptions of a high-quality sample of 60 CISOs and security leaders on critical themes such as: the skills shortage, barriers to strategy execution, the perception of cyber security functions, and future technology investment. The sampled respondents were sourced from Stott and May’s professional network across EMEA and North America.

This year’s report reveals that CISOs see budget as the biggest barrier to strategy execution in 2023.

Today’s security leaders face a range of barriers to strategy executing, and the state of the economy is starting to drive a new narrative for CISOs — many of whom are being asked to do more with less.

Challenges — including tackling the internal skills gap, achieving the right level of executive support from the business, building a security culture, and making sound technology investment decisions — have hampered digital transformation and cybersecurity efforts.

In the paper, Haris Pylarinos, Founder & CEO of Hack The Box, shared his thoughts on the top challenges CISOs face when building a high-performing security function. “It’s the ability to stay outward looking and ensure that internal skills stay up to date. You can hire the best security professionals out there with field experience, but the problem is that this knowledge can degrade over time because cyber security is evolving at such a rapid pace.”

The Findings 

51% of security leaders highlighted budget as their primary inhibitor to delivering on strategy, taking over internal skills (34%) for the first time. These were followed by board-level buy-in (11%), and technology (3%) also being cited as issues by the global sample of CISOs.

The report confirmed the continuation of many other trends in cybersecurity: filling vacancies continues to be a pain point for security leaders.

66% are facing challenges in sourcing talent for their business, with 69% of security vacancies left unfilled after 8 weeks.

Further, CISOs report that salary expectations across the industry continue to increase, with 47% believing that salary levels have increased by more than 11% year-on-year. A further 31% see wage inflation sitting between six and 10%.

Recommended

• Scots Rural Fibre Firm Secures £20M to Boost Targeted Rollout
• Ofcom Proposes to Refer UK Cloud Market for Investigation
• Scot-Secure 2023 | Security Through Anonymisation

As a consequence of 44% leaders reporting their budget will stay the same or decrease, strategic investment has little room for experimentation. Only 53% of respondents believe security investment is keeping pace with digital business. The top three priority investment areas for CISOs in 2023 are cloud security (25%), IAM (20%) and security and vulnerability management (18%).

Despite these challenges, 55% of security leaders do believe that their company sees cyber security as a strategic priority, while 60% agree their business feels that the security function improves the overall value proposition to customers.

Chris Castaldo, CISO at Crossbeam, outlined his thoughts on the main barriers that CISOs come across when executing their cyber security roadmaps. “Not understanding the business. That’s the main barrier. Everyone that I talk to that’s trying to implement some new tool or a new process or policy and meets resistance typically hasn’t spent enough time trying to understand what those stakeholders really care about and tailoring that message to them.”