The latest edition of the Allianz Risk Barometer confirms what organisational leaders have been experiencing. A digital world means more efficiency, lower cost, greater opportunity, and much faster speed for business. But it also comes with new risks – cyber risks – which top the Risk Barometer, followed by business interruption.
Some definitions limit cyber risks to cybercrime. However, there are other concerns under the category, such as data loss, negligent and malicious employee actions, digital weaknesses in supply chains, legacy technologies, and governance failures, such as publishing sensitive information publicly or not adhering to privacy legislation.
“It’s enough to make one’s head spin,” says Gerhard Swart, chief technology officer at Performanta. “Traditional businesses have a lot of risks to track. If we’re honest, most don’t and hope they don’t get into too much trouble.
“The problem with digital and cyber risks is that they tend to be present everywhere in a business and by their nature can escalate very quickly. For example, if a Point-of-Sale platform or payment service goes down, it could stop transactions at several branches.
“But that’s a lot of extra elements to track and most businesses don’t know where to start or what to prioritise.”
There isn’t a miracle service or process that will encompass all cyber risks. But companies can start their cyber risk management journey on the right foot with a potent suite of technologies that also pave the way to take control of the digital era’s new challenges.
Cyber Risks Need Visibility
A dive into the Allianz Risk Barometer reveals the most crucial cyber risks: data breaches, attacks on critical infrastructure, and ransomware. Those are primarily cybercrime risks, but if we take a step back, those same domains also affect data loss (intentional or accidental), failure of cyber infrastructure such as disconnected networks, and employee and partner actions.
It’s a message that the cybersecurity world has been promoting for a while–digital is everywhere, and security is an integral part of digital environments. Where digital goes, security follows, and security can identify more risks than just cybercrime.
“Think of it this way: if you lose important business data, does it matter how you lost it? Of course, you need to know what happened. But whether the data went missing because a system crashed, an employee deleted it, or a criminal encrypted it for ransom, the outcome is often the same. This is why we ask businesses not to treat security as a separate function. Security risks and other digital risks are often related, and they often come down to one thing – visibility,” says Swart.
Many organisations do not have clear views of what is going on in their systems. Whether it’s an outdated system close to collapse, an employee casually sending sensitive files to their personal email address so they can work at home, or someone trying to break into systems, visibility is the difference between dodging cyber blows and taking it on the chin.
Yet complexity erodes visibility, and today’s digital companies have layers upon layers of complex systems, processes, and relationships. Criminals love complexity. Like cracks in bricks and wood hide cockroaches, bad actors hide in the blind spots of digital complexity.
But visibility doesn’t just address cybercrime. It exposes most cyber risks. And if you can address visibility issues on the cybersecurity level, you build the foundations for other types of visibility as well.
Detect and Respond
To put that differently, if you improve security visibility, you start to improve other types of visibility. For example, security visibility of data encourages better overall data management. Security visibility of employee actions towards digital assets can also reinforce good governance and responsible practices. And security visibility of business systems supports better general maintenance of those systems.
Better security visibility leads to better visibility of digital estates and activities, which helps companies manage their wider range of cyber risks. Yet cybersecurity is already a demanding landscape of risks, so what is the best place to start and ensure these wider opportunities? Swart recommends looking at extended detection and response, or XDR.
“XDR is a security concept that combines different tools to actively detect problems and attacks. For example, it collects and examines a large amount of data from across a business. It looks at employee behaviours, system performance, activity logs and such things, analysing them for unusual patterns.
“But this is not spying. XDR isn’t Big Brother. It’s the very intelligent canary in the coalmine. It raises flags when something seems off, and it does this far more widely and quickly than any single system or team of humans ever could,” says Swart.
Since XDR’s inception, technology providers have combined different security products and services to create the most effective forms of XDR. It’s not a fixed product but a collaboration between specific technologies, services, and human skills. Taken as a whole, XDR represents a practical culture and philosophy for digital visibility–and that is why it’s an excellent answer to cyber risk concerns.
Organisations can tackle cyber risks by focusing on the visibility of their digital world. XDR provides an excellent way to channel those goals and tackle the most concerning cybersecurity risks. By investing in security visibility, you start to create visibility of all your digital risks.