Most executives spending less than a day on cyber risk – Marsh study

Most board members and senior executives responsible for their organisations’ cyber risk management had less than a day last year to spend focused on cyber risk issues, according to a new report from Marsh and Microsoft.

This lack of time to focus on cyber risk comes as concern as cyber threats hit an all-time high – and as confidence in organisations’ ability to manage cyber threats declines, according to the 2019 Marsh Microsoft Global Cyber Risk Perception survey. The survey scrutinised 1,500 organisations to determine the current state of cyber risk perceptions and risk management.

Nearly 80% of organisations now rank cyber risk as a top-five concern, up from 62% in 2017, when the study was last conducted. However, only 11% expressed a high degree of confidence in their ability to assess, prevent and respond effectively to cyber threats. That’s down from 19% in 2017. Cyber risk management remains a challenge for many organisations, the survey found.

“For example, while nearly two-thirds (65%) of organisations surveyed identified a senior executive or board member as a main owner of cyber risk management, only 17% of c-suite executives and board members said they spent more than a few days in the past year focusing on the issue,” Marsh said. “More than half, 51%, spent several hours or less.” While 88% of survey respondents identified their information technology and information security functions as the primary owners of cyber risk management, 30% of IT respondents said they spent only a few days or less over the past year focusing on cyber risk.

“We are well into the age of cyber risk awareness, yet too many organisations still struggle with creating a strong cybersecurity culture with appropriate levels for governance, prioritisation, management focus, and ownership,” said Kevin Richards, head of cyber risk consulting at Marsh. “This places them at a disadvantage both in building cyber resilience and in confronting the increasingly complex cyber landscape.”

“In an era of transformational technology and more interconnected supply chains, the cyber risk management practices and mindsets of yesterday no longer suffice and may actually inhibit innovation,” said Joram Borenstein, general manager of Microsoft’s Cyber Security Solutions Group. “It is incumbent upon senior leaders to focus on these issues for the welfare of their organisations, their customers, their employees, and beyond.”

Source: Insurance Business UK