Greater cyberthreats are changing the way executives manage and invest in cybersecurity, adopting systemic risk management frameworks that combine hardware, software and operations protocols to mitigate cyber risk.

Those are the findings of a study from Southern Methodist University’s Darwin Deason Institute for Cyber Security, which was sponsored by IBM Security. The study, Identifying How Firms Manage Cybersecurity Investment, was based on a semi-structured survey of 40 executives across financial, retail, healthcare and government sectors. Participants were mostly chief informationsecurity officers (CISOs) and selected primarily from large firms.

More than 80 percent of those interviewed reported broad and increasing support among senior-level management and corporate boards for their cybersecurity efforts. 

Security budgets have increased for 88 percent of respondents. The majority of respondents cited news coverage of large and harmful security breaches as the driver of that support.

While 46 percent of interview subjects believe their organization is spending the right amount of money on cybersecurity, 64 percent reported that their peers were spending too little.

Getting funding for their cybersecurity efforts is not challenging, most respondents said, but finding and hiring skilled cybersecurity personnel is. And, this lack of qualified, available cybersecurity professionals means they can't staff cybersecurity measures as fast as senior management can fund them. 

“Cybersecurity is more than a technology challenge,” said Fred Chang, director of the Deason Institute in SMU’s Bobby B. Lyle School of Engineering. “Dealing with the landscape as it exists today means making decisions within specific management cultures and understanding what drives the decision-making process. By explaining the move from compliance to risk-based cybersecurity programs we see in many C-suites, this report connects the dots for people making important decisions about what it takes to maintain privacy, financial security and operating capability—all of which are vulnerable.”

The widespread use of security frameworks shows a general maturation of cyber risk management, the study notes.

“Companies are realizing that simply checking the box for compliance requirements is no longer a sufficient security strategy,” said Bob Kalka, vice president of IBM Security. “Hackers are becoming increasingly sophisticated in the battle for corporate data, and the survey results show that companies are evolving their security to keep pace. The increasing use of strategic, risk-based frameworks is a huge step forward in protecting these organizations’ most critical assets.”