This is a newer concept to many executives who have viewed security teams like firefighters, paid to answer endless alarm bells. However, after a year of working with outcome-based cybersecurity, I can assure you that this is possible. But we’ve found that a new vision requires a new approach.
I’ll use our company as an example. At WithSecure, we would like to have credibility in the way we secure ourselves because this is the business we’re in and what we sell. This goes beyond any short-term strategy. As a result, our business outcomes include avoiding material downtime for our services because what we do is critical for our customers. And we’re doing everything we can to produce very satisfied partners and customers, a desired outcome shared by many organizations.
Anyone who has spent any time thinking about cybersecurity knows how multifaceted and complicated our digital supply chains are today. That means we need to empower people who are working directly with the different touch points in the supply chain and elevate their cybersecurity thinking. They need all the information and resources available to ensure they only push secure software to customers.
When we talk about costs here, we mean actual costs. This includes external consultant fees, CISO office salaries, MDR subscriptions, security training and platform subscriptions. When confronted with these numbers, we can make decisions that aren’t only guided by whims or immediate needs.